close nonstandard fds before forking external processes

diff --git a/curlwrapper.py b/curlwrapper.py
index 462c6ed..e259578 100644 (file)
--- a/curlwrapper.py
+++ b/curlwrapper.py
@@ -8,7 +8,7 @@ def retrieve(url, cacert=None, postdata=None, timeout=300):
     if cacert: options += ('--cacert', cacert)
     if postdata: options += ('--data', '@-')
     if timeout: options += ('--max-time', str(timeout))
-    p = Popen(options + (url,), stdin=PIPE, stdout=PIPE, stderr=PIPE)
+    p = Popen(options + (url,), stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=True)
     if postdata: p.stdin.write(postdata)
     p.stdin.close()
     data = p.stdout.read()

diff --git a/logger.py b/logger.py
index fa13dd9..8abd8fd 100644 (file)
--- a/logger.py
+++ b/logger.py
@@ -21,7 +21,7 @@ def log(msg):
 
 def log_call(*args):
     log('running command %s' % ' '.join(args))
-    try: subprocess.call(args)
+    try: subprocess.call(args, close_fds=True)
     except: log_exc()
 
 def log_exc():

diff --git a/ticket.py b/ticket.py
index b50a76e..c45e865 100644 (file)
--- a/ticket.py
+++ b/ticket.py
@@ -37,4 +37,4 @@ def verify(signed_msg):
 
 def _popen_gpg(*args):
     """Return a Popen object to GPG."""
-    return Popen((GPG, '--batch', '--no-tty') + args, stdin=PIPE, stdout=PIPE, stderr=PIPE)
+    return Popen((GPG, '--batch', '--no-tty') + args, stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=True)