diff --git a/devices/v2.go b/devices/v2.go
index 508f3dd..1116862 100644
--- a/devices/v2.go
+++ b/devices/v2.go
@@ -59,7 +59,7 @@ func setV2(dirPath string, r *cgroups.Resources) error {
 	if err != nil {
 		return err
 	}
-	dirFD, err := unix.Open(dirPath, unix.O_DIRECTORY|unix.O_RDONLY, 0o600)
+	dirFD, err := unix.Open(dirPath, unix.O_DIRECTORY|unix.O_RDONLY|unix.O_CLOEXEC, 0o600)
 	if err != nil {
 		return fmt.Errorf("cannot get dir FD for %s", dirPath)
 	}
diff --git a/fs/fs.go b/fs/fs.go
index 879400c..cf1a875 100644
--- a/fs/fs.go
+++ b/fs/fs.go
@@ -154,7 +154,8 @@ func (m *Manager) AddPid(subcgroup string, pid int) (retErr error) {
 
 	for _, dir := range m.paths {
 		path := path.Join(dir, subcgroup)
-		if !strings.HasPrefix(path, dir) {
+		// Make sure path is either dir itself or below it.
+		if path != dir && !strings.HasPrefix(path, dir+"/") {
 			return fmt.Errorf("bad sub cgroup path: %s", subcgroup)
 		}
 
diff --git a/fs2/fs2.go b/fs2/fs2.go
index 46819a8..710fb4f 100644
--- a/fs2/fs2.go
+++ b/fs2/fs2.go
@@ -89,7 +89,8 @@ func (m *Manager) Apply(pid int) error {
 // a cgroup under under the manager's cgroup.
 func (m *Manager) AddPid(subcgroup string, pid int) error {
 	path := filepath.Join(m.dirPath, subcgroup)
-	if !strings.HasPrefix(path, m.dirPath) {
+	// Make sure path is either m.dirPath itself or below it.
+	if path != m.dirPath && !strings.HasPrefix(path, m.dirPath+"/") {
 		return fmt.Errorf("bad sub cgroup path: %s", subcgroup)
 	}