8 files changed, 9 insertions, 9 deletions
diff --git a/src/ldso/dynlink.c b/src/ldso/dynlink.c
index d0b57e8d..960e0898 100644
--- a/src/ldso/dynlink.c
+++ b/src/ldso/dynlink.c
@@ -438,7 +438,7 @@ static struct dso *load_library(const char *name)
 		if (fd < 0 && env_path) fd = path_open(name, env_path, buf, sizeof buf);
 		if (fd < 0) {
 			if (!sys_path) {
-				FILE *f = fopen(ETC_LDSO_PATH, "r");
+				FILE *f = fopen(ETC_LDSO_PATH, "rbe");
 				if (f) {
 					if (getline(&sys_path, (size_t[1]){0}, f) > 0)
 						sys_path[strlen(sys_path)-1]=0;
diff --git a/src/legacy/getusershell.c b/src/legacy/getusershell.c
index 683158c8..f31f4042 100644
--- a/src/legacy/getusershell.c
+++ b/src/legacy/getusershell.c
@@ -17,7 +17,7 @@ void endusershell(void)
 
 void setusershell(void)
 {
-	if (!f) f = fopen("/etc/shells", "rb");
+	if (!f) f = fopen("/etc/shells", "rbe");
 	if (!f) f = fmemopen((void *)defshells, sizeof defshells - 1, "rb");
 }
 
diff --git a/src/passwd/getgr_r.c b/src/passwd/getgr_r.c
index 1dc5f7e0..234c9013 100644
--- a/src/passwd/getgr_r.c
+++ b/src/passwd/getgr_r.c
@@ -16,7 +16,7 @@ static int getgr_r(const char *name, gid_t gid, struct group *gr, char *buf, siz
 
 	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
 
-	f = fopen("/etc/group", "rb");
+	f = fopen("/etc/group", "rbe");
 	if (!f) {
 		rv = errno;
 		goto done;
diff --git a/src/passwd/getgrent.c b/src/passwd/getgrent.c
index 4cbe1ebf..429a3e58 100644
--- a/src/passwd/getgrent.c
+++ b/src/passwd/getgrent.c
@@ -15,7 +15,7 @@ struct group *getgrent()
 	static char *line, **mem;
 	static struct group gr;
 	size_t size=0, nmem=0;
-	if (!f) f = fopen("/etc/group", "rb");
+	if (!f) f = fopen("/etc/group", "rbe");
 	if (!f) return 0;
 	return __getgrent_a(f, &gr, &line, &size, &mem, &nmem);
 }
diff --git a/src/passwd/getpw_r.c b/src/passwd/getpw_r.c
index 39744959..28552572 100644
--- a/src/passwd/getpw_r.c
+++ b/src/passwd/getpw_r.c
@@ -13,7 +13,7 @@ static int getpw_r(const char *name, uid_t uid, struct passwd *pw, char *buf, si
 
 	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
 
-	f = fopen("/etc/passwd", "rb");
+	f = fopen("/etc/passwd", "rbe");
 	if (!f) {
 		rv = errno;
 		goto done;
diff --git a/src/passwd/getpwent.c b/src/passwd/getpwent.c
index e8501461..c655135e 100644
--- a/src/passwd/getpwent.c
+++ b/src/passwd/getpwent.c
@@ -15,7 +15,7 @@ struct passwd *getpwent()
 	static char *line;
 	static struct passwd pw;
 	size_t size=0;
-	if (!f) f = fopen("/etc/passwd", "rb");
+	if (!f) f = fopen("/etc/passwd", "rbe");
 	if (!f) return 0;
 	return __getpwent_a(f, &pw, &line, &size);
 }
diff --git a/src/passwd/getspnam_r.c b/src/passwd/getspnam_r.c
index 9f3378e9..f4d7b35e 100644
--- a/src/passwd/getspnam_r.c
+++ b/src/passwd/getspnam_r.c
@@ -46,7 +46,7 @@ int getspnam_r(const char *name, struct spwd *sp, char *buf, size_t size, struct
 	if (snprintf(path, sizeof path, "/etc/tcb/%s/shadow", name) >= sizeof path)
 		return EINVAL;
 
-	fd = open(path, O_RDONLY|O_NOFOLLOW|O_NONBLOCK);
+	fd = open(path, O_RDONLY|O_NOFOLLOW|O_NONBLOCK|O_CLOEXEC);
 	if (fd >= 0) {
 		struct stat st = { 0 };
 		errno = EINVAL;
@@ -57,7 +57,7 @@ int getspnam_r(const char *name, struct spwd *sp, char *buf, size_t size, struct
 			return errno;
 		}
 	} else {
-		f = fopen("/etc/shadow", "rb");
+		f = fopen("/etc/shadow", "rbe");
 		if (!f) return errno;
 	}
 
diff --git a/src/time/getdate.c b/src/time/getdate.c
index 8ed650a4..89f21699 100644
--- a/src/time/getdate.c
+++ b/src/time/getdate.c
@@ -22,7 +22,7 @@ struct tm *getdate(const char *s)
 		goto out;
 	}
 
-	f = fopen(datemsk, "r");
+	f = fopen(datemsk, "rbe");
 	if (!f) {
 		if (errno == ENOMEM) getdate_err = 6;
 		else getdate_err = 2;