diff --git a/src/header/sys_socket/mod.rs b/src/header/sys_socket/mod.rs
index f2a54e9e6588ed536b2b727e4b0dd9ba5e3cbff1..a07af00488620029654b7a2b8e5c132d1b888339 100644
--- a/src/header/sys_socket/mod.rs
+++ b/src/header/sys_socket/mod.rs
@@ -26,7 +26,9 @@ pub unsafe extern "C" fn accept(
     trace_expr!(
         Sys::accept(socket, address, address_len),
         "accept({}, {:p}, {:p})",
-        socket, address, address_len
+        socket,
+        address,
+        address_len
     )
 }
 
@@ -39,7 +41,9 @@ pub unsafe extern "C" fn bind(
     trace_expr!(
         Sys::bind(socket, address, address_len),
         "bind({}, {:p}, {})",
-        socket, address, address_len
+        socket,
+        address,
+        address_len
     )
 }
 
@@ -52,7 +56,9 @@ pub unsafe extern "C" fn connect(
     trace_expr!(
         Sys::connect(socket, address, address_len),
         "connect({}, {:p}, {})",
-        socket, address, address_len
+        socket,
+        address,
+        address_len
     )
 }
 
@@ -65,7 +71,9 @@ pub unsafe extern "C" fn getpeername(
     trace_expr!(
         Sys::getpeername(socket, address, address_len),
         "getpeername({}, {:p}, {:p})",
-        socket, address, address_len
+        socket,
+        address,
+        address_len
     )
 }
 
@@ -78,7 +86,9 @@ pub unsafe extern "C" fn getsockname(
     trace_expr!(
         Sys::getsockname(socket, address, address_len),
         "getsockname({}, {:p}, {:p})",
-        socket, address, address_len
+        socket,
+        address,
+        address_len
     )
 }
 
@@ -127,7 +137,12 @@ pub unsafe extern "C" fn recvfrom(
     trace_expr!(
         Sys::recvfrom(socket, buffer, length, flags, address, address_len),
         "recvfrom({}, {:p}, {}, {:#x}, {:p}, {:p})",
-        socket, buffer, length, flags, address, address_len
+        socket,
+        buffer,
+        length,
+        flags,
+        address,
+        address_len
     )
 }
 
@@ -153,7 +168,12 @@ pub unsafe extern "C" fn sendto(
     trace_expr!(
         Sys::sendto(socket, message, length, flags, dest_addr, dest_len),
         "sendto({}, {:p}, {}, {:#x}, {:p}, {})",
-        socket, message, length, flags, dest_addr, dest_len
+        socket,
+        message,
+        length,
+        flags,
+        dest_addr,
+        dest_len
     )
 }
 
@@ -178,7 +198,9 @@ pub unsafe extern "C" fn socket(domain: c_int, kind: c_int, protocol: c_int) ->
     trace_expr!(
         Sys::socket(domain, kind, protocol),
         "socket({}, {}, {})",
-        domain, kind, protocol,
+        domain,
+        kind,
+        protocol,
     )
 }
 
diff --git a/src/macros.rs b/src/macros.rs
index e243fa31874bd2528609d0dc735fe39d6ef6548c..6a3b790e4085b88022fdf20ba8ee3d5eb879c2df 100644
--- a/src/macros.rs
+++ b/src/macros.rs
@@ -35,7 +35,7 @@ macro_rules! eprintln {
 #[macro_export]
 #[cfg(not(feature = "trace"))]
 macro_rules! trace {
-    ($($arg:tt)*) => ();
+    ($($arg:tt)*) => {};
 }
 
 #[macro_export]
@@ -51,7 +51,9 @@ macro_rules! trace {
 #[macro_export]
 #[cfg(not(feature = "trace"))]
 macro_rules! trace_expr {
-    ($expr:expr, $($arg:tt)*) => ($expr);
+    ($expr:expr, $($arg:tt)*) => {
+        $expr
+    };
 }
 
 #[macro_export]
diff --git a/src/platform/redox/mod.rs b/src/platform/redox/mod.rs
index 4cbdd26d2b9c192b0f1df9424515bf25885ad540..8b136d7b227fe65ab640219cd8a3ecbc8b83fba5 100644
--- a/src/platform/redox/mod.rs
+++ b/src/platform/redox/mod.rs
@@ -55,7 +55,7 @@ pub struct Sys;
 
 impl Pal for Sys {
     fn access(path: &CStr, mode: c_int) -> c_int {
-        let fd = match RawFile::open(path, fcntl::O_PATH, 0) {
+        let fd = match RawFile::open(path, fcntl::O_PATH | fcntl::O_CLOEXEC, 0) {
             Ok(fd) => fd,
             Err(_) => return -1,
         };
@@ -109,7 +109,7 @@ impl Pal for Sys {
     }
 
     fn chmod(path: &CStr, mode: mode_t) -> c_int {
-        match syscall::open(path.to_bytes(), O_WRONLY) {
+        match syscall::open(path.to_bytes(), O_WRONLY | O_CLOEXEC) {
             Err(err) => e(Err(err)) as c_int,
             Ok(fd) => {
                 let res = syscall::fchmod(fd as usize, mode as u16);
@@ -120,7 +120,7 @@ impl Pal for Sys {
     }
 
     fn chown(path: &CStr, owner: uid_t, group: gid_t) -> c_int {
-        match syscall::open(path.to_bytes(), O_WRONLY) {
+        match syscall::open(path.to_bytes(), O_WRONLY | O_CLOEXEC) {
             Err(err) => e(Err(err)) as c_int,
             Ok(fd) => {
                 let res = syscall::fchown(fd as usize, owner as u32, group as u32);
@@ -168,7 +168,7 @@ impl Pal for Sys {
     ) -> c_int {
         use alloc::Vec;
 
-        let fd = match RawFile::open(path, fcntl::O_RDONLY, 0) {
+        let fd = match RawFile::open(path, fcntl::O_RDONLY | fcntl::O_CLOEXEC, 0) {
             Ok(fd) => fd,
             Err(_) => return -1,
         };
@@ -206,7 +206,7 @@ impl Pal for Sys {
                         Ok(path) => path,
                         Err(_) => return -1,
                     };
-                    match RawFile::open(&path, fcntl::O_RDONLY, 0) {
+                    match RawFile::open(&path, fcntl::O_RDONLY | fcntl::O_CLOEXEC, 0) {
                         Ok(file) => {
                             interpreter_fd = *file;
                             _interpreter_path = Some(path);
@@ -339,7 +339,7 @@ impl Pal for Sys {
     }
 
     fn utimens(path: &CStr, times: *const timespec) -> c_int {
-        match syscall::open(path.to_bytes(), O_STAT) {
+        match syscall::open(path.to_bytes(), O_STAT | O_CLOEXEC) {
             Err(err) => e(Err(err)) as c_int,
             Ok(fd) => {
                 let res = Self::futimens(fd as c_int, times);
@@ -423,11 +423,16 @@ impl Pal for Sys {
     }
 
     unsafe fn gethostname(mut name: *mut c_char, len: size_t) -> c_int {
-        let fd = e(syscall::open("/etc/hostname", O_RDONLY)) as i32;
-        if fd < 0 {
-            return fd;
-        }
-        let mut reader = FileReader(fd);
+        let fd = match RawFile::open(
+            &CString::new("/etc/hostname").unwrap(),
+            fcntl::O_RDONLY | fcntl::O_CLOEXEC,
+            0,
+        ) {
+            Ok(fd) => fd,
+            Err(_) => return -1,
+        };
+
+        let mut reader = FileReader(*fd);
         for _ in 0..len {
             match reader.read_u8() {
                 Ok(Some(b)) => {
@@ -515,7 +520,7 @@ impl Pal for Sys {
     }
 
     fn mkfifo(path: &CStr, mode: mode_t) -> c_int {
-        let flags = O_CREAT | MODE_FIFO as usize | mode as usize & 0o777;
+        let flags = O_CREAT | O_CLOEXEC | MODE_FIFO as usize | mode as usize & 0o777;
         match syscall::open(path.to_bytes(), flags) {
             Ok(fd) => {
                 let _ = syscall::close(fd);
@@ -534,7 +539,7 @@ impl Pal for Sys {
         off: off_t,
     ) -> *mut c_void {
         if flags & MAP_ANON == MAP_ANON {
-            let fd = e(syscall::open("memory:", 0)); // flags don't matter currently
+            let fd = e(syscall::open("memory:", O_STAT | O_CLOEXEC)); // flags don't matter currently
             if fd == !0 {
                 return !0 as *mut c_void;
             }
@@ -604,7 +609,7 @@ impl Pal for Sys {
     }
 
     fn rename(oldpath: &CStr, newpath: &CStr) -> c_int {
-        match syscall::open(oldpath.to_bytes(), O_WRONLY) {
+        match syscall::open(oldpath.to_bytes(), O_WRONLY | O_CLOEXEC) {
             Ok(fd) => {
                 let retval = syscall::frename(fd, newpath.to_bytes());
                 let _ = syscall::close(fd);
@@ -635,7 +640,7 @@ impl Pal for Sys {
         }
 
         let event_path = unsafe { CStr::from_bytes_with_nul_unchecked(b"event:\0") };
-        let event_file = match RawFile::open(event_path, fcntl::O_RDWR, 0) {
+        let event_file = match RawFile::open(event_path, fcntl::O_RDWR | fcntl::O_CLOEXEC, 0) {
             Ok(file) => file,
             Err(_) => return -1,
         };
@@ -683,10 +688,11 @@ impl Pal for Sys {
                     format!("time:{}", syscall::CLOCK_MONOTONIC).into_bytes(),
                 )
             };
-            let timeout_file = match RawFile::open(&timeout_path, fcntl::O_RDWR, 0) {
-                Ok(file) => file,
-                Err(_) => return -1,
-            };
+            let timeout_file =
+                match RawFile::open(&timeout_path, fcntl::O_RDWR | fcntl::O_CLOEXEC, 0) {
+                    Ok(file) => file,
+                    Err(_) => return -1,
+                };
 
             if Self::write(
                 *event_file,
diff --git a/src/platform/redox/socket.rs b/src/platform/redox/socket.rs
index d63ab64462c4e85fa1d24d3fae15981b05f686be..39728ff4ba18e3f8f8b3a20977e0ade36ee96043 100644
--- a/src/platform/redox/socket.rs
+++ b/src/platform/redox/socket.rs
@@ -38,10 +38,17 @@ macro_rules! bind_or_connect {
         let data = &*($address as *const sockaddr_in);
         let addr = slice::from_raw_parts(
             &data.sin_addr.s_addr as *const _ as *const u8,
-            mem::size_of_val(&data.sin_addr.s_addr)
+            mem::size_of_val(&data.sin_addr.s_addr),
         );
         let port = in_port_t::from_be(data.sin_port);
-        let path = format!(bind_or_connect!($mode "{}.{}.{}.{}:{}"), addr[0], addr[1], addr[2], addr[3], port);
+        let path = format!(
+            bind_or_connect!($mode "{}.{}.{}.{}:{}"),
+            addr[0],
+            addr[1],
+            addr[2],
+            addr[3],
+            port
+        );
 
         // Duplicate the socket, and then duplicate the copy back to the original fd
         let fd = e(syscall::dup($socket as usize, path.as_bytes()));