diff --git a/lib/krb5/fcache.c b/lib/krb5/fcache.c
index d25196d49..713e9df20 100644
--- a/lib/krb5/fcache.c
+++ b/lib/krb5/fcache.c
@@ -248,6 +248,7 @@ erase_file(krb5_context context, const char *filename)
 	else
 	    return errno;
     }
+    rk_cloexec(fd);
     ret = _krb5_xlock(context, fd, 1, filename);
     if (ret) {
 	close(fd);
@@ -372,7 +373,8 @@ fcc_open(krb5_context context,
 			       strerror(ret));
 	return ret;
     }
-	
+    rk_cloexec(fd);
+    
     if((ret = fcc_lock(context, id, fd, exclusive)) != 0) {
 	close(fd);
 	return ret;