diff --git a/tuned/plugins/plugin_mounts.py b/tuned/plugins/plugin_mounts.py
index 54c28c5..55b6b9e 100644
--- a/tuned/plugins/plugin_mounts.py
+++ b/tuned/plugins/plugin_mounts.py
@@ -38,7 +38,7 @@ class MountsPlugin(base.Plugin):
 		mountpoint_topology = {}
 		current_disk = None
 
-		stdout, stderr = Popen(["/usr/bin/lsblk", "-rno", "TYPE,RM,KNAME,FSTYPE,MOUNTPOINT"], stdout=PIPE, stderr=PIPE).communicate()
+		stdout, stderr = Popen(["/usr/bin/lsblk", "-rno", "TYPE,RM,KNAME,FSTYPE,MOUNTPOINT"], stdout=PIPE, stderr=PIPE, close_fds=True).communicate()
 		for columns in map(lambda line: line.split(), stdout.splitlines()):
 			device_type, device_removable, device_name = columns[:3]
 			filesystem = columns[3] if len(columns) > 3 else None
diff --git a/tuned/plugins/plugin_script.py b/tuned/plugins/plugin_script.py
index 0cb6a34..0807adb 100644
--- a/tuned/plugins/plugin_script.py
+++ b/tuned/plugins/plugin_script.py
@@ -32,7 +32,7 @@ class ScriptPlugin(base.Plugin):
 		for script in self._scripts:
 			log.info("Calling script %s with arg %s" % (script, arg))
 			try:
-				proc = Popen([script, arg], stdout=PIPE, stderr=PIPE)
+				proc = Popen([script, arg], stdout=PIPE, stderr=PIPE, close_fds=True)
 				out, err = proc.communicate()
 
 				if proc.returncode:
diff --git a/tuned/plugins/plugin_sysctl.py b/tuned/plugins/plugin_sysctl.py
index ddc8d65..cc10b51 100644
--- a/tuned/plugins/plugin_sysctl.py
+++ b/tuned/plugins/plugin_sysctl.py
@@ -33,9 +33,9 @@ class SysctlPlugin(base.Plugin):
 	def _exec_sysctl(self, data, write = False):
 		if write:
 			log.debug("Setting sysctl: %s" % (data))
-			proc = Popen(["/sbin/sysctl", "-q", "-w", data], stdout=PIPE, stderr=PIPE)
+			proc = Popen(["/sbin/sysctl", "-q", "-w", data], stdout=PIPE, stderr=PIPE, close_fds=True)
 		else:
-			proc = Popen(["/sbin/sysctl", "-e", data], stdout=PIPE, stderr=PIPE)
+			proc = Popen(["/sbin/sysctl", "-e", data], stdout=PIPE, stderr=PIPE, close_fds=True)
 		out, err = proc.communicate()
 
 		if proc.returncode:
diff --git a/tuned/utils/commands.py b/tuned/utils/commands.py
index f898311..c01f267 100644
--- a/tuned/utils/commands.py
+++ b/tuned/utils/commands.py
@@ -40,7 +40,7 @@ def execute(args):
 	log.debug("Executing %s." % str(args))
 	out = ""
 	try:
-		proc = Popen(args, stdout=PIPE, stderr=PIPE, env=execute._environment)
+		proc = Popen(args, stdout=PIPE, stderr=PIPE, env=execute._environment, close_fds=True)
 		out, err = proc.communicate()
 
 		if proc.returncode:
diff --git a/tuned/utils/nettool.py b/tuned/utils/nettool.py
index 676efca..28fdf89 100644
--- a/tuned/utils/nettool.py
+++ b/tuned/utils/nettool.py
@@ -57,13 +57,13 @@ class Nettool:
 		if not self.supported_autoneg:
 			return False
 
-		return 0 == call(["ethtool", "-s", self._interface, "autoneg", "on" if enable else "off"])
+		return 0 == call(["ethtool", "-s", self._interface, "autoneg", "on" if enable else "off"], close_fds=True)
 
 	def _set_advertise(self, value):
 		if not self._set_autonegotiation(True):
 			return False
 
-		return 0 == call(["ethtool", "-s", self._interface, "advertise", "0x%03x" % value])
+		return 0 == call(["ethtool", "-s", self._interface, "advertise", "0x%03x" % value], close_fds=True)
 
 	def get_max_speed(self):
 		max = 0
@@ -113,8 +113,8 @@ class Nettool:
 
 		# run ethtool and preprocess output
 
-		p_ethtool = Popen(["ethtool", self._interface], stdout=PIPE, stderr=PIPE)
-		p_filter = Popen(["sed", "s/^\s*//;s/:\s*/:\\n/g"], stdin=p_ethtool.stdout, stdout=PIPE)
+		p_ethtool = Popen(["ethtool", self._interface], stdout=PIPE, stderr=PIPE, close_fds=True)
+		p_filter = Popen(["sed", "s/^\s*//;s/:\s*/:\\n/g"], stdin=p_ethtool.stdout, stdout=PIPE, close_fds=True)
 
 		output = p_filter.communicate()[0]
 		errors = p_ethtool.communicate()[1]