diff --git a/main.cpp b/main.cpp
index b127bb0..8a3f845 100644
--- a/main.cpp
+++ b/main.cpp
@@ -33,6 +33,7 @@
 #include "cutils/klog.h"
 #include "cutils/log.h"
 #include "cutils/properties.h"
+#include "cutils/sockets.h"
 
 #include "Disk.h"
 #include "VolumeManager.h"
@@ -71,6 +72,9 @@
         selinux_android_set_sehandle(sehandle);
     }
 
+    // Quickly throw a CLOEXEC on the socket we just inherited from init
+    fcntl(android_get_control_socket("vold"), F_SETFD, FD_CLOEXEC);
+
     mkdir("/dev/block/vold", 0755);
 
     /* For when cryptfs checks and mounts an encrypted filesystem */
@@ -155,7 +159,7 @@
 
     dfd = dirfd(d);
 
-    fd = openat(dfd, "uevent", O_WRONLY);
+    fd = openat(dfd, "uevent", O_WRONLY | O_CLOEXEC);
     if(fd >= 0) {
         write(fd, "add\n", 4);
         close(fd);