diff --git a/libssh2-ocloexec.patch b/libssh2-ocloexec.patch
new file mode 100644
index 0000000..5f50f95
--- /dev/null
+++ b/libssh2-ocloexec.patch
@@ -0,0 +1,61 @@
+diff --git a/src/agent.c b/src/agent.c
+index 5a9e81c..989b7ec 100644
+--- a/src/agent.c
++++ b/src/agent.c
+@@ -152,7 +152,7 @@ agent_connect_unix(LIBSSH2_AGENT *agent)
+         return _libssh2_error(agent->session, LIBSSH2_ERROR_BAD_USE,
+                               "no auth sock variable");
+ 
+-    agent->fd = socket(PF_UNIX, SOCK_STREAM, 0);
++    agent->fd = socket(PF_UNIX, SOCK_STREAM| SOCK_CLOEXEC, 0);
+     if (agent->fd < 0)
+         return _libssh2_error(agent->session, LIBSSH2_ERROR_BAD_SOCKET,
+                               "failed creating socket");
+diff --git a/src/knownhost.c b/src/knownhost.c
+index d90f1d4..8862c58 100644
+--- a/src/knownhost.c
++++ b/src/knownhost.c
+@@ -905,7 +905,7 @@ libssh2_knownhost_readfile(LIBSSH2_KNOWNHOSTS *hosts,
+                               "Unsupported type of known-host information "
+                               "store");
+ 
+-    file = fopen(filename, "r");
++    file = fopen(filename, "re");
+     if(file) {
+         while(fgets(buf, sizeof(buf), file)) {
+             if(libssh2_knownhost_readline(hosts, buf, strlen(buf), type))
+@@ -1077,7 +1077,7 @@ libssh2_knownhost_writefile(LIBSSH2_KNOWNHOSTS *hosts,
+                               "Unsupported type of known-host information "
+                               "store");
+ 
+-    file = fopen(filename, "w");
++    file = fopen(filename, "we");
+     if(!file)
+         return _libssh2_error(hosts->session, LIBSSH2_ERROR_FILE,
+                               "Failed to open file");
+diff --git a/src/userauth.c b/src/userauth.c
+index d74c0c8..7e8efb6 100644
+--- a/src/userauth.c
++++ b/src/userauth.c
+@@ -467,7 +467,7 @@ file_read_publickey(LIBSSH2_SESSION * session, unsigned char **method,
+     _libssh2_debug(session, LIBSSH2_TRACE_AUTH, "Loading public key file: %s",
+                    pubkeyfile);
+     /* Read Public Key */
+-    fd = fopen(pubkeyfile, "r");
++    fd = fopen(pubkeyfile, "re");
+     if (!fd) {
+         return _libssh2_error(session, LIBSSH2_ERROR_FILE,
+                               "Unable to open public key file");
+diff --git a/tests/ssh2.c b/tests/ssh2.c
+index e09ba8a..9469970 100644
+--- a/tests/ssh2.c
++++ b/tests/ssh2.c
+@@ -64,7 +64,7 @@ int main(int argc, char *argv[])
+ 
+     hostaddr = htonl(0x7F000001);
+ 
+-    sock = socket(AF_INET, SOCK_STREAM, 0);
++    sock = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0);
+ #ifndef WIN32
+     fcntl(sock, F_SETFL, 0);
+ #endif
diff --git a/libssh2_org.changes b/libssh2_org.changes
index d4060b7..c3ee3f9 100644
--- a/libssh2_org.changes
+++ b/libssh2_org.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Thu Dec  1 02:43:46 UTC 2011 - crrodriguez@opensuse.org
+
+- open library file descriptors with O_CLOEXEC 
+
 -------------------------------------------------------------------
 Fri Oct 21 18:15:49 UTC 2011 - crrodriguez@opensuse.org
 
diff --git a/libssh2_org.spec b/libssh2_org.spec
index 053c4f0..a3dcd69 100644
--- a/libssh2_org.spec
+++ b/libssh2_org.spec
@@ -33,6 +33,7 @@ BuildRequires:  zlib-devel
 #for the test suite
 BuildRequires:  openssh
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
+Patch:          libssh2-ocloexec.patch
 
 %description
 libssh2 is a library implementing the SSH2 protocol as defined by
@@ -68,6 +69,7 @@ SECSH-PUBLICKEY.
 
 %prep
 %setup -q -n %{pkg_name}-%{version}
+%patch -p1
 
 %build
 export CFLAGS="%optflags -DOPENSSL_LOAD_CONF"