diff --git a/src/starter/invokecharon.c b/src/starter/invokecharon.c
index e88939415..ead55e9cc 100644
--- a/src/starter/invokecharon.c
+++ b/src/starter/invokecharon.c
@@ -192,6 +192,7 @@ int starter_start_charon (starter_config_t *cfg, bool no_fork, bool attach_gdb)
 		case 0:
 			/* child */
 			setsid();
+			closefrom(3);
 			sigprocmask(SIG_SETMASK, 0, NULL);
 			/* disable glibc's malloc checker, conflicts with leak detective */
 			setenv("MALLOC_CHECK_", "0", 1);
diff --git a/src/starter/invokepluto.c b/src/starter/invokepluto.c
index 70c0692ea..2f46c99fb 100644
--- a/src/starter/invokepluto.c
+++ b/src/starter/invokepluto.c
@@ -276,6 +276,7 @@ starter_start_pluto (starter_config_t *cfg, bool no_fork, bool attach_gdb)
 				}
 			}
 			setsid();
+			closefrom(3);
 			sigprocmask(SIG_SETMASK, 0, NULL);
 			/* disable glibc's malloc checker, conflicts with leak detective */
 			setenv("MALLOC_CHECK_", "0", 1);