diff --git a/src/ldso/dynlink.c b/src/ldso/dynlink.c
index d0b57e8d68496242b6bcc8b68adb983ea30b37a1..960e08986404b8c7f2378e73d0c49ec9d64f33cc 100644
--- a/src/ldso/dynlink.c
+++ b/src/ldso/dynlink.c
@@ -438,7 +438,7 @@ static struct dso *load_library(const char *name)
 		if (fd < 0 && env_path) fd = path_open(name, env_path, buf, sizeof buf);
 		if (fd < 0) {
 			if (!sys_path) {
-				FILE *f = fopen(ETC_LDSO_PATH, "r");
+				FILE *f = fopen(ETC_LDSO_PATH, "rbe");
 				if (f) {
 					if (getline(&sys_path, (size_t[1]){0}, f) > 0)
 						sys_path[strlen(sys_path)-1]=0;
diff --git a/src/legacy/getusershell.c b/src/legacy/getusershell.c
index 683158c85af5e615fcbfdfc8842457a96c297aee..f31f4042f928f2254c69f66f73d8c5aa74449b58 100644
--- a/src/legacy/getusershell.c
+++ b/src/legacy/getusershell.c
@@ -17,7 +17,7 @@ void endusershell(void)
 
 void setusershell(void)
 {
-	if (!f) f = fopen("/etc/shells", "rb");
+	if (!f) f = fopen("/etc/shells", "rbe");
 	if (!f) f = fmemopen((void *)defshells, sizeof defshells - 1, "rb");
 }
 
diff --git a/src/passwd/getgr_r.c b/src/passwd/getgr_r.c
index 1dc5f7e0e38df9398eaadbdb5e0291a546b599b8..234c90131143fd98fa3fef7c5954d7da8855144f 100644
--- a/src/passwd/getgr_r.c
+++ b/src/passwd/getgr_r.c
@@ -16,7 +16,7 @@ static int getgr_r(const char *name, gid_t gid, struct group *gr, char *buf, siz
 
 	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
 
-	f = fopen("/etc/group", "rb");
+	f = fopen("/etc/group", "rbe");
 	if (!f) {
 		rv = errno;
 		goto done;
diff --git a/src/passwd/getgrent.c b/src/passwd/getgrent.c
index 4cbe1ebfeaebe970592b327c0e36e643f2e7fa02..429a3e58a7aa9b72fd533720b7a2571831becb19 100644
--- a/src/passwd/getgrent.c
+++ b/src/passwd/getgrent.c
@@ -15,7 +15,7 @@ struct group *getgrent()
 	static char *line, **mem;
 	static struct group gr;
 	size_t size=0, nmem=0;
-	if (!f) f = fopen("/etc/group", "rb");
+	if (!f) f = fopen("/etc/group", "rbe");
 	if (!f) return 0;
 	return __getgrent_a(f, &gr, &line, &size, &mem, &nmem);
 }
diff --git a/src/passwd/getpw_r.c b/src/passwd/getpw_r.c
index 39744959ad12401be77295e8f4ead9226a6152de..285525727dc74647e56726f2f894956d00776fa0 100644
--- a/src/passwd/getpw_r.c
+++ b/src/passwd/getpw_r.c
@@ -13,7 +13,7 @@ static int getpw_r(const char *name, uid_t uid, struct passwd *pw, char *buf, si
 
 	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
 
-	f = fopen("/etc/passwd", "rb");
+	f = fopen("/etc/passwd", "rbe");
 	if (!f) {
 		rv = errno;
 		goto done;
diff --git a/src/passwd/getpwent.c b/src/passwd/getpwent.c
index e8501461a794c90eb39610ab5c3b34727e79fd3a..c655135e254fd168fdc2f43cc5bbfbeafad072f1 100644
--- a/src/passwd/getpwent.c
+++ b/src/passwd/getpwent.c
@@ -15,7 +15,7 @@ struct passwd *getpwent()
 	static char *line;
 	static struct passwd pw;
 	size_t size=0;
-	if (!f) f = fopen("/etc/passwd", "rb");
+	if (!f) f = fopen("/etc/passwd", "rbe");
 	if (!f) return 0;
 	return __getpwent_a(f, &pw, &line, &size);
 }
diff --git a/src/passwd/getspnam_r.c b/src/passwd/getspnam_r.c
index 9f3378e96c8c4cc40330cec189d12f4616b9b341..f4d7b35e18ce8f1c871051887a9fecc14733006e 100644
--- a/src/passwd/getspnam_r.c
+++ b/src/passwd/getspnam_r.c
@@ -46,7 +46,7 @@ int getspnam_r(const char *name, struct spwd *sp, char *buf, size_t size, struct
 	if (snprintf(path, sizeof path, "/etc/tcb/%s/shadow", name) >= sizeof path)
 		return EINVAL;
 
-	fd = open(path, O_RDONLY|O_NOFOLLOW|O_NONBLOCK);
+	fd = open(path, O_RDONLY|O_NOFOLLOW|O_NONBLOCK|O_CLOEXEC);
 	if (fd >= 0) {
 		struct stat st = { 0 };
 		errno = EINVAL;
@@ -57,7 +57,7 @@ int getspnam_r(const char *name, struct spwd *sp, char *buf, size_t size, struct
 			return errno;
 		}
 	} else {
-		f = fopen("/etc/shadow", "rb");
+		f = fopen("/etc/shadow", "rbe");
 		if (!f) return errno;
 	}
 
diff --git a/src/time/getdate.c b/src/time/getdate.c
index 8ed650a4cee57c738a1f5fc86f9fcd7c5a937d21..89f21699125655eb27b1efa780a4e6f7ef0755de 100644
--- a/src/time/getdate.c
+++ b/src/time/getdate.c
@@ -22,7 +22,7 @@ struct tm *getdate(const char *s)
 		goto out;
 	}
 
-	f = fopen(datemsk, "r");
+	f = fopen(datemsk, "rbe");
 	if (!f) {
 		if (errno == ENOMEM) getdate_err = 6;
 		else getdate_err = 2;