diff --git a/arc4random.c b/arc4random.c
index 31f3842f..fe0234c1 100644
--- a/arc4random.c
+++ b/arc4random.c
@@ -261,7 +261,7 @@ arc4_seed_proc_sys_kernel_random_uuid(void)
 	unsigned char entropy[64];
 	int bytes, n, i, nybbles;
 	for (bytes = 0; bytes<ADD_ENTROPY; ) {
-		fd = open("/proc/sys/kernel/random/uuid", O_RDONLY, 0);
+		fd = evutil_open_closeonexec("/proc/sys/kernel/random/uuid", O_RDONLY, 0);
 		if (fd < 0)
 			return -1;
 		n = read(fd, buf, sizeof(buf));
@@ -305,7 +305,7 @@ arc4_seed_urandom(void)
 	size_t n;
 
 	for (i = 0; filenames[i]; ++i) {
-		fd = open(filenames[i], O_RDONLY, 0);
+		fd = evutil_open_closeonexec(filenames[i], O_RDONLY, 0);
 		if (fd<0)
 			continue;
 		n = read_all(fd, buf, sizeof(buf));
diff --git a/devpoll.c b/devpoll.c
index 6b46fc3f..4be46e40 100644
--- a/devpoll.c
+++ b/devpoll.c
@@ -132,7 +132,7 @@ devpoll_init(struct event_base *base)
 		nfiles = rl.rlim_cur;
 
 	/* Initialize the kernel queue */
-	if ((dpfd = open("/dev/poll", O_RDWR)) == -1) {
+	if ((dpfd = evutil_open_closeonexec("/dev/poll", O_RDWR, 0)) == -1) {
 		event_warn("open: /dev/poll");
 		mm_free(devpollop);
 		return (NULL);
diff --git a/evutil.c b/evutil.c
index 306f037c..317db7c6 100644
--- a/evutil.c
+++ b/evutil.c
@@ -96,6 +96,30 @@
 #define stat _stati64
 #endif
 
+int
+evutil_open_closeonexec(const char *pathname, int flags, unsigned mode)
+{
+	int fd;
+
+#ifdef O_CLOEXEC
+	flags |= O_CLOEXEC;
+#endif
+
+	if (flags & O_CREAT)
+		fd = open(pathname, flags, (mode_t)mode);
+	else
+		fd = open(pathname, flags);
+	if (fd < 0)
+		return -1;
+
+#if !defined(O_CLOEXEC) && defined(FD_CLOEXEC)
+	if (fcntl(fd, F_SETFD, FD_CLOEXEC) < 0)
+		return -1;
+#endif
+
+	return fd;
+}
+
 /**
    Read the contents of 'filename' into a newly allocated NUL-terminated
    string.  Set *content_out to hold this string, and *len_out to hold its
@@ -126,7 +150,7 @@ evutil_read_file(const char *filename, char **content_out, size_t *len_out,
 		mode |= O_BINARY;
 #endif
 
-	fd = open(filename, mode);
+	fd = evutil_open_closeonexec(filename, mode, 0);
 	if (fd < 0)
 		return -1;
 	if (fstat(fd, &st) || st.st_size < 0 ||
diff --git a/util-internal.h b/util-internal.h
index 52f61f2c..8139fb98 100644
--- a/util-internal.h
+++ b/util-internal.h
@@ -163,6 +163,11 @@ char EVUTIL_TOLOWER(char c);
 #define EVUTIL_UPCAST(ptr, type, field)				\
 	((type *)(((char*)(ptr)) - evutil_offsetof(type, field)))
 
+/* As open(pathname, flags, mode), except that the file is always opened with
+ * the close-on-exec flag set. (And the mode argument is mandatory.)
+ */
+int evutil_open_closeonexec(const char *pathname, int flags, unsigned mode);
+
 int evutil_read_file(const char *filename, char **content_out, size_t *len_out,
     int is_binary);