I create this issue to review and track the implementation of the PEP 433: "Easier suppression of file descriptor inheritance"
http://www.python.org/dev/peps/pep-0433/

Here is a patch of the latest revision.

configure and Python/importlib.h must be regenerated (are not part of the diff).

I tested 9bdfa1a3ea8c.patch on Fedora 16 (Linux 3.6, glibc 2.14), Debian Etch (Linux 2.6.19), OpenBSD 5.2, OpenIndiana, FreeBSD 8.2, Windows 7.

I tested both cases (works/not supported) for O_CLOEXEC and SOCK_CLOEXEC. For the WSA_FLAG_NO_HANDLE_INHERIT flag, I only tested a Windows version not supporting it (Windows 7 SP1 is required).

The select module may need more work.

New patch:

 - sys.setdefaultcloexec() takes again an argument, so sys.setdefaultcloexec(False) is allowed
 - add cloexec parameter to select.devpoll(), select.kqueue() and select.epoll()
 - when a function accepts a file name and a file descriptor: the cloexec parameter is ignored if the argument is a file descriptor (it was already done for open(), but not for socket.socket on Windows)
 - revert enhancements using cloexec=True to simplify the patch: will be done in another issue
 - fix various bugs in error handling (close newly created file descriptors on error)
 - release the GIL when calling the os: os.urandom(), os.pipe(), os.dup(), etc.

My TODO list is almost empty: the implementation is done. I just see possible enhancement on Windows: socket.socket() and os.dup() can use an atomic flag to set close-on-exec if native functions are used (WSASocket, DuplicateHandle) instead of the POSIX API. But it can be done later.

"revert enhancements using cloexec=True to simplify the patch: will be done in another issue"

I just created the issue #17070 to track this task.

> My TODO list is almost empty

Oh, I forgot one point: I stil don't know if the close-on-exec flag of
file descriptors of pass_fds argument of subprocess.Popen should be
set. If close-on-exec flag is set globally, it's not convinient to
have to clear the flag manually on each file descriptor.

I tested bc88690df059.patch on Solaris 9: test_os failed on openpty(cloexec=True). It looks like setting close-on-exec on master_fd must be done after grantpt().