diff -u -p -r1.43 ssh-keysign.c
--- ssh-keysign.c	10 Sep 2010 01:12:09 -0000	1.43
+++ ssh-keysign.c	29 Apr 2011 01:25:55 -0000
@@ -167,6 +167,9 @@ main(int argc, char **argv)
 
 	key_fd[0] = open(_PATH_HOST_RSA_KEY_FILE, O_RDONLY);
 	key_fd[1] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY);
+	if (fcntl(key_fd[0], F_SETFD, FD_CLOEXEC) != 0 ||
+	    fcntl(key_fd[1], F_SETFD, FD_CLOEXEC) != 0)
+		fatal("fcntl failed");
 
 	original_real_uid = getuid();	/* XXX readconf.c needs this */
 	if ((pw = getpwuid(original_real_uid)) == NULL)