diff -up iptables-1.4.11/extensions/libxt_set.h.cloexec iptables-1.4.11/extensions/libxt_set.h
--- iptables-1.4.11/extensions/libxt_set.h.cloexec	2011-05-26 18:12:12.000000000 +0200
+++ iptables-1.4.11/extensions/libxt_set.h	2011-06-07 16:39:04.308403784 +0200
@@ -2,6 +2,7 @@
 #define _LIBXT_SET_H
 
 #include <unistd.h>
+#include <fcntl.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <errno.h>
@@ -23,6 +24,12 @@ get_version(unsigned *version)
 		xtables_error(OTHER_PROBLEM,
 			      "Can't open socket to ipset.\n");
 
+	if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) {
+		xtables_error(OTHER_PROBLEM,
+			      "Could not set close on exec: %s\n",
+			      strerror(errno));
+	}
+
 	req_version.op = IP_SET_OP_VERSION;
 	res = getsockopt(sockfd, SOL_IP, SO_IP_SET, &req_version, &size);
 	if (res != 0)
diff -up iptables-1.4.11/libiptc/libiptc.c.cloexec iptables-1.4.11/libiptc/libiptc.c
--- iptables-1.4.11/libiptc/libiptc.c.cloexec	2011-05-26 18:12:12.000000000 +0200
+++ iptables-1.4.11/libiptc/libiptc.c	2011-06-07 16:43:15.283421508 +0200
@@ -29,6 +29,8 @@
  * 	- performance work: speedup initial ruleset parsing.
  * 	- sponsored by ComX Networks A/S (http://www.comx.dk/)
  */
+#include <unistd.h>
+#include <fcntl.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <stdbool.h>
@@ -1329,6 +1331,12 @@ TC_INIT(const char *tablename)
 	if (sockfd < 0)
 		return NULL;
 
+	if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) {
+		fprintf(stderr, "Could not set close on exec: %s\n",
+			strerror(errno));
+		abort();
+	}
+
 retry:
 	s = sizeof(info);
 
diff -up iptables-1.4.11/xtables.c.cloexec iptables-1.4.11/xtables.c