diff --git a/src/msg/async/AsyncMessenger.cc b/src/msg/async/AsyncMessenger.cc
index 90bb30dac64..df0f4a6c43a 100644
--- a/src/msg/async/AsyncMessenger.cc
+++ b/src/msg/async/AsyncMessenger.cc
@@ -104,7 +104,7 @@ int Processor::bind(const entity_addr_t &bind_addr, const set<int>& avoid_ports)
     listen_sd = -1;
     return r;
   }
-
+  net.set_close_on_exec(listen_sd);
   net.set_socket_options(listen_sd);
 
   // use whatever user specified (if anything)
@@ -258,6 +258,7 @@ void Processor::accept()
     socklen_t slen = sizeof(ss);
     int sd = ::accept(listen_sd, (sockaddr*)&ss, &slen);
     if (sd >= 0) {
+      net.set_close_on_exec(sd);
       ldout(msgr->cct, 10) << __func__ << " accepted incoming on sd " << sd << dendl;
 
       msgr->add_accept(sd);
diff --git a/src/msg/async/net_handler.cc b/src/msg/async/net_handler.cc
index 497c1cb77c6..dae74e4f5eb 100644
--- a/src/msg/async/net_handler.cc
+++ b/src/msg/async/net_handler.cc
@@ -73,6 +73,22 @@ int NetHandler::set_nonblock(int sd)
   return 0;
 }
 
+void NetHandler::set_close_on_exec(int sd)
+{
+  int flags = fcntl(sd, F_GETFD, 0);
+  if (flags < 0) {
+    int r = errno;
+    lderr(cct) << __func__ << " fcntl(F_GETFD): "
+	       << cpp_strerror(r) << dendl;
+    return;
+  }
+  if (fcntl(sd, F_SETFD, flags | FD_CLOEXEC)) {
+    int r = errno;
+    lderr(cct) << __func__ << " fcntl(F_SETFD): "
+	       << cpp_strerror(r) << dendl;
+  }
+}
+
 void NetHandler::set_socket_options(int sd)
 {
   // disable Nagle algorithm?
diff --git a/src/msg/async/net_handler.h b/src/msg/async/net_handler.h
index 499d8fb9e6c..02f2e96c5fb 100644
--- a/src/msg/async/net_handler.h
+++ b/src/msg/async/net_handler.h
@@ -28,6 +28,7 @@ namespace ceph {
    public:
     explicit NetHandler(CephContext *c): cct(c) {}
     int set_nonblock(int sd);
+    void set_close_on_exec(int sd);
     void set_socket_options(int sd);
     int connect(const entity_addr_t &addr);