>> Why locking? /dev/urandom is a pseudo char device. You can have multiple
>> readers on the same fd without any locking.
>
> You must put a lock around the open() call, though, to avoid calling it
> several times and losing an fd.

Exactly (unless the FD is open during the module initialization,
instead of using lazy-open upon first os.urandom() call).