diff --git a/src/namespace.c b/src/namespace.c
index d1d8a47..f23da48 100644
--- a/src/namespace.c
+++ b/src/namespace.c
@@ -25,7 +25,7 @@
 {
 	if (chunk_printf(&trash, "/var/run/netns/%s", ns_name) < 0)
 		return -1;
-	return open(trash.area, O_RDONLY);
+	return open(trash.area, O_RDONLY | O_CLOEXEC);
 }
 
 static int default_namespace = -1;
@@ -34,7 +34,7 @@
 {
 	if (chunk_printf(&trash, "/proc/%d/ns/net", getpid()) < 0)
 		return -1;
-	default_namespace = open(trash.area, O_RDONLY);
+	default_namespace = open(trash.area, O_RDONLY | O_CLOEXEC);
 	return default_namespace;
 }