[daemon] Close inherited filedescriptors after forking

We don't want to keep listening on the parent's sockets (e.g. when
started by neutron-openvswitch agent) after forking the rootwrap
daemon.

Closes-Bug: #1658973
Change-Id: I3e364e9d3ad4e2fcd6f4d8f52f847ec9fa944572

oslo_rootwrap/client.py

@@ -62,7 +62,8 @@ class Client(object):
         process_obj = subprocess.Popen(self._start_command,
                                        stdin=subprocess.PIPE,
                                        stdout=subprocess.PIPE,
-                                       stderr=subprocess.PIPE)
+                                       stderr=subprocess.PIPE,
+                                       close_fds=True)
         LOG.debug("Popen for %s command has been instantiated",
                   self._start_command)