diff --git a/src/namespace.c b/src/namespace.c
index 8a2e5a7b1..cfb81ba0f 100644
--- a/src/namespace.c
+++ b/src/namespace.c
@@ -24,7 +24,7 @@ static int open_named_namespace(const char *ns_name)
 {
 	if (chunk_printf(&trash, "/var/run/netns/%s", ns_name) < 0)
 		return -1;
-	return open(trash.area, O_RDONLY);
+	return open(trash.area, O_RDONLY | O_CLOEXEC);
 }
 
 static int default_namespace = -1;
@@ -33,7 +33,7 @@ static int init_default_namespace()
 {
 	if (chunk_printf(&trash, "/proc/%d/ns/net", getpid()) < 0)
 		return -1;
-	default_namespace = open(trash.area, O_RDONLY);
+	default_namespace = open(trash.area, O_RDONLY | O_CLOEXEC);
 	return default_namespace;
 }