Another idea is to write a best-effort function to open a file with CLOEXEC flag:
 * use O_CLOEXEC if available
 * use fcntl(fd, F_SETFD, flags | FD_CLOEXEC) if O_CLOEXEC is missing or was silently ignored by the kernel (by open)

Attached open_cloexec.py is an implementation.

--

Usage of "CLOEXEC" in the Python standard library:

- subprocess: create pipe. use pipe2() or pipe()+fcntl(FD_CLOEXEC)
- test_socket: create a socket. use SOCK_CLOEXEC. The test is skipped if the kernel is Linux < 2.6.28. It has a nice linux_version() which should be moved to the platform module.
- test_posix: check open(O_CLOEXEC).
- test_tempfile: test "cloexec" behaviour using os.spawnl()
- xmlrpclib: use FD_CLOEXEC on the socket

You may also add pipe_cloexec() to os, and socket_cloexec() to socket?