diff --git a/lib/hcrypto/ui.c b/lib/hcrypto/ui.c
index 53d3ca38d..05f44bc66 100644
--- a/lib/hcrypto/ui.c
+++ b/lib/hcrypto/ui.c
@@ -84,7 +84,9 @@ read_string(const char *preprompt, const char *prompt,
 	    if (sigaction(i, &sa, &sigs[i]) == 0)
 		oksigs[i] = 1;
 
-    if((tty = fopen("/dev/tty", "r")) == NULL)
+    if((tty = fopen("/dev/tty", "r")) != NULL)
+	rk_cloexec_file(tty);
+    else
 	tty = stdin;
        
     fprintf(stderr, "%s%s", preprompt, prompt);