diff --git a/src/dvr/dvr_inotify.c b/src/dvr/dvr_inotify.c
index 9d7687de..70884271 100644
--- a/src/dvr/dvr_inotify.c
+++ b/src/dvr/dvr_inotify.c
@@ -63,7 +63,7 @@ pthread_t dvr_inotify_tid;
 
 void dvr_inotify_init ( void )
 {
-  _inot_fd = inotify_init();
+  _inot_fd = inotify_init1(IN_CLOEXEC);
   if (_inot_fd < 0) {
     tvhlog(LOG_ERR, "dvr", "failed to initialise inotify (err=%s)",
            strerror(errno));
diff --git a/src/fsmonitor.c b/src/fsmonitor.c
index 7d1aaabb..a311fcb9 100644
--- a/src/fsmonitor.c
+++ b/src/fsmonitor.c
@@ -105,7 +105,7 @@ void
 fsmonitor_init ( void )
 {
   /* Intialise inotify */
-  fsmonitor_fd = inotify_init();
+  fsmonitor_fd = inotify_init1(IN_CLOEXEC);
   tvhthread_create0(&fsmonitor_tid, NULL, fsmonitor_thread, NULL, "fsmonitor");
 }
 
diff --git a/src/input/mpegts/iptv/iptv_pipe.c b/src/input/mpegts/iptv/iptv_pipe.c
index 5c0484f8..898c48e5 100644
--- a/src/input/mpegts/iptv/iptv_pipe.c
+++ b/src/input/mpegts/iptv/iptv_pipe.c
@@ -33,7 +33,7 @@
 static int
 iptv_pipe_start ( iptv_mux_t *im, const char *_raw, const url_t *url )
 {
-  char *argv[32], *f, *raw, *s, *p, *a;
+  char *argv[64], *f, *raw, *s, *p, *a;
   int i = 1, rd;
 
   if (strncmp(_raw, "pipe://", 7))
diff --git a/src/input/mpegts/tvhdhomerun/tvhdhomerun_frontend.c b/src/input/mpegts/tvhdhomerun/tvhdhomerun_frontend.c
index e0ac5dfd..f9ee04e6 100644
--- a/src/input/mpegts/tvhdhomerun/tvhdhomerun_frontend.c
+++ b/src/input/mpegts/tvhdhomerun/tvhdhomerun_frontend.c
@@ -111,7 +111,7 @@ tvhdhomerun_frontend_input_thread ( void *aux )
   local_ip = hdhomerun_device_get_local_machine_addr(hfe->hf_hdhomerun_tuner);
 
   /* first setup a local socket for the device to stream to */
-  sockfd = socket(AF_INET, SOCK_DGRAM, 0);
+  sockfd = tvh_socket(AF_INET, SOCK_DGRAM, 0);
   if(sockfd == -1) {
     tvherror("stvhdhomerun", "failed to open socket (%d)", errno);
     return NULL;
diff --git a/src/spawn.c b/src/spawn.c
index a21528cc..7236a336 100644
--- a/src/spawn.c
+++ b/src/spawn.c
@@ -304,7 +304,7 @@ int
 spawn_and_give_stdout(const char *prog, char *argv[], int *rd, int redir_stderr)
 {
   pid_t p;
-  int fd[2], f;
+  int fd[2], f, maxfd;
   char bin[256];
   const char *local_argv[2] = { NULL, NULL };
 
@@ -316,6 +316,8 @@ spawn_and_give_stdout(const char *prog, char *argv[], int *rd, int redir_stderr)
   if (!argv) argv = (void *)local_argv;
   if (!argv[0]) argv[0] = (char*)prog;
 
+  maxfd = sysconf(_SC_OPEN_MAX);
+
   pthread_mutex_lock(&fork_lock);
 
   if(pipe(fd) == -1) {
@@ -338,6 +340,11 @@ spawn_and_give_stdout(const char *prog, char *argv[], int *rd, int redir_stderr)
     close(fd[0]);
     dup2(fd[1], 1);
     close(fd[1]);
+    if (redir_stderr)
+      dup2(spawn_pipe_error.wr, 2);
+
+    for (f = 3; f < maxfd; f++)
+      close(f);
 
     f = open("/dev/null", O_RDWR);
     if(f == -1) {
@@ -347,7 +354,8 @@ spawn_and_give_stdout(const char *prog, char *argv[], int *rd, int redir_stderr)
     }
 
     dup2(f, 0);
-    dup2(redir_stderr ? spawn_pipe_error.wr : f, 2);
+    if (!redir_stderr)
+      dup2(f, 2);
     close(f);
 
     spawn_info("Executing \"%s\"\n", prog);
diff --git a/src/tvhpoll.c b/src/tvhpoll.c
index 1783dc12..44e47182 100644
--- a/src/tvhpoll.c
+++ b/src/tvhpoll.c
@@ -70,7 +70,7 @@ tvhpoll_create ( size_t n )
 {
   int fd;
 #if ENABLE_EPOLL
-  if ((fd = epoll_create(n)) < 0) {
+  if ((fd = epoll_create1(EPOLL_CLOEXEC)) < 0) {
     tvhlog(LOG_ERR, "tvhpoll", "failed to create epoll [%s]",
            strerror(errno));
     return NULL;
diff --git a/src/uuid.c b/src/uuid.c
index f96512ee..9b5472cf 100644
--- a/src/uuid.c
+++ b/src/uuid.c
@@ -94,7 +94,7 @@ bin2hex(char *dst, size_t dstlen, const uint8_t *src, size_t srclen)
 void
 uuid_init ( void )
 {
-  fd = open(RANDOM_PATH, O_RDONLY);
+  fd = open(RANDOM_PATH, O_RDONLY|O_CLOEXEC);
   if (fd == -1) {
     tvherror("uuid", "failed to open %s", RANDOM_PATH);
     exit(1);