patch to just call open() with O_CLOEXEC Index: lib/libutil/check_expire.c =================================================================== RCS file: /cvs/src/lib/libutil/check_expire.c,v retrieving revision 1.8 diff -u -p -r1.8 check_expire.c --- lib/libutil/check_expire.c 20 Apr 2004 23:21:23 -0000 1.8 +++ lib/libutil/check_expire.c 21 Mar 2013 20:19:56 -0000 @@ -173,8 +173,8 @@ pwd_update(const struct passwd *pwd, con return("can't open passwd temp file"); } - pfd = open(_PATH_MASTERPASSWD, O_RDONLY, 0); - if (pfd < 0 || fcntl(pfd, F_SETFD, 1) == -1) { + pfd = open(_PATH_MASTERPASSWD, O_RDONLY | O_CLOEXEC, 0); + if (pfd < 0) { pw_abort(); return(strerror(errno)); }