set close_fds=True in Popen

The current way of using Popen does not close pipes properly,
and therefore long-running keystone processes, which depends on
keystoneclient.common.cms for data sigining, eventually hit
open file limit and stop working. Passing close_fds=True seems
to have solved the problem.

Change-Id: Ife452ab6843c1af5eb39debb8db453e45f78cba9
Closes-Bug: 1382906

1 files changed, 4 insertions, 2 deletions

diff --git a/keystoneclient/common/cms.py b/keystoneclient/common/cms.py
index 1c343f6..343b303 100644
--- a/keystoneclient/common/cms.py
+++ b/keystoneclient/common/cms.py
@@ -148,7 +148,8 @@ def cms_verify(formatted, signing_cert_file_name, ca_file_name,
                                 '-nocerts', '-noattr'],
                                stdin=subprocess.PIPE,
                                stdout=subprocess.PIPE,
-                               stderr=subprocess.PIPE)
+                               stderr=subprocess.PIPE,
+                               close_fds=True)
     output, err, retcode = _process_communicate_handle_oserror(
         process, data, (signing_cert_file_name, ca_file_name))
 
@@ -336,7 +337,8 @@ def cms_sign_data(data_to_sign, signing_cert_file_name, signing_key_file_name,
                                 '-md', 'sha256', ],
                                stdin=subprocess.PIPE,
                                stdout=subprocess.PIPE,
-                               stderr=subprocess.PIPE)
+                               stderr=subprocess.PIPE,
+                               close_fds=True)
 
     output, err, retcode = _process_communicate_handle_oserror(
         process, data, (signing_cert_file_name, signing_key_file_name))