diff --git a/mpp/legacy/vpu.c b/mpp/legacy/vpu.c
index 5b056218..540eadc9 100644
--- a/mpp/legacy/vpu.c
+++ b/mpp/legacy/vpu.c
@@ -17,7 +17,6 @@
 #define MODULE_TAG "vpu"
 
 #include <sys/ioctl.h>
-#include <fcntl.h>
 #include <errno.h>
 #include <string.h>
 
diff --git a/mpp/legacy/vpu_api_legacy.cpp b/mpp/legacy/vpu_api_legacy.cpp
index 42eead46..ff69f44d 100644
--- a/mpp/legacy/vpu_api_legacy.cpp
+++ b/mpp/legacy/vpu_api_legacy.cpp
@@ -16,7 +16,6 @@
 
 #define MODULE_TAG "vpu_api_legacy"
 
-#include <fcntl.h>
 #include "string.h"
 
 #include "mpp_mem.h"
diff --git a/mpp/legacy/vpu_api_mlvec.cpp b/mpp/legacy/vpu_api_mlvec.cpp
index e71922fd..f32c9171 100644
--- a/mpp/legacy/vpu_api_mlvec.cpp
+++ b/mpp/legacy/vpu_api_mlvec.cpp
@@ -16,7 +16,6 @@
 
 #define MODULE_TAG "vpu_api_mlvec"
 
-#include <fcntl.h>
 #include "string.h"
 
 #include "mpp_mem.h"
diff --git a/mpp/vproc/iep/iep.cpp b/mpp/vproc/iep/iep.cpp
index 5bdc173b..35e22345 100644
--- a/mpp/vproc/iep/iep.cpp
+++ b/mpp/vproc/iep/iep.cpp
@@ -17,7 +17,6 @@
 #define MODULE_TAG "iep"
 
 #include <math.h>
-#include <fcntl.h>
 #include <string.h>
 
 #include "mpp_env.h"
diff --git a/mpp/vproc/rga/rga.cpp b/mpp/vproc/rga/rga.cpp
index b4e817f6..4b7bd56f 100644
--- a/mpp/vproc/rga/rga.cpp
+++ b/mpp/vproc/rga/rga.cpp
@@ -17,7 +17,6 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/ioctl.h>
-#include <fcntl.h>
 #include <errno.h>
 #include <string.h>
 #include <stdint.h>
diff --git a/osal/allocator/allocator_dma_heap.c b/osal/allocator/allocator_dma_heap.c
index dae08cd3..f2465af3 100644
--- a/osal/allocator/allocator_dma_heap.c
+++ b/osal/allocator/allocator_dma_heap.c
@@ -19,7 +19,6 @@
 #include <unistd.h>
 #include <string.h>
 #include <errno.h>
-#include <fcntl.h>
 #include <sys/ioctl.h>
 #include <sys/mman.h>
 
@@ -113,7 +112,7 @@ static MPP_RET try_flip_flag(RK_U32 orig, RK_U32 flag)
     src = &heap_infos[used];
     if (src->fd > 0) {
         /* found valid heap use it */
-        dst->fd = dup(src->fd);
+        dst->fd = mpp_dup(src->fd);
         dst->flags = src->flags;
 
         dma_heap_dbg_chk("dma-heap type %x %s remap to %x %s\n",
@@ -278,7 +277,7 @@ static MPP_RET os_allocator_dma_heap_import(void *ctx, MppBufferInfo *data)
 
     mpp_assert(fd_ext > 0);
 
-    data->fd = dup(fd_ext);
+    data->fd = mpp_dup(fd_ext);
     data->ptr = NULL;
 
     dma_heap_dbg_ops("dev %d import %3d -> %3d\n", p->device, fd_ext, data->fd);
diff --git a/osal/allocator/allocator_drm.c b/osal/allocator/allocator_drm.c
index 2a4dc928..9bed02fa 100644
--- a/osal/allocator/allocator_drm.c
+++ b/osal/allocator/allocator_drm.c
@@ -19,7 +19,6 @@
 #include <unistd.h>
 #include <string.h>
 #include <errno.h>
-#include <fcntl.h>
 #include <sys/ioctl.h>
 #include <sys/mman.h>
 
@@ -254,7 +253,7 @@ static MPP_RET os_allocator_drm_import(void *ctx, MppBufferInfo *data)
 
     mpp_assert(fd_ext > 0);
 
-    data->fd = dup(fd_ext);
+    data->fd = mpp_dup(fd_ext);
     data->ptr = NULL;
 
     if (data->fd <= 0) {
diff --git a/osal/allocator/allocator_ion.c b/osal/allocator/allocator_ion.c
index f466b4d4..3739e46f 100644
--- a/osal/allocator/allocator_ion.c
+++ b/osal/allocator/allocator_ion.c
@@ -19,7 +19,6 @@
 #include <unistd.h>
 #include <string.h>
 #include <errno.h>
-#include <fcntl.h>
 #include <sys/ioctl.h>
 #include <sys/mman.h>
 
diff --git a/osal/inc/mpp_common.h b/osal/inc/mpp_common.h
index fb8eb98d..b4d29e01 100644
--- a/osal/inc/mpp_common.h
+++ b/osal/inc/mpp_common.h
@@ -135,6 +135,7 @@
 #include <direct.h>
 #include <io.h>
 #include <sys/stat.h>
+
 #define chdir                   _chdir
 #define mkdir                   _mkdir
 #define access                  _access
@@ -150,6 +151,7 @@
 #else
 #include <unistd.h>
 #include <stddef.h>
+#include <fcntl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #define mkdir(x)                mkdir(x, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH)
@@ -210,6 +212,12 @@ static __inline RK_U32 mpp_is_32bit()
     return ((sizeof(void *) == 4) ? (1) : (0));
 }
 
+static __inline RK_S32 mpp_dup(RK_S32 fd)
+{
+    /* avoid stdin / stdout / stderr so start from 3 */
+    return fcntl(fd, F_DUPFD_CLOEXEC, 3);
+}
+
 RK_S32 axb_div_c(RK_S32 a, RK_S32 b, RK_S32 c);
 RK_U32 mpp_align_16(RK_U32 val);
 RK_U32 mpp_align_64(RK_U32 val);
diff --git a/utils/camera_source.c b/utils/camera_source.c
index 9099eacd..296a21b0 100644
--- a/utils/camera_source.c
+++ b/utils/camera_source.c
@@ -125,7 +125,7 @@ CamSource *camera_source_init(const char *device, RK_U32 bufcnt, RK_U32 width, R
         return NULL;
 
     ctx->bufcnt = bufcnt;
-    ctx->fd = open(device, O_RDWR, 0);
+    ctx->fd = open(device, O_RDWR | O_CLOEXEC, 0);
     if (ctx->fd < 0) {
         mpp_err_f("Cannot open device\n");
         goto FAIL;