diff --git a/mnexec.c b/mnexec.c
index a9cb867..d3f173d 100644
--- a/mnexec.c
+++ b/mnexec.c
@@ -130,6 +130,16 @@ int main(int argc, char *argv[])
                 perror("unshare");
                 return 1;
             }
+
+            /* Mark our whole hierarchy recursively as private, so that our
+             * mounts do not propagate to other processes.
+             */
+
+            if (mount("none", "/", NULL, MS_REC|MS_PRIVATE, NULL) == -1) {
+                perror("remount");
+                return 1;
+            }
+
             /* mount sysfs to pick up the new network namespace */
             if (mount("sysfs", "/sys", "sysfs", MS_MGC_VAL, NULL) == -1) {
                 perror("mount");