diff --git a/CommandListener.cpp b/CommandListener.cpp
index e80bdce..c2b8310 100644
--- a/CommandListener.cpp
+++ b/CommandListener.cpp
@@ -36,6 +36,7 @@
 
 #include <android-base/logging.h>
 #include <android-base/stringprintf.h>
+#include <android-base/unique_fd.h>
 #include <cutils/fs.h>
 
 #include <sysutils/SocketClient.h>
@@ -54,6 +55,8 @@
 #define DUMP_ARGS 0
 #define DEBUG_APPFUSE 0
 
+using android::base::unique_fd;
+
 CommandListener::CommandListener() :
                  FrameworkListener("vold", true) {
     registerCmd(new DumpCmd());
@@ -120,7 +123,7 @@
         cli->sendMsg(ResponseCode::CommandOkay, "Devmapper dump failed", true);
     }
     cli->sendMsg(0, "Dumping mounted filesystems", false);
-    FILE *fp = fopen("/proc/mounts", "r");
+    FILE *fp = fopen("/proc/mounts", "re");
     if (fp) {
         char line[1024];
         while (fgets(line, sizeof(line), fp)) {
@@ -680,16 +683,16 @@
                    << " in namespace " << uid;
     }
 
-    const android::vold::ScopedDir dir(opendir("/proc"));
-    if (dir.get() == nullptr) {
+    unique_fd dir(open("/proc", O_RDONLY | O_DIRECTORY | O_CLOEXEC));
+    if (dir.get() == -1) {
         PLOG(ERROR) << "Failed to open /proc";
         return -errno;
     }
 
     // Obtains process file descriptor.
     const std::string pid_str = android::base::StringPrintf("%d", pid);
-    const android::vold::ScopedFd pid_fd(
-            openat(dirfd(dir.get()), pid_str.c_str(), O_RDONLY | O_DIRECTORY | O_CLOEXEC));
+    const unique_fd pid_fd(
+            openat(dir.get(), pid_str.c_str(), O_RDONLY | O_DIRECTORY | O_CLOEXEC));
     if (pid_fd.get() == -1) {
         PLOG(ERROR) << "Failed to open /proc/" << pid;
         return -errno;
@@ -715,7 +718,7 @@
         char rootName[PATH_MAX];
         char pidName[PATH_MAX];
         const int root_result =
-                android::vold::SaneReadLinkAt(dirfd(dir.get()), "1/ns/mnt", rootName, PATH_MAX);
+                android::vold::SaneReadLinkAt(dir.get(), "1/ns/mnt", rootName, PATH_MAX);
         const int pid_result =
                 android::vold::SaneReadLinkAt(pid_fd.get(), "ns/mnt", pidName, PATH_MAX);
         if (root_result == -1) {
@@ -733,7 +736,7 @@
     }
 
     // We purposefully leave the namespace open across the fork
-    android::vold::ScopedFd ns_fd(openat(pid_fd.get(), "ns/mnt", O_RDONLY));
+    unique_fd ns_fd(openat(pid_fd.get(), "ns/mnt", O_RDONLY)); // not O_CLOEXEC
     if (ns_fd.get() < 0) {
         PLOG(ERROR) << "Failed to open namespace for /proc/" << pid << "/ns/mnt";
         return -errno;
@@ -811,7 +814,7 @@
         }
 
         // Open device FD.
-        android::vold::ScopedFd device_fd(open("/dev/fuse", O_RDWR));
+        unique_fd device_fd(open("/dev/fuse", O_RDWR)); // not O_CLOEXEC
         if (device_fd.get() == -1) {
             PLOG(ERROR) << "Failed to open /dev/fuse";
             return sendGenericOkFail(cli, -errno);
diff --git a/Loop.cpp b/Loop.cpp
index 7e243de..6ec5e6d 100644
--- a/Loop.cpp
+++ b/Loop.cpp
@@ -237,7 +237,7 @@
 }
 
 int Loop::create(const std::string& target, std::string& out_device) {
-    unique_fd ctl_fd(open("/dev/loop-control", O_RDWR));
+    unique_fd ctl_fd(open("/dev/loop-control", O_RDWR | O_CLOEXEC));
     if (ctl_fd.get() == -1) {
         PLOG(ERROR) << "Failed to open loop-control";
         return -errno;
@@ -251,12 +251,12 @@
 
     out_device = StringPrintf("/dev/block/loop%d", num);
 
-    unique_fd target_fd(open(target.c_str(), O_RDWR));
+    unique_fd target_fd(open(target.c_str(), O_RDWR | O_CLOEXEC));
     if (target_fd.get() == -1) {
         PLOG(ERROR) << "Failed to open " << target;
         return -errno;
     }
-    unique_fd device_fd(open(out_device.c_str(), O_RDWR));
+    unique_fd device_fd(open(out_device.c_str(), O_RDWR | O_CLOEXEC));
     if (device_fd.get() == -1) {
         PLOG(ERROR) << "Failed to open " << out_device;
         return -errno;
@@ -295,37 +295,19 @@
 }
 
 int Loop::createImageFile(const char *file, unsigned long numSectors) {
-    int res = 0;
-
-    char* secontext = nullptr;
-    if (sehandle) {
-        if (!selabel_lookup(sehandle, &secontext, file, S_IFREG)) {
-            setfscreatecon(secontext);
-        }
-    }
-
-    unique_fd fd(creat(file, 0600));
+    unique_fd fd(open(file, O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC, 0600));
     if (fd.get() == -1) {
         PLOG(ERROR) << "Failed to create image " << file;
-        res = -errno;
-        goto done;
+        return -errno;
     }
-
     if (fallocate(fd.get(), 0, 0, numSectors * 512) == -1) {
         PLOG(WARNING) << "Failed to fallocate; falling back to ftruncate";
         if (ftruncate(fd, numSectors * 512) == -1) {
             PLOG(ERROR) << "Failed to ftruncate";
-            res = -errno;
+            return -errno;
         }
     }
-
-done:
-    if (secontext) {
-        setfscreatecon(nullptr);
-        freecon(secontext);
-    }
-
-    return res;
+    return 0;
 }
 
 int Loop::resizeImageFile(const char *file, unsigned long numSectors) {
diff --git a/Process.cpp b/Process.cpp
index 7dc0144..fd757d5 100644
--- a/Process.cpp
+++ b/Process.cpp
@@ -130,7 +130,7 @@
     char buffer[PATH_MAX + 100];
 
     snprintf(buffer, sizeof(buffer), "/proc/%d/maps", pid);
-    file = fopen(buffer, "r");
+    file = fopen(buffer, "re");
     if (!file)
         return 0;
     
diff --git a/Utils.cpp b/Utils.cpp
index cc30d5d..72d3801 100644
--- a/Utils.cpp
+++ b/Utils.cpp
@@ -483,7 +483,7 @@
                     continue;
             }
 
-            subfd = openat(dfd, name, O_RDONLY | O_DIRECTORY);
+            subfd = openat(dfd, name, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
             if (subfd >= 0) {
                 size += calculate_dir_size(subfd);
             }
@@ -494,7 +494,7 @@
 }
 
 uint64_t GetTreeBytes(const std::string& path) {
-    int dirfd = open(path.c_str(), O_DIRECTORY, O_RDONLY);
+    int dirfd = open(path.c_str(), O_RDONLY | O_DIRECTORY | O_CLOEXEC);
     if (dirfd < 0) {
         PLOG(WARNING) << "Failed to open " << path;
         return -1;
@@ -668,20 +668,6 @@
     }
 }
 
-ScopedFd::ScopedFd(int fd) : fd_(fd) {}
-
-ScopedFd::~ScopedFd() {
-    close(fd_);
-}
-
-ScopedDir::ScopedDir(DIR* dir) : dir_(dir) {}
-
-ScopedDir::~ScopedDir() {
-    if (dir_ != nullptr) {
-        closedir(dir_);
-    }
-}
-
 bool IsRunningInEmulator() {
     return property_get_bool("ro.kernel.qemu", 0);
 }
diff --git a/Utils.h b/Utils.h
index 78e4618..813ffac 100644
--- a/Utils.h
+++ b/Utils.h
@@ -115,26 +115,6 @@
 
 status_t SaneReadLinkAt(int dirfd, const char* path, char* buf, size_t bufsiz);
 
-class ScopedFd {
-    const int fd_;
-public:
-    ScopedFd(int fd);
-    ~ScopedFd();
-    int get() const { return fd_; }
-
-    DISALLOW_COPY_AND_ASSIGN(ScopedFd);
-};
-
-class ScopedDir {
-    DIR* const dir_;
-public:
-    ScopedDir(DIR* dir);
-    ~ScopedDir();
-    DIR* get() const { return dir_; }
-
-    DISALLOW_COPY_AND_ASSIGN(ScopedDir);
-};
-
 /* Checks if Android is running in QEMU */
 bool IsRunningInEmulator();
 
diff --git a/VolumeManager.cpp b/VolumeManager.cpp
index a67c8ec..3b4c054 100644
--- a/VolumeManager.cpp
+++ b/VolumeManager.cpp
@@ -617,7 +617,7 @@
         }
 
         // We purposefully leave the namespace open across the fork
-        nsFd = openat(pidFd, "ns/mnt", O_RDONLY);
+        nsFd = openat(pidFd, "ns/mnt", O_RDONLY); // not O_CLOEXEC
         if (nsFd < 0) {
             PLOG(WARNING) << "Failed to open namespace for " << de->d_name;
             goto next;
diff --git a/main.cpp b/main.cpp
index c106af9..4657377 100644
--- a/main.cpp
+++ b/main.cpp
@@ -192,7 +192,7 @@
         if (de->d_type != DT_DIR && lvl > 0)
             continue;
 
-        fd = openat(dfd, de->d_name, O_RDONLY | O_DIRECTORY);
+        fd = openat(dfd, de->d_name, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
         if(fd < 0)
             continue;