diff --git a/Checkpoint.cpp b/Checkpoint.cpp
index 8605b6a..370b235 100644
--- a/Checkpoint.cpp
+++ b/Checkpoint.cpp
@@ -575,7 +575,7 @@
         Status status = Status::ok();
 
         LOG(INFO) << action << " checkpoint on " << blockDevice;
-        base::unique_fd device_fd(open(blockDevice.c_str(), O_RDWR));
+        base::unique_fd device_fd(open(blockDevice.c_str(), O_RDWR | O_CLOEXEC));
         if (device_fd < 0) {
             PLOG(ERROR) << "Cannot open " << blockDevice;
             return Status::fromExceptionCode(errno, ("Cannot open " + blockDevice).c_str());