From f00755f04ac5298c86620592af1c65acb0f021ae Mon Sep 17 00:00:00 2001 From: "Xu (Simon) Chen" Date: Sat, 18 Oct 2014 23:00:01 -0400 Subject: [PATCH] set close_fds=True in Popen The current way of using Popen does not close pipes properly, and therefore long-running keystone processes, which depends on keystoneclient.common.cms for data sigining, eventually hit open file limit and stop working. Passing close_fds=True seems to have solved the problem. Change-Id: Ife452ab6843c1af5eb39debb8db453e45f78cba9 Closes-Bug: 1382906 --- keystoneclient/common/cms.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/keystoneclient/common/cms.py b/keystoneclient/common/cms.py index 1c343f68d..343b303e8 100644 --- a/keystoneclient/common/cms.py +++ b/keystoneclient/common/cms.py @@ -148,7 +148,8 @@ def cms_verify(formatted, signing_cert_file_name, ca_file_name, '-nocerts', '-noattr'], stdin=subprocess.PIPE, stdout=subprocess.PIPE, - stderr=subprocess.PIPE) + stderr=subprocess.PIPE, + close_fds=True) output, err, retcode = _process_communicate_handle_oserror( process, data, (signing_cert_file_name, ca_file_name)) @@ -336,7 +337,8 @@ def cms_sign_data(data_to_sign, signing_cert_file_name, signing_key_file_name, '-md', 'sha256', ], stdin=subprocess.PIPE, stdout=subprocess.PIPE, - stderr=subprocess.PIPE) + stderr=subprocess.PIPE, + close_fds=True) output, err, retcode = _process_communicate_handle_oserror( process, data, (signing_cert_file_name, signing_key_file_name))