diff --git a/iptables-1.4.3.1-cloexec.patch b/iptables-1.4.3.1-cloexec.patch
new file mode 100644
index 0000000..47af3f7
--- /dev/null
+++ b/iptables-1.4.3.1-cloexec.patch
@@ -0,0 +1,109 @@
+diff -up iptables-1.4.3.1/extensions/libipt_realm.c.cloexec iptables-1.4.3.1/extensions/libipt_realm.c
+--- iptables-1.4.3.1/extensions/libipt_realm.c.cloexec	2009-03-24 13:08:24.000000000 +0100
++++ iptables-1.4.3.1/extensions/libipt_realm.c	2009-03-30 14:23:11.000000000 +0200
+@@ -49,7 +49,7 @@ static void load_realms(void)
+ 	int id;
+ 	struct realmname *oldnm = NULL, *newnm = NULL;
+ 
+-	fil = fopen(rfnm, "r");
++	fil = fopen(rfnm, "re");
+ 	if (!fil) {
+ 		rdberr = 1;
+ 		return;
+@@ -248,7 +248,7 @@ static struct xtables_match realm_mt_reg
+ 	.extra_opts	= realm_opts,
+ };
+ 
+-void _init(void)
++void __attribute((constructor)) nf_ext_init(void)
+ {
+ 	xtables_register_match(&realm_mt_reg);
+ }
+diff -up iptables-1.4.3.1/ip6tables-restore.c.cloexec iptables-1.4.3.1/ip6tables-restore.c
+--- iptables-1.4.3.1/ip6tables-restore.c.cloexec	2009-03-24 13:08:24.000000000 +0100
++++ iptables-1.4.3.1/ip6tables-restore.c	2009-03-30 14:23:11.000000000 +0200
+@@ -169,7 +169,7 @@ int main(int argc, char *argv[])
+ 	}
+ 
+ 	if (optind == argc - 1) {
+-		in = fopen(argv[optind], "r");
++		in = fopen(argv[optind], "re");
+ 		if (!in) {
+ 			fprintf(stderr, "Can't open %s: %s\n", argv[optind],
+ 				strerror(errno));
+diff -up iptables-1.4.3.1/ip6tables-save.c.cloexec iptables-1.4.3.1/ip6tables-save.c
+--- iptables-1.4.3.1/ip6tables-save.c.cloexec	2009-03-24 13:08:24.000000000 +0100
++++ iptables-1.4.3.1/ip6tables-save.c	2009-03-30 14:24:11.000000000 +0200
+@@ -41,7 +41,7 @@ static int for_each_table(int (*func)(co
+ 	FILE *procfile = NULL;
+ 	char tablename[IP6T_TABLE_MAXNAMELEN+1];
+ 
+-	procfile = fopen("/proc/net/ip6_tables_names", "r");
++	procfile = fopen("/proc/net/ip6_tables_names", "re");
+ 	if (!procfile)
+ 		return ret;
+ 
+diff -up iptables-1.4.3.1/iptables-restore.c.cloexec iptables-1.4.3.1/iptables-restore.c
+--- iptables-1.4.3.1/iptables-restore.c.cloexec	2009-03-24 13:08:24.000000000 +0100
++++ iptables-1.4.3.1/iptables-restore.c	2009-03-30 14:23:11.000000000 +0200
+@@ -175,7 +175,7 @@ main(int argc, char *argv[])
+ 	}
+ 
+ 	if (optind == argc - 1) {
+-		in = fopen(argv[optind], "r");
++		in = fopen(argv[optind], "re");
+ 		if (!in) {
+ 			fprintf(stderr, "Can't open %s: %s\n", argv[optind],
+ 				strerror(errno));
+diff -up iptables-1.4.3.1/iptables-save.c.cloexec iptables-1.4.3.1/iptables-save.c
+--- iptables-1.4.3.1/iptables-save.c.cloexec	2009-03-24 13:08:24.000000000 +0100
++++ iptables-1.4.3.1/iptables-save.c	2009-03-30 14:24:33.000000000 +0200
+@@ -39,7 +39,7 @@ static int for_each_table(int (*func)(co
+ 	FILE *procfile = NULL;
+ 	char tablename[IPT_TABLE_MAXNAMELEN+1];
+ 
+-	procfile = fopen("/proc/net/ip_tables_names", "r");
++	procfile = fopen("/proc/net/ip_tables_names", "re");
+ 	if (!procfile)
+ 		return ret;
+ 
+diff -up iptables-1.4.3.1/iptables-xml.c.cloexec iptables-1.4.3.1/iptables-xml.c
+--- iptables-1.4.3.1/iptables-xml.c.cloexec	2009-03-24 13:08:24.000000000 +0100
++++ iptables-1.4.3.1/iptables-xml.c	2009-03-30 14:23:11.000000000 +0200
+@@ -653,7 +653,7 @@ main(int argc, char *argv[])
+ 	}
+ 
+ 	if (optind == argc - 1) {
+-		in = fopen(argv[optind], "r");
++		in = fopen(argv[optind], "re");
+ 		if (!in) {
+ 			fprintf(stderr, "Can't open %s: %s", argv[optind],
+ 				strerror(errno));
+diff -up iptables-1.4.3.1/xtables.c.cloexec iptables-1.4.3.1/xtables.c
+--- iptables-1.4.3.1/xtables.c.cloexec	2009-03-24 13:08:24.000000000 +0100
++++ iptables-1.4.3.1/xtables.c	2009-03-30 14:25:51.000000000 +0200
+@@ -280,6 +280,11 @@ static char *get_modprobe(void)
+ 	procfile = open(PROC_SYS_MODPROBE, O_RDONLY);
+ 	if (procfile < 0)
+ 		return NULL;
++ 	if (fcntl(procfile, F_SETFD, FD_CLOEXEC) == -1) {
++ 		fprintf(stderr, "Could not set close on exec: %s\n",
++ 			strerror(errno));
++ 		exit(1);
++ 	}
+ 
+ 	ret = (char *) malloc(PROCFILE_BUFSIZ);
+ 	if (ret) {
+@@ -672,6 +677,12 @@ static int compatible_revision(const cha
+ 		exit(1);
+ 	}
+ 
++	if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) {
++		fprintf(stderr, "Could not set close on exec: %s\n",
++			strerror(errno));
++		exit(1);
++	}
++
+ 	xtables_load_ko(xtables_modprobe_program, true);
+ 
+ 	strcpy(rev.name, name);