2 files changed, 4 insertions, 2 deletions
diff --git a/source/cache.c b/source/cache.c
index 4802ab5..12151b8 100644
--- a/source/cache.c
+++ b/source/cache.c
@@ -202,7 +202,9 @@ static int lock_slot(struct cache_slot *slot)
 {
 	struct stat held, named;
 
-	slot->lock_fd = open(slot->lock_path, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR);
+	// Close-on-exec, so that a program the fill runs gets the file only
+	// as its stdout, and holds the lock no longer than it can write there.
+	slot->lock_fd = open(slot->lock_path, O_RDWR | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR);
 	if (slot->lock_fd == -1)
 		return errno;
 	// An flock rather than a POSIX record lock. The descriptor is put on
diff --git a/source/cgit.c b/source/cgit.c
index f81af79..f5f3138 100644
--- a/source/cgit.c
+++ b/source/cgit.c
@@ -337,7 +337,7 @@ static int generate_cached_repolist(const char *path, const char *cached_rc)
 	FILE *f;
 
 	strbuf_addf(&locked_rc, "%s.lock", cached_rc);
-	fd = open(locked_rc.buf, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR);
+	fd = open(locked_rc.buf, O_RDWR | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR);
 	if (fd == -1) {
 		err = errno;
 		fprintf(stderr, "[cgit] Unable to open %s: %s (%d)\n", locked_rc.buf, strerror(err), err);