Index: /trunk/src/kmk/kmkbuiltin/cat.c
===================================================================
--- /trunk/src/kmk/kmkbuiltin/cat.c	(revision 3218)
+++ /trunk/src/kmk/kmkbuiltin/cat.c	(revision 3219)
@@ -222,5 +222,5 @@
 		} else {
 			pThis->filename = path;
-			fd = open(path, O_RDONLY);
+			fd = open(path, O_RDONLY | KMK_OPEN_NO_INHERIT);
 #ifndef NO_UDOM_SUPPORT
 			if (fd < 0 && errno == EOPNOTSUPP)
Index: /trunk/src/kmk/kmkbuiltin/cmp_util.c
===================================================================
--- /trunk/src/kmk/kmkbuiltin/cmp_util.c	(revision 3218)
+++ /trunk/src/kmk/kmkbuiltin/cmp_util.c	(revision 3219)
@@ -481,5 +481,5 @@
     }
     else
-        fd2 = open(file2, O_RDONLY | O_BINARY, 0);
+        fd2 = open(file2, O_RDONLY | O_BINARY | KMK_OPEN_NO_INHERIT, 0);
     if (fd2 >= 0)
     {
@@ -534,5 +534,5 @@
     }
     else
-        fd1 = open(file1, O_RDONLY | O_BINARY, 0);
+        fd1 = open(file1, O_RDONLY | O_BINARY | KMK_OPEN_NO_INHERIT, 0);
     if (fd1 >= 0)
     {
Index: /trunk/src/kmk/kmkbuiltin/cp_utils.c
===================================================================
--- /trunk/src/kmk/kmkbuiltin/cp_utils.c	(revision 3218)
+++ /trunk/src/kmk/kmkbuiltin/cp_utils.c	(revision 3219)
@@ -102,5 +102,5 @@
 	*pcopied = 0;
 
-	if ((from_fd = open(entp->fts_path, O_RDONLY | O_BINARY, 0)) == -1) {
+	if ((from_fd = open(entp->fts_path, O_RDONLY | O_BINARY | KMK_OPEN_NO_INHERIT, 0)) == -1) {
 		warn(pCtx, "open: %s", entp->fts_path);
 		return (1);
@@ -128,5 +128,5 @@
 			if (lseek(from_fd, 0, SEEK_SET) != 0) {
     				close(from_fd);
-				if ((from_fd = open(entp->fts_path, O_RDONLY | O_BINARY, 0)) == -1) {
+				if ((from_fd = open(entp->fts_path, O_RDONLY | O_BINARY | KMK_OPEN_NO_INHERIT, 0)) == -1) {
 					warn(pCtx, "open: %s", entp->fts_path);
 					return (1);
@@ -157,11 +157,11 @@
 		     * create a new file  */
 		    (void)unlink(to.p_path);
-		    to_fd = open(to.p_path, O_WRONLY | O_TRUNC | O_CREAT | O_BINARY,
+		    to_fd = open(to.p_path, O_WRONLY | O_TRUNC | O_CREAT | O_BINARY | KMK_OPEN_NO_INHERIT,
 				 fs->st_mode & ~(S_ISUID | S_ISGID));
 		} else
 		    /* overwrite existing destination file name */
-		    to_fd = open(to.p_path, O_WRONLY | O_TRUNC | O_BINARY, 0);
+		    to_fd = open(to.p_path, O_WRONLY | O_TRUNC | O_BINARY | KMK_OPEN_NO_INHERIT, 0);
 	} else
-		to_fd = open(to.p_path, O_WRONLY | O_TRUNC | O_CREAT | O_BINARY,
+		to_fd = open(to.p_path, O_WRONLY | O_TRUNC | O_CREAT | O_BINARY | KMK_OPEN_NO_INHERIT,
 		    fs->st_mode & ~(S_ISUID | S_ISGID));
 
Index: /trunk/src/kmk/kmkbuiltin/fts.c
===================================================================
--- /trunk/src/kmk/kmkbuiltin/fts.c	(revision 3218)
+++ /trunk/src/kmk/kmkbuiltin/fts.c	(revision 3219)
@@ -275,5 +275,5 @@
 	if (!ISSET(FTS_NOCHDIR)) {
 #ifdef HAVE_FCHDIR
-		if ((sp->fts_rfd = open(".", O_RDONLY, 0)) == -1)
+		if ((sp->fts_rfd = open(".", O_RDONLY | KMK_OPEN_NO_INHERIT, 0)) == -1)
 			SET(FTS_NOCHDIR);
 		else if (fcntl(sp->fts_rfd, F_SETFD, FD_CLOEXEC) == -1) {
@@ -454,5 +454,5 @@
 		if (p->fts_info == FTS_D && !ISSET(FTS_NOCHDIR)) {
 #ifdef HAVE_FCHDIR
-			if ((p->fts_symfd = open(".", O_RDONLY, 0)) == -1) {
+			if ((p->fts_symfd = open(".", O_RDONLY | KMK_OPEN_NO_INHERIT, 0)) == -1) {
 				p->fts_errno = errno;
 				p->fts_info = FTS_ERR;
@@ -556,5 +556,5 @@
 #ifdef HAVE_FCHDIR
 				if ((p->fts_symfd =
-				    open(".", O_RDONLY, 0)) == -1) {
+				    open(".", O_RDONLY | KMK_OPEN_NO_INHERIT, 0)) == -1) {
 					p->fts_errno = errno;
 					p->fts_info = FTS_ERR;
@@ -722,5 +722,5 @@
 
 #ifdef HAVE_FCHDIR
-	if ((fd = open(".", O_RDONLY, 0)) == -1)
+	if ((fd = open(".", O_RDONLY | KMK_OPEN_NO_INHERIT, 0)) == -1)
 #else
 	if ((pszRoot = getcwd(NULL, 0)) == NULL)
@@ -1427,5 +1427,5 @@
 		if (!path) /* shuts up gcc nonull checks*/
 			return -1;
-		fd = open(path, O_RDONLY);
+		fd = open(path, O_RDONLY | KMK_OPEN_NO_INHERIT);
 		if (fd == -1)
 			return -1;
Index: /trunk/src/kmk/kmkbuiltin/install.c
===================================================================
--- /trunk/src/kmk/kmkbuiltin/install.c	(revision 3218)
+++ /trunk/src/kmk/kmkbuiltin/install.c	(revision 3219)
@@ -551,10 +551,10 @@
 	}
 
-	if (!devnull && (from_fd = open(from_name, O_RDONLY | O_BINARY, 0)) < 0)
+	if (!devnull && (from_fd = open(from_name, O_RDONLY | O_BINARY | KMK_OPEN_NO_INHERIT, 0)) < 0)
 		return err(pThis->pCtx, EX_OSERR, "%s", from_name);
 
 	/* If we don't strip, we can compare first. */
 	if (pThis->docompare && !pThis->dostrip && target) {
-		if ((to_fd = open(to_name, O_RDONLY | O_BINARY, 0)) < 0) {
+		if ((to_fd = open(to_name, O_RDONLY | O_BINARY | KMK_OPEN_NO_INHERIT, 0)) < 0) {
 			rc = err(pThis->pCtx, EX_OSERR, "%s", to_name);
 			goto l_done;
@@ -613,5 +613,5 @@
 		close(to_fd);
 #endif
-		to_fd = open(tempcopy ? tempfile : to_name, O_RDONLY | O_BINARY, 0);
+		to_fd = open(tempcopy ? tempfile : to_name, O_RDONLY | O_BINARY | KMK_OPEN_NO_INHERIT, 0);
 		if (to_fd < 0) {
 			rc = err(pThis->pCtx, EX_OSERR, "stripping %s", to_name);
@@ -627,5 +627,5 @@
 
 		/* Re-open to_fd using the real target name. */
-		if ((to_fd = open(to_name, O_RDONLY | O_BINARY, 0)) < 0) {
+		if ((to_fd = open(to_name, O_RDONLY | O_BINARY | KMK_OPEN_NO_INHERIT, 0)) < 0) {
 			rc = err(pThis->pCtx, EX_OSERR, "%s", to_name);
 			goto l_done;
@@ -707,5 +707,5 @@
 		/* Re-open to_fd so we aren't hosed by the rename(2). */
 		(void) close(to_fd);
-		if ((to_fd = open(to_name, O_RDONLY | O_BINARY, 0)) < 0) {
+		if ((to_fd = open(to_name, O_RDONLY | O_BINARY | KMK_OPEN_NO_INHERIT, 0)) < 0) {
 			rc = err(pThis->pCtx, EX_OSERR, "%s", to_name);
 			goto l_done;
@@ -913,5 +913,5 @@
 	}
 
-	newfd = open(path, O_CREAT | O_RDWR | O_TRUNC | O_BINARY, S_IRUSR | S_IWUSR);
+	newfd = open(path, O_CREAT | O_RDWR | O_TRUNC | O_BINARY | KMK_OPEN_NO_INHERIT, S_IRUSR | S_IWUSR);
 	if (newfd < 0 && saved_errno != 0)
 		errno = saved_errno;
Index: /trunk/src/kmk/kmkbuiltin/kDepObj.c
===================================================================
--- /trunk/src/kmk/kmkbuiltin/kDepObj.c	(revision 3218)
+++ /trunk/src/kmk/kmkbuiltin/kDepObj.c	(revision 3219)
@@ -1069,5 +1069,5 @@
                         pOutput = stdout;
                     else
-                        pOutput = fopen(pszOutput, "w");
+                        pOutput = fopen(pszOutput, "w" KMK_FOPEN_NO_INHERIT_MODE);
                     if (!pOutput)
                         return err(pCtx, 1, "Failed to create output file '%s'", pszOutput);
@@ -1145,5 +1145,5 @@
         else
         {
-            pInput = fopen(argv[i], "rb");
+            pInput = fopen(argv[i], "rb" KMK_FOPEN_NO_INHERIT_MODE);
             if (!pInput)
                 return err(pCtx, 1, "Failed to open input file '%s'", argv[i]);
Index: /trunk/src/kmk/kmkbuiltin/md5sum.c
===================================================================
--- /trunk/src/kmk/kmkbuiltin/md5sum.c	(revision 3218)
+++ /trunk/src/kmk/kmkbuiltin/md5sum.c	(revision 3219)
@@ -168,5 +168,5 @@
 
     /* figure out the appropriate flags. */
-    fFlags = O_RDONLY;
+    fFlags = O_RDONLY | KMK_OPEN_NO_INHERIT;
 #ifdef O_SEQUENTIAL
     fFlags |= _O_SEQUENTIAL;
Index: /trunk/src/kmk/kmkbuiltin/mscfakes.c
===================================================================
--- /trunk/src/kmk/kmkbuiltin/mscfakes.c	(revision 3218)
+++ /trunk/src/kmk/kmkbuiltin/mscfakes.c	(revision 3219)
@@ -366,5 +366,5 @@
         if (doname(pszX, pszEnd))
             return -1;
-        fd = open(temp, _O_EXCL | _O_CREAT | _O_BINARY | _O_RDWR, 0777);
+        fd = open(temp, _O_EXCL | _O_CREAT | _O_BINARY | _O_RDWR | KMK_OPEN_NO_INHERIT, 0777);
         if (fd >= 0)
             return fd;
Index: /trunk/src/kmk/kmkbuiltin/mv.c
===================================================================
--- /trunk/src/kmk/kmkbuiltin/mv.c	(revision 3218)
+++ /trunk/src/kmk/kmkbuiltin/mv.c	(revision 3219)
@@ -374,5 +374,5 @@
 	acl_t acl;
 
-	if ((from_fd = open(from, O_RDONLY, 0)) < 0) {
+	if ((from_fd = open(from, O_RDONLY | KMK_OPEN_NO_INHERIT, 0)) < 0) {
 		warn("%s", from);
 		return (1);
@@ -389,5 +389,5 @@
 	}
 	while ((to_fd =
-	    open(to, O_CREAT | O_EXCL | O_TRUNC | O_WRONLY, 0)) < 0) {
+	    open(to, O_CREAT | O_EXCL | O_TRUNC | O_WRONLY | KMK_OPEN_NO_INHERIT, 0)) < 0) {
 		if (errno == EEXIST && unlink(to) == 0)
 			continue;