diff --git a/adb/adb_auth_client.c b/adb/adb_auth_client.c
index f8d730645..8409c6339 100644
--- a/adb/adb_auth_client.c
+++ b/adb/adb_auth_client.c
@@ -57,7 +57,7 @@ static void read_keys(const char *file, struct listnode *list)
     char *sep;
     int ret;
 
-    f = fopen(file, "r");
+    f = fopen(file, "re");
     if (!f) {
         D("Can't open '%s'\n", file);
         return;
@@ -126,7 +126,7 @@ int adb_auth_generate_token(void *token, size_t token_size)
     FILE *f;
     int ret;
 
-    f = fopen("/dev/urandom", "r");
+    f = fopen("/dev/urandom", "re");
     if (!f)
         return 0;
 
@@ -257,6 +257,7 @@ void adb_auth_init(void)
         D("Failed to get adbd socket\n");
         return;
     }
+    fcntl(fd, F_SETFD, FD_CLOEXEC);
 
     ret = listen(fd, 4);
     if (ret < 0) {
diff --git a/adb/file_sync_service.c b/adb/file_sync_service.c
index 1d80d26ac..b2975529b 100644
--- a/adb/file_sync_service.c
+++ b/adb/file_sync_service.c
@@ -178,18 +178,18 @@ static int handle_send_file(int s, char *path, uid_t uid,
     unsigned int timestamp = 0;
     int fd;
 
-    fd = adb_open_mode(path, O_WRONLY | O_CREAT | O_EXCL, mode);
+    fd = adb_open_mode(path, O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC, mode);
     if(fd < 0 && errno == ENOENT) {
         if(mkdirs(path) != 0) {
             if(fail_errno(s))
                 return -1;
             fd = -1;
         } else {
-            fd = adb_open_mode(path, O_WRONLY | O_CREAT | O_EXCL, mode);
+            fd = adb_open_mode(path, O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC, mode);
         }
     }
     if(fd < 0 && errno == EEXIST) {
-        fd = adb_open_mode(path, O_WRONLY, mode);
+        fd = adb_open_mode(path, O_WRONLY | O_CLOEXEC, mode);
     }
     if(fd < 0) {
         if(fail_errno(s))
@@ -383,7 +383,7 @@ static int do_recv(int s, const char *path, char *buffer)
     syncmsg msg;
     int fd, r;
 
-    fd = adb_open(path, O_RDONLY);
+    fd = adb_open(path, O_RDONLY | O_CLOEXEC);
     if(fd < 0) {
         if(fail_errno(s)) return -1;
         return 0;
diff --git a/adb/remount_service.c b/adb/remount_service.c
index d3a649bfb..3a4535ec0 100644
--- a/adb/remount_service.c
+++ b/adb/remount_service.c
@@ -39,7 +39,7 @@ static char *find_mount(const char *dir)
     const char delims[] = "\n";
     char buf[4096];
 
-    fd = unix_open("/proc/mounts", O_RDONLY);
+    fd = unix_open("/proc/mounts", O_RDONLY | O_CLOEXEC);
     if (fd < 0)
         return NULL;
 
@@ -83,7 +83,7 @@ static int remount_system()
     if (!dev)
         return -1;
 
-    fd = unix_open(dev, O_RDONLY);
+    fd = unix_open(dev, O_RDONLY | O_CLOEXEC);
     if (fd < 0)
         return -1;
 
diff --git a/adb/services.c b/adb/services.c
index e48e4603e..528585a2c 100644
--- a/adb/services.c
+++ b/adb/services.c
@@ -190,7 +190,7 @@ static void init_subproc_child()
     setsid();
 
     // Set OOM score adjustment to prevent killing
-    int fd = adb_open("/proc/self/oom_score_adj", O_WRONLY);
+    int fd = adb_open("/proc/self/oom_score_adj", O_WRONLY | O_CLOEXEC);
     if (fd >= 0) {
         adb_write(fd, "0", 1);
         adb_close(fd);
@@ -209,12 +209,11 @@ static int create_subproc_pty(const char *cmd, const char *arg0, const char *arg
     char *devname;
     int ptm;
 
-    ptm = unix_open("/dev/ptmx", O_RDWR); // | O_NOCTTY);
+    ptm = unix_open("/dev/ptmx", O_RDWR | O_CLOEXEC); // | O_NOCTTY);
     if(ptm < 0){
         printf("[ cannot open /dev/ptmx - %s ]\n",strerror(errno));
         return -1;
     }
-    fcntl(ptm, F_SETFD, FD_CLOEXEC);
 
     if(grantpt(ptm) || unlockpt(ptm) ||
        ((devname = (char*) ptsname(ptm)) == 0)){
@@ -233,7 +232,7 @@ static int create_subproc_pty(const char *cmd, const char *arg0, const char *arg
     if (*pid == 0) {
         init_subproc_child();
 
-        int pts = unix_open(devname, O_RDWR);
+        int pts = unix_open(devname, O_RDWR | O_CLOEXEC);
         if (pts < 0) {
             fprintf(stderr, "child failed to open pseudo-term slave: %s\n", devname);
             exit(-1);
@@ -417,7 +416,7 @@ int service_to_fd(const char *name)
 #endif
 #if !ADB_HOST
     } else if(!strncmp("dev:", name, 4)) {
-        ret = unix_open(name + 4, O_RDWR);
+        ret = unix_open(name + 4, O_RDWR | O_CLOEXEC);
     } else if(!strncmp(name, "framebuffer:", 12)) {
         ret = create_service_thread(framebuffer_service, 0);
     } else if (!strncmp(name, "jdwp:", 5)) {
diff --git a/adb/usb_linux.c b/adb/usb_linux.c
index 8ff753e43..f16bdd036 100644
--- a/adb/usb_linux.c
+++ b/adb/usb_linux.c
@@ -170,7 +170,7 @@ static void find_usb_device(const char *base,
             }
 
 //            DBGX("[ scanning %s ]\n", devname);
-            if((fd = unix_open(devname, O_RDONLY)) < 0) {
+            if((fd = unix_open(devname, O_RDONLY | O_CLOEXEC)) < 0) {
                 continue;
             }
 
@@ -597,10 +597,10 @@ static void register_device(const char *dev_name, const char *devpath,
     usb->mark = 1;
     usb->reaper_thread = 0;
 
-    usb->desc = unix_open(usb->fname, O_RDWR);
+    usb->desc = unix_open(usb->fname, O_RDWR | O_CLOEXEC);
     if(usb->desc < 0) {
         /* if we fail, see if have read-only access */
-        usb->desc = unix_open(usb->fname, O_RDONLY);
+        usb->desc = unix_open(usb->fname, O_RDONLY | O_CLOEXEC);
         if(usb->desc < 0) goto fail;
         usb->writeable = 0;
         D("[ usb open read-only %s fd = %d]\n", usb->fname, usb->desc);