diff --git a/lib/puppet/application/kick.rb b/lib/puppet/application/kick.rb
index 0b6ddc9c5..5d5ed62be 100644
--- a/lib/puppet/application/kick.rb
+++ b/lib/puppet/application/kick.rb
@@ -1,351 +1,351 @@
 require 'puppet/application'
 
 class Puppet::Application::Kick < Puppet::Application
 
   should_not_parse_config
 
   attr_accessor :hosts, :tags, :classes
 
   option("--all","-a")
   option("--foreground","-f")
   option("--debug","-d")
   option("--ping","-P")
   option("--test")
 
   option("--host HOST") do |arg|
     @hosts << arg
   end
 
   option("--tag TAG", "-t") do |arg|
     @tags << arg
   end
 
   option("--class CLASS", "-c") do |arg|
     @classes << arg
   end
 
   option("--no-fqdn", "-n") do |arg|
     options[:fqdn] = false
   end
 
   option("--parallel PARALLEL", "-p") do |arg|
     begin
       options[:parallel] = Integer(arg)
     rescue
       $stderr.puts "Could not convert #{arg.inspect} to an integer"
       exit(23)
     end
   end
 
   def help
     <<-HELP
 
 puppet-kick(8) -- Remotely control puppet agent
 ========
 
 SYNOPSIS
 --------
 Trigger a puppet agent run on a set of hosts.
 
 
 USAGE
 -----
 puppet kick [-a|--all] [-c|--class <class>] [-d|--debug] [-f|--foreground]
   [-h|--help] [--host <host>] [--no-fqdn] [--ignoreschedules]
   [-t|--tag <tag>] [--test] [-p|--ping] <host> [<host> [...]]
 
 
 DESCRIPTION
 -----------
 This script can be used to connect to a set of machines running 'puppet
 agent' and trigger them to run their configurations. The most common
 usage would be to specify a class of hosts and a set of tags, and
 'puppet kick' would look up in LDAP all of the hosts matching that
 class, then connect to each host and trigger a run of all of the objects
 with the specified tags.
 
 If you are not storing your host configurations in LDAP, you can specify
 hosts manually.
 
 You will most likely have to run 'puppet kick' as root to get access to
 the SSL certificates.
 
 'puppet kick' reads 'puppet master''s configuration file, so that it can
 copy things like LDAP settings.
 
 
 USAGE NOTES
 -----------
 Puppet kick needs the puppet agent on the target machine to be running as a
 daemon, be configured to listen for incoming network connections, and have an
 appropriate security configuration.
 
 The specific changes required are:
 
 * Set `listen = true` in the agent's `puppet.conf` file (or `--listen` on the
   command line)
 * Configure the node's firewall to allow incoming connections on port 8139
 * Insert the following stanza at the top of the node's `auth.conf` file:
 
         # Allow puppet kick access
         path    /run
         method  save
         auth    any
         allow   workstation.example.com
 
 This example would allow the machine `workstation.example.com` to trigger a
 Puppet run; adjust the "allow" directive to suit your site. You may also use
 `allow *` to allow anyone to trigger a Puppet run, but that makes it possible
 to interfere with your site by triggering excessive Puppet runs.
 
 See `http://docs.puppetlabs.com/guides/rest_auth_conf.html` for more details
 about security settings.
 
 OPTIONS
 -------
 Note that any configuration parameter that's valid in the configuration
 file is also a valid long argument. For example, 'ssldir' is a valid
 configuration parameter, so you can specify '--ssldir <directory>' as an
 argument.
 
 See the configuration file documentation at
 http://docs.puppetlabs.com/references/latest/configuration.html for
 the full list of acceptable parameters. A commented list of all
 configuration options can also be generated by running puppet master
 with '--genconfig'.
 
 * --all:
   Connect to all available hosts. Requires LDAP support at this point.
 
 * --class:
   Specify a class of machines to which to connect. This only works if
   you have LDAP configured, at the moment.
 
 * --debug:
   Enable full debugging.
 
 * --foreground:
   Run each configuration in the foreground; that is, when connecting to
   a host, do not return until the host has finished its run. The default
   is false.
 
 * --help:
   Print this help message
 
 * --host:
   A specific host to which to connect. This flag can be specified more
   than once.
 
 * --ignoreschedules:
   Whether the client should ignore schedules when running its
   configuration. This can be used to force the client to perform work it
   would not normally perform so soon. The default is false.
 
 * --parallel:
   How parallel to make the connections. Parallelization is provided by
   forking for each client to which to connect. The default is 1, meaning
   serial execution.
 
 * --tag:
   Specify a tag for selecting the objects to apply. Does not work with
   the --test option.
 
 * --test:
   Print the hosts you would connect to but do not actually connect. This
   option requires LDAP support at this point.
 
 * --ping:
   Do a ICMP echo against the target host. Skip hosts that don't respond
   to ping.
 
 
 EXAMPLE
 -------
     $ sudo puppet kick -p 10 -t remotefile -t webserver host1 host2
 
 
 AUTHOR
 ------
 Luke Kanies
 
 
 COPYRIGHT
 ---------
 Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
 
     HELP
   end
 
   def run_command
     @hosts += command_line.args
     options[:test] ? test : main
   end
 
   def test
     puts "Skipping execution in test mode"
     exit(0)
   end
 
   def main
     Puppet.warning "Failed to load ruby LDAP library. LDAP functionality will not be available" unless Puppet.features.ldap?
     require 'puppet/util/ldap/connection'
 
     todo = @hosts.dup
 
     failures = []
 
     # Now do the actual work
     go = true
     while go
       # If we don't have enough children in process and we still have hosts left to
       # do, then do the next host.
       if @children.length < options[:parallel] and ! todo.empty?
         host = todo.shift
-        pid = fork do
+        pid = safe_posix_fork do
           run_for_host(host)
         end
         @children[pid] = host
       else
         # Else, see if we can reap a process.
         begin
           pid = Process.wait
 
           if host = @children[pid]
             # Remove our host from the list of children, so the parallelization
             # continues working.
             @children.delete(pid)
             failures << host if $CHILD_STATUS.exitstatus != 0
             print "#{host} finished with exit code #{$CHILD_STATUS.exitstatus}\n"
           else
             $stderr.puts "Could not find host for PID #{pid} with status #{$CHILD_STATUS.exitstatus}"
           end
         rescue Errno::ECHILD
           # There are no children left, so just exit unless there are still
           # children left to do.
           next unless todo.empty?
 
           if failures.empty?
             puts "Finished"
             exit(0)
           else
             puts "Failed: #{failures.join(", ")}"
             exit(3)
           end
         end
       end
     end
   end
 
   def run_for_host(host)
     if options[:ping]
       out = %x{ping -c 1 #{host}}
       unless $CHILD_STATUS == 0
         $stderr.print "Could not contact #{host}\n"
         exit($CHILD_STATUS)
       end
     end
 
     require 'puppet/run'
     Puppet::Run.indirection.terminus_class = :rest
     port = Puppet[:puppetport]
     url = ["https://#{host}:#{port}", "production", "run", host].join('/')
 
     print "Triggering #{host}\n"
     begin
       run_options = {
         :tags => @tags,
         :background => ! options[:foreground],
         :ignoreschedules => options[:ignoreschedules]
       }
       run = Puppet::Run.indirection.save(Puppet::Run.new( run_options ), url)
       puts "Getting status"
       result = run.status
       puts "status is #{result}"
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       $stderr.puts "Host #{host} failed: #{detail}\n"
       exit(2)
     end
 
     case result
     when "success";
       exit(0)
     when "running"
       $stderr.puts "Host #{host} is already running"
       exit(3)
     else
       $stderr.puts "Host #{host} returned unknown answer '#{result}'"
       exit(12)
     end
   end
 
   def initialize(*args)
     super
     @hosts = []
     @classes = []
     @tags = []
   end
 
   def preinit
     [:INT, :TERM].each do |signal|
       Signal.trap(signal) do
         $stderr.puts "Cancelling"
         exit(1)
       end
     end
     options[:parallel] = 1
     options[:verbose] = true
     options[:fqdn] = true
     options[:ignoreschedules] = false
     options[:foreground] = false
   end
 
   def setup
     raise Puppet::Error.new("Puppet kick is not supported on Microsoft Windows") if Puppet.features.microsoft_windows?
 
     if options[:debug]
       Puppet::Util::Log.level = :debug
     else
       Puppet::Util::Log.level = :info
     end
 
     # Now parse the config
     Puppet.parse_config
 
     if Puppet[:node_terminus] == "ldap" and (options[:all] or @classes)
       if options[:all]
         @hosts = Puppet::Node.indirection.search("whatever", :fqdn => options[:fqdn]).collect { |node| node.name }
         puts "all: #{@hosts.join(", ")}"
       else
         @hosts = []
         @classes.each do |klass|
           list = Puppet::Node.indirection.search("whatever", :fqdn => options[:fqdn], :class => klass).collect { |node| node.name }
           puts "#{klass}: #{list.join(", ")}"
 
           @hosts += list
         end
       end
     elsif ! @classes.empty?
       $stderr.puts "You must be using LDAP to specify host classes"
       exit(24)
     end
 
     @children = {}
 
     # If we get a signal, then kill all of our children and get out.
     [:INT, :TERM].each do |signal|
       Signal.trap(signal) do
         Puppet.notice "Caught #{signal}; shutting down"
         @children.each do |pid, host|
           Process.kill("INT", pid)
         end
 
         waitall
 
         exit(1)
       end
     end
 
   end
 
 end
diff --git a/lib/puppet/reports/tagmail.rb b/lib/puppet/reports/tagmail.rb
index 2c2c475ef..8df669b88 100644
--- a/lib/puppet/reports/tagmail.rb
+++ b/lib/puppet/reports/tagmail.rb
@@ -1,179 +1,179 @@
 require 'puppet'
 require 'pp'
 
 require 'net/smtp'
 require 'time'
 
 Puppet::Reports.register_report(:tagmail) do
   desc "This report sends specific log messages to specific email addresses
     based on the tags in the log messages.  
 
     See the [documentation on tags](http://projects.puppetlabs.com/projects/puppet/wiki/Using_Tags) for more information.
 
     To use this report, you must create a `tagmail.conf` file in the location
     specified by the `tagmap` setting.  This is a simple file that maps tags to
     email addresses:  Any log messages in the report that match the specified
     tags will be sent to the specified email addresses.
 
     Lines in the `tagmail.conf` file consist of a comma-separated list
     of tags, a colon, and a comma-separated list of email addresses.
     Tags can be !negated with a leading exclamation mark, which will
     subtract any messages with that tag from the set of events handled
     by that line.
 
     Puppet's log levels (`debug`, `info`, `notice`, `warning`, `err`,
     `alert`, `emerg`, `crit`, and `verbose`) can also be used as tags,
     and there is an `all` tag that will always match all log messages.
 
     An example `tagmail.conf`:
 
         all: me@domain.com
         webserver, !mailserver: httpadmins@domain.com
 
     This will send all messages to `me@domain.com`, and all messages from
     webservers that are not also from mailservers to `httpadmins@domain.com`.
 
     If you are using anti-spam controls such as grey-listing on your mail
     server, you should whitelist the sending email address (controlled by
     `reportform` configuration option) to ensure your email is not discarded as spam.
     "
 
   # Find all matching messages.
   def match(taglists)
     matching_logs = []
     taglists.each do |emails, pos, neg|
       # First find all of the messages matched by our positive tags
       messages = nil
       if pos.include?("all")
         messages = self.logs
       else
         # Find all of the messages that are tagged with any of our
         # tags.
         messages = self.logs.find_all do |log|
           pos.detect { |tag| log.tagged?(tag) }
         end
       end
 
       # Now go through and remove any messages that match our negative tags
       messages = messages.reject do |log|
         true if neg.detect do |tag| log.tagged?(tag) end
       end
 
       if messages.empty?
         Puppet.info "No messages to report to #{emails.join(",")}"
         next
       else
         matching_logs << [emails, messages.collect { |m| m.to_report }.join("\n")]
       end
     end
 
     matching_logs
   end
 
   # Load the config file
   def parse(text)
     taglists = []
     text.split("\n").each do |line|
       taglist = emails = nil
       case line.chomp
       when /^\s*#/; next
       when /^\s*$/; next
       when /^\s*(.+)\s*:\s*(.+)\s*$/
         taglist = $1
         emails = $2.sub(/#.*$/,'')
       else
         raise ArgumentError, "Invalid tagmail config file"
       end
 
       pos = []
       neg = []
       taglist.sub(/\s+$/,'').split(/\s*,\s*/).each do |tag|
         unless tag =~ /^!?[-\w\.]+$/
           raise ArgumentError, "Invalid tag #{tag.inspect}"
         end
         case tag
         when /^\w+/; pos << tag
         when /^!\w+/; neg << tag.sub("!", '')
         else
           raise Puppet::Error, "Invalid tag '#{tag}'"
         end
       end
 
       # Now split the emails
       emails = emails.sub(/\s+$/,'').split(/\s*,\s*/)
       taglists << [emails, pos, neg]
     end
     taglists
   end
 
   # Process the report.  This just calls the other associated messages.
   def process
     unless FileTest.exists?(Puppet[:tagmap])
       Puppet.notice "Cannot send tagmail report; no tagmap file #{Puppet[:tagmap]}"
       return
     end
 
     metrics = raw_summary['resources'] || {} rescue {}
 
     if metrics['out_of_sync'] == 0 && metrics['changed'] == 0
       Puppet.notice "Not sending tagmail report; no changes"
       return
     end
 
     taglists = parse(File.read(Puppet[:tagmap]))
 
     # Now find any appropriately tagged messages.
     reports = match(taglists)
 
     send(reports)
   end
 
   # Send the email reports.
   def send(reports)
-    pid = fork do
+    pid = Puppet::Util.safe_posix_fork do
       if Puppet[:smtpserver] != "none"
         begin
           Net::SMTP.start(Puppet[:smtpserver]) do |smtp|
             reports.each do |emails, messages|
               smtp.open_message_stream(Puppet[:reportfrom], *emails) do |p|
                 p.puts "From: #{Puppet[:reportfrom]}"
                 p.puts "Subject: Puppet Report for #{self.host}"
                 p.puts "To: " + emails.join(", ")
                 p.puts "Date: #{Time.now.rfc2822}"
                 p.puts
                 p.puts messages
               end
             end
           end
         rescue => detail
           puts detail.backtrace if Puppet[:debug]
           raise Puppet::Error,
             "Could not send report emails through smtp: #{detail}"
         end
       elsif Puppet[:sendmail] != ""
         begin
           reports.each do |emails, messages|
             # We need to open a separate process for every set of email addresses
             IO.popen(Puppet[:sendmail] + " " + emails.join(" "), "w") do |p|
               p.puts "From: #{Puppet[:reportfrom]}"
               p.puts "Subject: Puppet Report for #{self.host}"
               p.puts "To: " + emails.join(", ")
 
               p.puts messages
             end
           end
         rescue => detail
           puts detail.backtrace if Puppet[:debug]
           raise Puppet::Error,
             "Could not send report emails via sendmail: #{detail}"
         end
       else
         raise Puppet::Error, "SMTP server is unset and could not find sendmail"
       end
     end
 
     # Don't bother waiting for the pid to return.
     Process.detach(pid)
   end
 end
 
diff --git a/lib/puppet/util.rb b/lib/puppet/util.rb
index 461e82ab3..f50def66b 100644
--- a/lib/puppet/util.rb
+++ b/lib/puppet/util.rb
@@ -1,569 +1,577 @@
 # A module to collect utility functions.
 
 require 'English'
 require 'puppet/util/monkey_patches'
 require 'puppet/external/lock'
 require 'puppet/util/execution_stub'
 require 'uri'
 require 'sync'
 require 'monitor'
 require 'tempfile'
 require 'pathname'
 
 module Puppet
   # A command failed to execute.
   require 'puppet/error'
   class ExecutionFailure < Puppet::Error
   end
 module Util
   require 'benchmark'
 
   # These are all for backward compatibility -- these are methods that used
   # to be in Puppet::Util but have been moved into external modules.
   require 'puppet/util/posix'
   extend Puppet::Util::POSIX
 
   @@sync_objects = {}.extend MonitorMixin
 
   def self.activerecord_version
     if (defined?(::ActiveRecord) and defined?(::ActiveRecord::VERSION) and defined?(::ActiveRecord::VERSION::MAJOR) and defined?(::ActiveRecord::VERSION::MINOR))
       ([::ActiveRecord::VERSION::MAJOR, ::ActiveRecord::VERSION::MINOR].join('.').to_f)
     else
       0
     end
   end
 
   def self.synchronize_on(x,type)
     sync_object,users = 0,1
     begin
       @@sync_objects.synchronize {
         (@@sync_objects[x] ||= [Sync.new,0])[users] += 1
       }
       @@sync_objects[x][sync_object].synchronize(type) { yield }
     ensure
       @@sync_objects.synchronize {
         @@sync_objects.delete(x) unless (@@sync_objects[x][users] -= 1) > 0
       }
     end
   end
 
   # Change the process to a different user
   def self.chuser
     if group = Puppet[:group]
       begin
         Puppet::Util::SUIDManager.change_group(group, true)
       rescue => detail
         Puppet.warning "could not change to group #{group.inspect}: #{detail}"
         $stderr.puts "could not change to group #{group.inspect}"
 
         # Don't exit on failed group changes, since it's
         # not fatal
         #exit(74)
       end
     end
 
     if user = Puppet[:user]
       begin
         Puppet::Util::SUIDManager.change_user(user, true)
       rescue => detail
         $stderr.puts "Could not change to user #{user}: #{detail}"
         exit(74)
       end
     end
   end
 
   # Create instance methods for each of the log levels.  This allows
   # the messages to be a little richer.  Most classes will be calling this
   # method.
   def self.logmethods(klass, useself = true)
     Puppet::Util::Log.eachlevel { |level|
       klass.send(:define_method, level, proc { |args|
         args = args.join(" ") if args.is_a?(Array)
         if useself
 
           Puppet::Util::Log.create(
             :level => level,
             :source => self,
             :message => args
           )
         else
 
           Puppet::Util::Log.create(
             :level => level,
             :message => args
           )
         end
       })
     }
   end
 
   # Proxy a bunch of methods to another object.
   def self.classproxy(klass, objmethod, *methods)
     classobj = class << klass; self; end
     methods.each do |method|
       classobj.send(:define_method, method) do |*args|
         obj = self.send(objmethod)
 
         obj.send(method, *args)
       end
     end
   end
 
   # Proxy a bunch of methods to another object.
   def self.proxy(klass, objmethod, *methods)
     methods.each do |method|
       klass.send(:define_method, method) do |*args|
         obj = self.send(objmethod)
 
         obj.send(method, *args)
       end
     end
   end
 
   # Execute a given chunk of code with a new umask.
   def self.withumask(mask)
     cur = File.umask(mask)
 
     begin
       yield
     ensure
       File.umask(cur)
     end
   end
 
   def benchmark(*args)
     msg = args.pop
     level = args.pop
     object = nil
 
     if args.empty?
       if respond_to?(level)
         object = self
       else
         object = Puppet
       end
     else
       object = args.pop
     end
 
     raise Puppet::DevError, "Failed to provide level to :benchmark" unless level
 
     unless level == :none or object.respond_to? level
       raise Puppet::DevError, "Benchmarked object does not respond to #{level}"
     end
 
     # Only benchmark if our log level is high enough
     if level != :none and Puppet::Util::Log.sendlevel?(level)
       result = nil
       seconds = Benchmark.realtime {
         yield
       }
       object.send(level, msg + (" in %0.2f seconds" % seconds))
       return seconds
     else
       yield
     end
   end
 
   def which(bin)
     if absolute_path?(bin)
       return bin if FileTest.file? bin and FileTest.executable? bin
     else
       ENV['PATH'].split(File::PATH_SEPARATOR).each do |dir|
         dest = File.expand_path(File.join(dir, bin))
         if Puppet.features.microsoft_windows? && File.extname(dest).empty?
           exts = ENV['PATHEXT']
           exts = exts ? exts.split(File::PATH_SEPARATOR) : %w[.COM .EXE .BAT .CMD]
           exts.each do |ext|
             destext = File.expand_path(dest + ext)
             return destext if FileTest.file? destext and FileTest.executable? destext
           end
         end
         return dest if FileTest.file? dest and FileTest.executable? dest
       end
     end
     nil
   end
   module_function :which
 
   # Determine in a platform-specific way whether a path is absolute. This
   # defaults to the local platform if none is specified.
   def absolute_path?(path, platform=nil)
     # Escape once for the string literal, and once for the regex.
     slash = '[\\\\/]'
     name = '[^\\\\/]+'
     regexes = {
       :windows => %r!^(([A-Z]:#{slash})|(#{slash}#{slash}#{name}#{slash}#{name})|(#{slash}#{slash}\?#{slash}#{name}))!i,
       :posix   => %r!^/!,
     }
     require 'puppet'
     platform ||= Puppet.features.microsoft_windows? ? :windows : :posix
 
     !! (path =~ regexes[platform])
   end
   module_function :absolute_path?
 
   # Convert a path to a file URI
   def path_to_uri(path)
     return unless path
 
     params = { :scheme => 'file' }
 
     if Puppet.features.microsoft_windows?
       path = path.gsub(/\\/, '/')
 
       if unc = /^\/\/([^\/]+)(\/[^\/]+)/.match(path)
         params[:host] = unc[1]
         path = unc[2]
       elsif path =~ /^[a-z]:\//i
         path = '/' + path
       end
     end
 
     params[:path] = URI.escape(path)
 
     begin
       URI::Generic.build(params)
     rescue => detail
       raise Puppet::Error, "Failed to convert '#{path}' to URI: #{detail}"
     end
   end
   module_function :path_to_uri
 
   # Get the path component of a URI
   def uri_to_path(uri)
     return unless uri.is_a?(URI)
 
     path = URI.unescape(uri.path)
 
     if Puppet.features.microsoft_windows? and uri.scheme == 'file'
       if uri.host
         path = "//#{uri.host}" + path # UNC
       else
         path.sub!(/^\//, '')
       end
     end
 
     path
   end
   module_function :uri_to_path
 
   # Execute the provided command with STDIN connected to a pipe, yielding the
   # pipe object.  That allows data to be fed to that subprocess.
   #
   # The command can be a simple string, which is executed as-is, or an Array,
   # which is treated as a set of command arguments to pass through.#
   #
   # In all cases this is passed directly to the shell, and STDOUT and STDERR
   # are connected together during execution.
   def execpipe(command, failonfail = true)
     if respond_to? :debug
       debug "Executing '#{command}'"
     else
       Puppet.debug "Executing '#{command}'"
     end
 
     # Paste together an array with spaces.  We used to paste directly
     # together, no spaces, which made for odd invocations; the user had to
     # include whitespace between arguments.
     #
     # Having two spaces is really not a big drama, since this passes to the
     # shell anyhow, while no spaces makes for a small developer cost every
     # time this is invoked. --daniel 2012-02-13
     command_str = command.respond_to?(:join) ? command.join(' ') : command
     output = open("| #{command_str} 2>&1") do |pipe|
       yield pipe
     end
 
     if failonfail
       unless $CHILD_STATUS == 0
         raise ExecutionFailure, output
       end
     end
 
     output
   end
 
   def execfail(command, exception)
       output = execute(command)
       return output
   rescue ExecutionFailure
       raise exception, output
   end
 
   def execute_posix(command, arguments, stdin, stdout, stderr)
-    child_pid = Kernel.fork do
+    child_pid = safe_posix_fork(stdin, stdout, stderr) do
       # We can't just call Array(command), and rely on it returning
       # things like ['foo'], when passed ['foo'], because
       # Array(command) will call command.to_a internally, which when
       # given a string can end up doing Very Bad Things(TM), such as
       # turning "/tmp/foo;\r\n /bin/echo" into ["/tmp/foo;\r\n", " /bin/echo"]
       command = [command].flatten
       Process.setsid
       begin
-        $stdin.reopen(stdin)
-        $stdout.reopen(stdout)
-        $stderr.reopen(stderr)
-
-        3.upto(256){|fd| IO::new(fd).close rescue nil}
-
         Puppet::Util::SUIDManager.change_privileges(arguments[:uid], arguments[:gid], true)
 
         ENV['LANG'] = ENV['LC_ALL'] = ENV['LC_MESSAGES'] = ENV['LANGUAGE'] = 'C'
         Kernel.exec(*command)
       rescue => detail
         puts detail.to_s
         exit!(1)
       end
     end
     child_pid
   end
   module_function :execute_posix
 
+  def safe_posix_fork(stdin=$stdin, stdout=$stdout, stderr=$stderr, &block)
+    child_pid = Kernel.fork do
+      $stdin.reopen(stdin)
+      $stdout.reopen(stdout)
+      $stderr.reopen(stderr)
+
+      3.upto(256){|fd| IO::new(fd).close rescue nil}
+
+      block.call if block
+    end
+    child_pid
+  end
+  module_function :safe_posix_fork
+
   def execute_windows(command, arguments, stdin, stdout, stderr)
     command = command.map do |part|
       part.include?(' ') ? %Q["#{part.gsub(/"/, '\"')}"] : part
     end.join(" ") if command.is_a?(Array)
 
     Puppet::Util::Windows::Process.execute(command, arguments, stdin, stdout, stderr)
   end
   module_function :execute_windows
 
   # Execute the desired command, and return the status and output.
   # def execute(command, failonfail = true, uid = nil, gid = nil)
   # :combine sets whether or not to combine stdout/stderr in the output
   # :stdinfile sets a file that can be used for stdin. Passing a string
   # for stdin is not currently supported.
   def execute(command, arguments = {:failonfail => true, :combine => true})
     if command.is_a?(Array)
       command = command.flatten.map(&:to_s)
       str = command.join(" ")
     elsif command.is_a?(String)
       str = command
     end
 
     if respond_to? :debug
       debug "Executing '#{str}'"
     else
       Puppet.debug "Executing '#{str}'"
     end
 
     null_file = Puppet.features.microsoft_windows? ? 'NUL' : '/dev/null'
 
     stdin = File.open(arguments[:stdinfile] || null_file, 'r')
     stdout = arguments[:squelch] ? File.open(null_file, 'w') : Tempfile.new('puppet')
     stderr = arguments[:combine] ? stdout : File.open(null_file, 'w')
 
     exec_args = [command, arguments, stdin, stdout, stderr]
 
     if execution_stub = Puppet::Util::ExecutionStub.current_value
       return execution_stub.call(*exec_args)
     elsif Puppet.features.posix?
       child_pid = execute_posix(*exec_args)
       exit_status = Process.waitpid2(child_pid).last.exitstatus
     elsif Puppet.features.microsoft_windows?
       process_info = execute_windows(*exec_args)
       begin
         exit_status = Puppet::Util::Windows::Process.wait_process(process_info.process_handle)
       ensure
         Process.CloseHandle(process_info.process_handle)
         Process.CloseHandle(process_info.thread_handle)
       end
     end
 
     [stdin, stdout, stderr].each {|io| io.close rescue nil}
 
     # read output in if required
     unless arguments[:squelch]
       output = wait_for_output(stdout)
       Puppet.warning "Could not get output" unless output
     end
 
     if arguments[:failonfail] and exit_status != 0
       raise ExecutionFailure, "Execution of '#{str}' returned #{exit_status}: #{output}"
     end
 
     output
   end
 
   module_function :execute
 
   def wait_for_output(stdout)
     # Make sure the file's actually been written.  This is basically a race
     # condition, and is probably a horrible way to handle it, but, well, oh
     # well.
     2.times do |try|
       if File.exists?(stdout.path)
         output = stdout.open.read
 
         stdout.close(true)
 
         return output
       else
         time_to_sleep = try / 2.0
         Puppet.warning "Waiting for output; will sleep #{time_to_sleep} seconds"
         sleep(time_to_sleep)
       end
     end
     nil
   end
   module_function :wait_for_output
 
   # Create an exclusive lock.
   def threadlock(resource, type = Sync::EX)
     Puppet::Util.synchronize_on(resource,type) { yield }
   end
 
   # Because some modules provide their own version of this method.
   alias util_execute execute
 
   module_function :benchmark
 
   def memory
     unless defined?(@pmap)
       @pmap = which('pmap')
     end
     if @pmap
       %x{#{@pmap} #{Process.pid}| grep total}.chomp.sub(/^\s*total\s+/, '').sub(/K$/, '').to_i
     else
       0
     end
   end
 
   def symbolize(value)
     if value.respond_to? :intern
       value.intern
     else
       value
     end
   end
 
   def symbolizehash(hash)
     newhash = {}
     hash.each do |name, val|
       if name.is_a? String
         newhash[name.intern] = val
       else
         newhash[name] = val
       end
     end
     newhash
   end
 
   def symbolizehash!(hash)
     # this is not the most memory-friendly way to accomplish this, but the
     #  code re-use and clarity seems worthwhile.
     newhash = symbolizehash(hash)
     hash.clear
     hash.merge!(newhash)
 
     hash
   end
   module_function :symbolize, :symbolizehash, :symbolizehash!
 
   # Just benchmark, with no logging.
   def thinmark
     seconds = Benchmark.realtime {
       yield
     }
 
     seconds
   end
 
   module_function :memory, :thinmark
 
   # Because IO#binread is only available in 1.9
   def binread(file)
     File.open(file, 'rb') { |f| f.read }
   end
   module_function :binread
 
   # Replace a file, securely.  This takes a block, and passes it the file
   # handle of a file open for writing.  Write the replacement content inside
   # the block and it will safely replace the target file.
   #
   # This method will make no changes to the target file until the content is
   # successfully written and the block returns without raising an error.
   #
   # As far as possible the state of the existing file, such as mode, is
   # preserved.  This works hard to avoid loss of any metadata, but will result
   # in an inode change for the file.
   #
   # Arguments: `filename`, `default_mode`
   #
   # The filename is the file we are going to replace.
   #
   # The default_mode is the mode to use when the target file doesn't already
   # exist; if the file is present we copy the existing mode/owner/group values
   # across.
   def replace_file(file, default_mode, &block)
     raise Puppet::DevError, "replace_file requires a block" unless block_given?
     raise Puppet::DevError, "replace_file is non-functional on Windows" if Puppet.features.microsoft_windows?
 
     file     = Pathname(file)
     tempfile = Tempfile.new(file.basename.to_s, file.dirname.to_s)
 
     file_exists = file.exist?
 
     # If the file exists, use its current mode/owner/group. If it doesn't, use
     # the supplied mode, and default to current user/group.
     if file_exists
       stat = file.lstat
 
       # We only care about the four lowest-order octets. Higher octets are
       # filesystem-specific.
       mode = stat.mode & 07777
       uid = stat.uid
       gid = stat.gid
     else
       mode = default_mode
       uid = Process.euid
       gid = Process.egid
     end
 
     # Set properties of the temporary file before we write the content, because
     # Tempfile doesn't promise to be safe from reading by other people, just
     # that it avoids races around creating the file.
     tempfile.chmod(mode)
     tempfile.chown(uid, gid)
 
     # OK, now allow the caller to write the content of the file.
     yield tempfile
 
     # Now, make sure the data (which includes the mode) is safe on disk.
     tempfile.flush
     begin
       tempfile.fsync
     rescue NotImplementedError
       # fsync may not be implemented by Ruby on all platforms, but
       # there is absolutely no recovery path if we detect that.  So, we just
       # ignore the return code.
       #
       # However, don't be fooled: that is accepting that we are running in
       # an unsafe fashion.  If you are porting to a new platform don't stub
       # that out.
     end
 
     tempfile.close
 
     File.rename(tempfile.path, file)
 
     # Ideally, we would now fsync the directory as well, but Ruby doesn't
     # have support for that, and it doesn't matter /that/ much...
 
     # Return something true, and possibly useful.
     file
   end
   module_function :replace_file
 end
 end
 
 require 'puppet/util/errors'
 require 'puppet/util/methodhelper'
 require 'puppet/util/metaid'
 require 'puppet/util/classgen'
 require 'puppet/util/docs'
 require 'puppet/util/execution'
 require 'puppet/util/logging'
 require 'puppet/util/package'
 require 'puppet/util/warnings'
diff --git a/spec/unit/application/kick_spec.rb b/spec/unit/application/kick_spec.rb
index 361aafb86..b7c68ac95 100755
--- a/spec/unit/application/kick_spec.rb
+++ b/spec/unit/application/kick_spec.rb
@@ -1,294 +1,294 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/application/kick'
 
 describe Puppet::Application::Kick, :if => Puppet.features.posix? do
 
   before :each do
     require 'puppet/util/ldap/connection'
     Puppet::Util::Ldap::Connection.stubs(:new).returns(stub_everything)
     @kick = Puppet::Application[:kick]
     Puppet::Util::Log.stubs(:newdestination)
   end
 
   describe ".new" do
     it "should take a command-line object as an argument" do
       command_line = stub_everything "command_line"
       lambda{ Puppet::Application::Kick.new( command_line ) }.should_not raise_error
     end
   end
 
   it "should ask Puppet::Application to not parse Puppet configuration file" do
     @kick.should_parse_config?.should be_false
   end
 
   it "should declare a main command" do
     @kick.should respond_to(:main)
   end
 
   it "should declare a test command" do
     @kick.should respond_to(:test)
   end
 
   it "should declare a preinit block" do
     @kick.should respond_to(:preinit)
   end
 
   describe "during preinit" do
     before :each do
       @kick.stubs(:trap)
     end
 
     it "should catch INT and TERM" do
       @kick.stubs(:trap).with { |arg,block| arg == :INT or arg == :TERM }
 
       @kick.preinit
     end
 
     it "should set parallel option to 1" do
       @kick.preinit
 
       @kick.options[:parallel].should == 1
     end
 
     it "should set verbose by default" do
       @kick.preinit
 
       @kick.options[:verbose].should be_true
     end
 
     it "should set fqdn by default" do
       @kick.preinit
 
       @kick.options[:fqdn].should be_true
     end
 
     it "should set ignoreschedules to 'false'" do
       @kick.preinit
 
       @kick.options[:ignoreschedules].should be_false
     end
 
     it "should set foreground to 'false'" do
       @kick.preinit
 
       @kick.options[:foreground].should be_false
     end
   end
 
   describe "when applying options" do
 
     before do
       @kick.preinit
     end
 
     [:all, :foreground, :debug, :ping, :test].each do |option|
       it "should declare handle_#{option} method" do
         @kick.should respond_to("handle_#{option}".to_sym)
       end
 
       it "should store argument value when calling handle_#{option}" do
         @kick.options.expects(:[]=).with(option, 'arg')
         @kick.send("handle_#{option}".to_sym, 'arg')
       end
     end
 
     it "should add to the host list with the host option" do
       @kick.handle_host('host')
 
       @kick.hosts.should == ['host']
     end
 
     it "should add to the tag list with the tag option" do
       @kick.handle_tag('tag')
 
       @kick.tags.should == ['tag']
     end
 
     it "should add to the class list with the class option" do
       @kick.handle_class('class')
 
       @kick.classes.should == ['class']
     end
   end
 
   describe "during setup" do
 
     before :each do
       @kick.classes = []
       @kick.tags = []
       @kick.hosts = []
       @kick.stubs(:trap)
       @kick.stubs(:puts)
       Puppet.stubs(:parse_config)
 
       @kick.options.stubs(:[]).with(any_parameters)
     end
 
     it "should abort stating that kick is not supported on Windows" do
       Puppet.features.stubs(:microsoft_windows?).returns(true)
 
       expect { @kick.setup }.to raise_error(Puppet::Error, /Puppet kick is not supported on Microsoft Windows/)
     end
 
     it "should set log level to debug if --debug was passed" do
       @kick.options.stubs(:[]).with(:debug).returns(true)
       @kick.setup
       Puppet::Log.level.should == :debug
     end
 
     it "should set log level to info if --verbose was passed" do
       @kick.options.stubs(:[]).with(:verbose).returns(true)
       @kick.setup
       Puppet::Log.level.should == :info
     end
 
     it "should Parse puppet config" do
       Puppet.expects(:parse_config)
 
       @kick.setup
     end
 
     describe "when using the ldap node terminus" do
       before :each do
         Puppet.stubs(:[]).with(:node_terminus).returns("ldap")
       end
 
       it "should pass the fqdn option to search" do
         @kick.options.stubs(:[]).with(:fqdn).returns(:something)
         @kick.options.stubs(:[]).with(:all).returns(true)
         @kick.stubs(:puts)
 
         Puppet::Node.indirection.expects(:search).with("whatever",:fqdn => :something).returns([])
 
         @kick.setup
       end
 
       it "should search for all nodes if --all" do
         @kick.options.stubs(:[]).with(:all).returns(true)
         @kick.stubs(:puts)
 
         Puppet::Node.indirection.expects(:search).with("whatever",:fqdn => nil).returns([])
 
         @kick.setup
       end
 
       it "should search for nodes including given classes" do
         @kick.options.stubs(:[]).with(:all).returns(false)
         @kick.stubs(:puts)
         @kick.classes = ['class']
 
         Puppet::Node.indirection.expects(:search).with("whatever", :class => "class", :fqdn => nil).returns([])
 
         @kick.setup
       end
     end
 
     describe "when using regular nodes" do
       it "should fail if some classes have been specified" do
         $stderr.stubs(:puts)
         @kick.classes = ['class']
 
         expect { @kick.setup }.to exit_with 24
       end
     end
   end
 
   describe "when running" do
     before :each do
       @kick.stubs(:puts)
     end
 
     it "should dispatch to test if --test is used" do
       @kick.options.stubs(:[]).with(:test).returns(true)
 
       @kick.expects(:test)
       @kick.run_command
     end
 
     it "should dispatch to main if --test is not used" do
       @kick.options.stubs(:[]).with(:test).returns(false)
 
       @kick.expects(:main)
       @kick.run_command
     end
 
     describe "the test command" do
       it "should exit with exit code 0 " do
         expect { @kick.test }.to exit_with 0
       end
     end
 
     describe "the main command" do
       before :each do
         @kick.options.stubs(:[]).with(:parallel).returns(1)
         @kick.options.stubs(:[]).with(:ping).returns(false)
         @kick.options.stubs(:[]).with(:ignoreschedules).returns(false)
         @kick.options.stubs(:[]).with(:foreground).returns(false)
         @kick.options.stubs(:[]).with(:debug).returns(false)
         @kick.stubs(:print)
         @kick.preinit
         @kick.stubs(:parse_options)
         @kick.setup
         $stderr.stubs(:puts)
       end
 
       it "should create as much childs as --parallel" do
         @kick.options.stubs(:[]).with(:parallel).returns(3)
         @kick.hosts = ['host1', 'host2', 'host3']
         Process.stubs(:wait).returns(1).then.returns(2).then.returns(3).then.raises(Errno::ECHILD)
 
-        @kick.expects(:fork).times(3).returns(1).then.returns(2).then.returns(3)
+        @kick.expects(:safe_posix_fork).times(3).returns(1).then.returns(2).then.returns(3)
 
         expect { @kick.main }.to raise_error SystemExit
       end
 
       it "should delegate to run_for_host per host" do
         @kick.hosts = ['host1', 'host2']
-        @kick.stubs(:fork).returns(1).yields
+        @kick.stubs(:safe_posix_fork).returns(1).yields
         Process.stubs(:wait).returns(1).then.raises(Errno::ECHILD)
 
         @kick.expects(:run_for_host).times(2)
 
         lambda { @kick.main }.should raise_error
       end
 
       describe "during call of run_for_host" do
         before do
           require 'puppet/run'
           options = {
             :background => true, :ignoreschedules => false, :tags => []
           }
           @kick.preinit
           @agent_run = Puppet::Run.new( options.dup )
           @agent_run.stubs(:status).returns("success")
 
           Puppet::Run.indirection.expects(:terminus_class=).with( :rest )
           Puppet::Run.expects(:new).with( options ).returns(@agent_run)
         end
 
         it "should call run on a Puppet::Run for the given host" do
           Puppet::Run.indirection.expects(:save).with(@agent_run, 'https://host:8139/production/run/host').returns(@agent_run)
 
           expect { @kick.run_for_host('host') }.to exit_with 0
         end
 
         it "should exit the child with 0 on success" do
           @agent_run.stubs(:status).returns("success")
           expect { @kick.run_for_host('host') }.to exit_with 0
         end
 
         it "should exit the child with 3 on running" do
           @agent_run.stubs(:status).returns("running")
           expect { @kick.run_for_host('host') }.to exit_with 3
         end
 
         it "should exit the child with 12 on unknown answer" do
           @agent_run.stubs(:status).returns("whatever")
           expect { @kick.run_for_host('host') }.to exit_with 12
         end
       end
     end
   end
 end
diff --git a/spec/unit/util_spec.rb b/spec/unit/util_spec.rb
index 3ce8276f8..ef143b28f 100755
--- a/spec/unit/util_spec.rb
+++ b/spec/unit/util_spec.rb
@@ -1,767 +1,790 @@
 #!/usr/bin/env ruby
 
 require 'spec_helper'
 
 describe Puppet::Util do
   include PuppetSpec::Files
 
   if Puppet.features.microsoft_windows?
     def set_mode(mode, file)
       Puppet::Util::Windows::Security.set_mode(mode, file)
     end
 
     def get_mode(file)
       Puppet::Util::Windows::Security.get_mode(file) & 07777
     end
   else
     def set_mode(mode, file)
       File.chmod(mode, file)
     end
 
     def get_mode(file)
       File.lstat(file).mode & 07777
     end
   end
 
   def process_status(exitstatus)
     return exitstatus if Puppet.features.microsoft_windows?
 
     stub('child_status', :exitstatus => exitstatus)
   end
 
   describe "#absolute_path?" do
     it "should default to the platform of the local system" do
       Puppet.features.stubs(:posix?).returns(true)
       Puppet.features.stubs(:microsoft_windows?).returns(false)
 
       Puppet::Util.should be_absolute_path('/foo')
       Puppet::Util.should_not be_absolute_path('C:/foo')
 
       Puppet.features.stubs(:posix?).returns(false)
       Puppet.features.stubs(:microsoft_windows?).returns(true)
 
       Puppet::Util.should be_absolute_path('C:/foo')
       Puppet::Util.should_not be_absolute_path('/foo')
     end
 
     describe "when using platform :posix" do
       %w[/ /foo /foo/../bar //foo //Server/Foo/Bar //?/C:/foo/bar /\Server/Foo /foo//bar/baz].each do |path|
         it "should return true for #{path}" do
           Puppet::Util.should be_absolute_path(path, :posix)
         end
       end
 
       %w[. ./foo \foo C:/foo \\Server\Foo\Bar \\?\C:\foo\bar \/?/foo\bar \/Server/foo foo//bar/baz].each do |path|
         it "should return false for #{path}" do
           Puppet::Util.should_not be_absolute_path(path, :posix)
         end
       end
     end
 
     describe "when using platform :windows" do
       %w[C:/foo C:\foo \\\\Server\Foo\Bar \\\\?\C:\foo\bar //Server/Foo/Bar //?/C:/foo/bar /\?\C:/foo\bar \/Server\Foo/Bar c:/foo//bar//baz].each do |path|
         it "should return true for #{path}" do
           Puppet::Util.should be_absolute_path(path, :windows)
         end
       end
 
       %w[/ . ./foo \foo /foo /foo/../bar //foo C:foo/bar foo//bar/baz].each do |path|
         it "should return false for #{path}" do
           Puppet::Util.should_not be_absolute_path(path, :windows)
         end
       end
     end
   end
 
   describe "#path_to_uri" do
     %w[. .. foo foo/bar foo/../bar].each do |path|
       it "should reject relative path: #{path}" do
         lambda { Puppet::Util.path_to_uri(path) }.should raise_error(Puppet::Error)
       end
     end
 
     it "should perform URI escaping" do
       Puppet::Util.path_to_uri("/foo bar").path.should == "/foo%20bar"
     end
 
     describe "when using platform :posix" do
       before :each do
         Puppet.features.stubs(:posix).returns true
         Puppet.features.stubs(:microsoft_windows?).returns false
       end
 
       %w[/ /foo /foo/../bar].each do |path|
         it "should convert #{path} to URI" do
           Puppet::Util.path_to_uri(path).path.should == path
         end
       end
     end
 
     describe "when using platform :windows" do
       before :each do
         Puppet.features.stubs(:posix).returns false
         Puppet.features.stubs(:microsoft_windows?).returns true
       end
 
       it "should normalize backslashes" do
         Puppet::Util.path_to_uri('c:\\foo\\bar\\baz').path.should == '/' + 'c:/foo/bar/baz'
       end
 
       %w[C:/ C:/foo/bar].each do |path|
         it "should convert #{path} to absolute URI" do
           Puppet::Util.path_to_uri(path).path.should == '/' + path
         end
       end
 
       %w[share C$].each do |path|
         it "should convert UNC #{path} to absolute URI" do
           uri = Puppet::Util.path_to_uri("\\\\server\\#{path}")
           uri.host.should == 'server'
           uri.path.should == '/' + path
         end
       end
     end
   end
 
   describe ".uri_to_path" do
     require 'uri'
 
     it "should strip host component" do
       Puppet::Util.uri_to_path(URI.parse('http://foo/bar')).should == '/bar'
     end
 
     it "should accept puppet URLs" do
       Puppet::Util.uri_to_path(URI.parse('puppet:///modules/foo')).should == '/modules/foo'
     end
 
     it "should return unencoded path" do
       Puppet::Util.uri_to_path(URI.parse('http://foo/bar%20baz')).should == '/bar baz'
     end
 
     it "should be nil-safe" do
       Puppet::Util.uri_to_path(nil).should be_nil
     end
 
     describe "when using platform :posix",:if => Puppet.features.posix? do
       it "should accept root" do
         Puppet::Util.uri_to_path(URI.parse('file:/')).should == '/'
       end
 
       it "should accept single slash" do
         Puppet::Util.uri_to_path(URI.parse('file:/foo/bar')).should == '/foo/bar'
       end
 
       it "should accept triple slashes" do
         Puppet::Util.uri_to_path(URI.parse('file:///foo/bar')).should == '/foo/bar'
       end
     end
 
     describe "when using platform :windows", :if => Puppet.features.microsoft_windows? do
       it "should accept root" do
         Puppet::Util.uri_to_path(URI.parse('file:/C:/')).should == 'C:/'
       end
 
       it "should accept single slash" do
         Puppet::Util.uri_to_path(URI.parse('file:/C:/foo/bar')).should == 'C:/foo/bar'
       end
 
       it "should accept triple slashes" do
         Puppet::Util.uri_to_path(URI.parse('file:///C:/foo/bar')).should == 'C:/foo/bar'
       end
 
       it "should accept file scheme with double slashes as a UNC path" do
         Puppet::Util.uri_to_path(URI.parse('file://host/share/file')).should == '//host/share/file'
       end
     end
   end
 
   describe "execution methods" do
     let(:pid) { 5501 }
     let(:process_handle) { 0xDEADBEEF }
     let(:thread_handle) { 0xCAFEBEEF }
     let(:proc_info_stub) { stub 'processinfo', :process_handle => process_handle, :thread_handle => thread_handle, :process_id => pid}
     let(:null_file) { Puppet.features.microsoft_windows? ? 'NUL' : '/dev/null' }
 
     def stub_process_wait(exitstatus)
       if Puppet.features.microsoft_windows?
         Puppet::Util::Windows::Process.stubs(:wait_process).with(process_handle).returns(exitstatus)
         Process.stubs(:CloseHandle).with(process_handle)
         Process.stubs(:CloseHandle).with(thread_handle)
       else
         Process.stubs(:waitpid2).with(pid).returns([pid, stub('child_status', :exitstatus => exitstatus)])
       end
     end
 
     describe "#execute_posix" do
       before :each do
         # Most of the things this method does are bad to do during specs. :/
         Kernel.stubs(:fork).returns(pid).yields
         Process.stubs(:setsid)
         Kernel.stubs(:exec)
         Puppet::Util::SUIDManager.stubs(:change_user)
         Puppet::Util::SUIDManager.stubs(:change_group)
 
         $stdin.stubs(:reopen)
         $stdout.stubs(:reopen)
         $stderr.stubs(:reopen)
 
         @stdin  = File.open(null_file, 'r')
         @stdout = Tempfile.new('stdout')
         @stderr = File.open(null_file, 'w')
       end
 
       it "should fork a child process to execute the command" do
         Kernel.expects(:fork).returns(pid).yields
         Kernel.expects(:exec).with('test command')
 
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should start a new session group" do
         Process.expects(:setsid)
 
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
-      it "should close all open file descriptors except stdin/stdout/stderr" do
-        # This is ugly, but I can't really think of a better way to do it without
-        # letting it actually close fds, which seems risky
-        (0..2).each {|n| IO.expects(:new).with(n).never}
-        (3..256).each {|n| IO.expects(:new).with(n).returns mock('io', :close) }
-
-        Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr)
-      end
-
       it "should permanently change to the correct user and group if specified" do
         Puppet::Util::SUIDManager.expects(:change_group).with(55, true)
         Puppet::Util::SUIDManager.expects(:change_user).with(50, true)
 
         Puppet::Util.execute_posix('test command', {:uid => 50, :gid => 55}, @stdin, @stdout, @stderr)
       end
 
       it "should exit failure if there is a problem execing the command" do
         Kernel.expects(:exec).with('test command').raises("failed to execute!")
         Puppet::Util.stubs(:puts)
         Puppet::Util.expects(:exit!).with(1)
 
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should properly execute commands specified as arrays" do
         Kernel.expects(:exec).with('test command', 'with', 'arguments')
 
         Puppet::Util.execute_posix(['test command', 'with', 'arguments'], {:uid => 50, :gid => 55}, @stdin, @stdout, @stderr)
       end
 
       it "should properly execute string commands with embedded newlines" do
         Kernel.expects(:exec).with("/bin/echo 'foo' ; \n /bin/echo 'bar' ;")
 
         Puppet::Util.execute_posix("/bin/echo 'foo' ; \n /bin/echo 'bar' ;", {:uid => 50, :gid => 55}, @stdin, @stdout, @stderr)
       end
 
       it "should return the pid of the child process" do
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr).should == pid
       end
     end
 
     describe "#execute_windows", :if => Puppet.features.microsoft_windows? do
       before :each do
         Process.stubs(:create).returns(proc_info_stub)
         stub_process_wait(0)
 
         @stdin  = File.open(null_file, 'r')
         @stdout = Tempfile.new('stdout')
         @stderr = File.open(null_file, 'w')
       end
 
       it "should create a new process for the command" do
         Process.expects(:create).with(
           :command_line => "test command",
           :startup_info => {:stdin => @stdin, :stdout => @stdout, :stderr => @stderr},
           :close_handles => false
         ).returns(proc_info_stub)
 
         Puppet::Util.execute_windows('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should return the process info of the child process" do
         Puppet::Util.execute_windows('test command', {}, @stdin, @stdout, @stderr).should == proc_info_stub
       end
 
       it "should quote arguments containing spaces if command is specified as an array" do
         Process.expects(:create).with do |args|
           args[:command_line] == '"test command" with some "arguments \"with spaces"'
         end.returns(proc_info_stub)
 
         Puppet::Util.execute_windows(['test command', 'with', 'some', 'arguments "with spaces'], {}, @stdin, @stdout, @stderr)
       end
     end
 
     describe "#execute" do
       before :each do
         stub_process_wait(0)
       end
 
       describe "when an execution stub is specified" do
         before :each do
           Puppet::Util::ExecutionStub.set do |command,args,stdin,stdout,stderr|
             "execution stub output"
           end
         end
 
         it "should call the block on the stub" do
           Puppet::Util.execute("/usr/bin/run_my_execute_stub").should == "execution stub output"
         end
 
         it "should not actually execute anything" do
           Puppet::Util.expects(:execute_posix).never
           Puppet::Util.expects(:execute_windows).never
 
           Puppet::Util.execute("/usr/bin/run_my_execute_stub")
         end
       end
 
       describe "when setting up input and output files" do
         include PuppetSpec::Files
         let(:executor) { Puppet.features.microsoft_windows? ? 'execute_windows' : 'execute_posix' }
         let(:rval) { Puppet.features.microsoft_windows? ? proc_info_stub : pid }
 
         before :each do
           Puppet::Util.stubs(:wait_for_output)
         end
 
         it "should set stdin to the stdinfile if specified" do
           input = tmpfile('stdin')
           FileUtils.touch(input)
 
           Puppet::Util.expects(executor).with do |_,_,stdin,_,_|
             stdin.path == input
           end.returns(rval)
 
           Puppet::Util.execute('test command', :stdinfile => input)
         end
 
         it "should set stdin to the null file if not specified" do
           Puppet::Util.expects(executor).with do |_,_,stdin,_,_|
             stdin.path == null_file
           end.returns(rval)
 
           Puppet::Util.execute('test command')
         end
 
         describe "when squelch is set" do
           it "should set stdout and stderr to the null file" do
             Puppet::Util.expects(executor).with do |_,_,_,stdout,stderr|
               stdout.path == null_file and stderr.path == null_file
             end.returns(rval)
 
             Puppet::Util.execute('test command', :squelch => true)
           end
         end
 
         describe "when squelch is not set" do
           it "should set stdout to a temporary output file" do
             outfile = Tempfile.new('stdout')
             Tempfile.stubs(:new).returns(outfile)
 
             Puppet::Util.expects(executor).with do |_,_,_,stdout,_|
               stdout.path == outfile.path
             end.returns(rval)
 
             Puppet::Util.execute('test command', :squelch => false)
           end
 
           it "should set stderr to the same file as stdout if combine is true" do
             outfile = Tempfile.new('stdout')
             Tempfile.stubs(:new).returns(outfile)
 
             Puppet::Util.expects(executor).with do |_,_,_,stdout,stderr|
               stdout.path == outfile.path and stderr.path == outfile.path
             end.returns(rval)
 
             Puppet::Util.execute('test command', :squelch => false, :combine => true)
           end
 
           it "should set stderr to the null device if combine is false" do
             outfile = Tempfile.new('stdout')
             Tempfile.stubs(:new).returns(outfile)
 
             Puppet::Util.expects(executor).with do |_,_,_,stdout,stderr|
               stdout.path == outfile.path and stderr.path == null_file
             end.returns(rval)
 
             Puppet::Util.execute('test command', :squelch => false, :combine => false)
           end
         end
       end
 
       describe "on Windows", :if => Puppet.features.microsoft_windows? do
         it "should always close the process and thread handles" do
           Puppet::Util.stubs(:execute_windows).returns(proc_info_stub)
 
           Puppet::Util::Windows::Process.expects(:wait_process).with(process_handle).raises('whatever')
           Process.expects(:CloseHandle).with(thread_handle)
           Process.expects(:CloseHandle).with(process_handle)
 
           expect { Puppet::Util.execute('test command') }.should raise_error(RuntimeError)
         end
       end
     end
 
     describe "after execution" do
       before :each do
         stub_process_wait(0)
 
         if Puppet.features.microsoft_windows?
           Puppet::Util.stubs(:execute_windows).returns(proc_info_stub)
         else
           Puppet::Util.stubs(:execute_posix).returns(pid)
         end
       end
 
       it "should wait for the child process to exit" do
         Puppet::Util.stubs(:wait_for_output)
 
         Puppet::Util.execute('test command')
       end
 
       it "should close the stdin/stdout/stderr files used by the child" do
         stdin = mock 'file', :close
         stdout = mock 'file', :close
         stderr = mock 'file', :close
 
         File.expects(:open).
           times(3).
           returns(stdin).
           then.returns(stdout).
           then.returns(stderr)
 
         Puppet::Util.execute('test command', :squelch => true)
       end
 
       it "should read and return the output if squelch is false" do
         stdout = Tempfile.new('test')
         Tempfile.stubs(:new).returns(stdout)
         stdout.write("My expected command output")
 
         Puppet::Util.execute('test command').should == "My expected command output"
       end
 
       it "should not read the output if squelch is true" do
         stdout = Tempfile.new('test')
         Tempfile.stubs(:new).returns(stdout)
         stdout.write("My expected command output")
 
         Puppet::Util.execute('test command', :squelch => true).should == nil
       end
 
       it "should delete the file used for output if squelch is false" do
         stdout = Tempfile.new('test')
         path = stdout.path
         Tempfile.stubs(:new).returns(stdout)
 
         Puppet::Util.execute('test command')
 
         File.should_not be_exist(path)
       end
 
       it "should raise an error if failonfail is true and the child failed" do
         stub_process_wait(1)
 
         expect {
           Puppet::Util.execute('fail command', :failonfail => true)
         }.to raise_error(Puppet::ExecutionFailure, /Execution of 'fail command' returned 1/)
       end
 
       it "should not raise an error if failonfail is false and the child failed" do
         stub_process_wait(1)
 
         expect {
           Puppet::Util.execute('fail command', :failonfail => false)
         }.not_to raise_error
       end
 
       it "should not raise an error if failonfail is true and the child succeeded" do
         expect {
           Puppet::Util.execute('fail command', :failonfail => true)
         }.not_to raise_error
       end
     end
+
+    describe "safe_posix_fork" do
+      before :each do
+        # Most of the things this method does are bad to do during specs. :/
+        Kernel.stubs(:fork).returns(pid).yields
+
+        $stdin.stubs(:reopen)
+        $stdout.stubs(:reopen)
+        $stderr.stubs(:reopen)
+      end
+
+      it "should close all open file descriptors except stdin/stdout/stderr" do
+        # This is ugly, but I can't really think of a better way to do it without
+        # letting it actually close fds, which seems risky
+        (0..2).each {|n| IO.expects(:new).with(n).never}
+        (3..256).each {|n| IO.expects(:new).with(n).returns mock('io', :close) }
+
+        Puppet::Util.safe_posix_fork
+      end
+
+      it "should fork a child process to execute the block" do
+        Kernel.expects(:fork).returns(pid).yields
+
+        Puppet::Util.safe_posix_fork do
+          message = "Fork this!"
+        end
+      end
+
+      it "should return the pid of the child process" do
+        Puppet::Util.safe_posix_fork.should == pid
+      end
+    end
   end
 
   describe "#execpipe" do
     let :instance do
       instance = Class.new.new
       instance.send(:extend, Puppet::Util)
       instance
     end
 
     it "should execute a string as a string" do
       instance.expects(:open).with('| echo hello 2>&1').returns('hello')
       $CHILD_STATUS.expects(:==).with(0).returns(true)
       instance.execpipe('echo hello').should == 'hello'
     end
 
     it "should execute an array by pasting together with spaces" do
       instance.expects(:open).with('| echo hello 2>&1').returns('hello')
       $CHILD_STATUS.expects(:==).with(0).returns(true)
       instance.execpipe(['echo', 'hello']).should == 'hello'
     end
 
     it "should fail if asked to fail, and the child does" do
       instance.stubs(:open).returns('error message')
       $CHILD_STATUS.expects(:==).with(0).returns(false)
       expect { instance.execpipe('echo hello') }.
         to raise_error Puppet::ExecutionFailure, /error message/
     end
 
     it "should not fail if asked not to fail, and the child does" do
       instance.stubs(:open).returns('error message')
       $CHILD_STATUS.stubs(:==).with(0).returns(false)
       expect do
         instance.execpipe('echo hello', false).should == 'error message'
       end.not_to raise_error
     end
   end
 
   describe "#which" do
     let(:base) { File.expand_path('/bin') }
     let(:path) { File.join(base, 'foo') }
 
     before :each do
       FileTest.stubs(:file?).returns false
       FileTest.stubs(:file?).with(path).returns true
 
       FileTest.stubs(:executable?).returns false
       FileTest.stubs(:executable?).with(path).returns true
     end
 
     it "should accept absolute paths" do
       Puppet::Util.which(path).should == path
     end
 
     it "should return nil if no executable found" do
       Puppet::Util.which('doesnotexist').should be_nil
     end
 
     it "should reject directories" do
       Puppet::Util.which(base).should be_nil
     end
 
     describe "on POSIX systems" do
       before :each do
         Puppet.features.stubs(:posix?).returns true
         Puppet.features.stubs(:microsoft_windows?).returns false
       end
 
       it "should walk the search PATH returning the first executable" do
         ENV.stubs(:[]).with('PATH').returns(File.expand_path('/bin'))
 
         Puppet::Util.which('foo').should == path
       end
     end
 
     describe "on Windows systems" do
       let(:path) { File.expand_path(File.join(base, 'foo.CMD')) }
 
       before :each do
         Puppet.features.stubs(:posix?).returns false
         Puppet.features.stubs(:microsoft_windows?).returns true
       end
 
       describe "when a file extension is specified" do
         it "should walk each directory in PATH ignoring PATHEXT" do
           ENV.stubs(:[]).with('PATH').returns(%w[/bar /bin].map{|dir| File.expand_path(dir)}.join(File::PATH_SEPARATOR))
 
           FileTest.expects(:file?).with(File.join(File.expand_path('/bar'), 'foo.CMD')).returns false
 
           ENV.expects(:[]).with('PATHEXT').never
           Puppet::Util.which('foo.CMD').should == path
         end
       end
 
       describe "when a file extension is not specified" do
         it "should walk each extension in PATHEXT until an executable is found" do
           bar = File.expand_path('/bar')
           ENV.stubs(:[]).with('PATH').returns("#{bar}#{File::PATH_SEPARATOR}#{base}")
           ENV.stubs(:[]).with('PATHEXT').returns(".EXE#{File::PATH_SEPARATOR}.CMD")
 
           exts = sequence('extensions')
           FileTest.expects(:file?).in_sequence(exts).with(File.join(bar, 'foo.EXE')).returns false
           FileTest.expects(:file?).in_sequence(exts).with(File.join(bar, 'foo.CMD')).returns false
           FileTest.expects(:file?).in_sequence(exts).with(File.join(base, 'foo.EXE')).returns false
           FileTest.expects(:file?).in_sequence(exts).with(path).returns true
 
           Puppet::Util.which('foo').should == path
         end
 
         it "should walk the default extension path if the environment variable is not defined" do
           ENV.stubs(:[]).with('PATH').returns(base)
           ENV.stubs(:[]).with('PATHEXT').returns(nil)
 
           exts = sequence('extensions')
           %w[.COM .EXE .BAT].each do |ext|
             FileTest.expects(:file?).in_sequence(exts).with(File.join(base, "foo#{ext}")).returns false
           end
           FileTest.expects(:file?).in_sequence(exts).with(path).returns true
 
           Puppet::Util.which('foo').should == path
         end
 
         it "should fall back if no extension matches" do
           ENV.stubs(:[]).with('PATH').returns(base)
           ENV.stubs(:[]).with('PATHEXT').returns(".EXE")
 
           FileTest.stubs(:file?).with(File.join(base, 'foo.EXE')).returns false
           FileTest.stubs(:file?).with(File.join(base, 'foo')).returns true
           FileTest.stubs(:executable?).with(File.join(base, 'foo')).returns true
 
           Puppet::Util.which('foo').should == File.join(base, 'foo')
         end
       end
     end
   end
 
   describe "#binread" do
     let(:contents) { "foo\r\nbar" }
 
     it "should preserve line endings" do
       path = tmpfile('util_binread')
       File.open(path, 'wb') { |f| f.print contents }
 
       Puppet::Util.binread(path).should == contents
     end
 
     it "should raise an error if the file doesn't exist" do
       expect { Puppet::Util.binread('/path/does/not/exist') }.to raise_error(Errno::ENOENT)
     end
   end
 
   describe "hash symbolizing functions" do
     let (:myhash) { { "foo" => "bar", :baz => "bam" } }
     let (:resulthash) { { :foo => "bar", :baz => "bam" } }
 
     describe "#symbolizehash" do
       it "should return a symbolized hash" do
         newhash = Puppet::Util.symbolizehash(myhash)
         newhash.should == resulthash
       end
     end
 
     describe "#symbolizehash!" do
       it "should symbolize the hash in place" do
         localhash = myhash
         Puppet::Util.symbolizehash!(localhash)
         localhash.should == resulthash
       end
     end
   end
 
   context "#replace_file" do
     describe "on POSIX platforms", :if => Puppet.features.posix? do
       subject { Puppet::Util }
       it { should respond_to :replace_file }
 
       let :target do
         target = Tempfile.new("puppet-util-replace-file")
         target.puts("hello, world")
         target.flush              # make sure content is on disk.
         target.fsync rescue nil
         target.close
         target
       end
 
       it "should fail if no block is given" do
         expect { subject.replace_file(target.path, 0600) }.to raise_error /block/
       end
 
       it "should replace a file when invoked" do
         # Check that our file has the expected content.
         File.read(target.path).should == "hello, world\n"
 
         # Replace the file.
         subject.replace_file(target.path, 0600) do |fh|
           fh.puts "I am the passenger..."
         end
 
         # ...and check the replacement was complete.
         File.read(target.path).should == "I am the passenger...\n"
       end
 
       [0555, 0600, 0660, 0700, 0770].each do |mode|
         it "should copy 0#{mode.to_s(8)} permissions from the target file by default" do
           set_mode(mode, target.path)
 
           get_mode(target.path).should == mode
 
           subject.replace_file(target.path, 0000) {|fh| fh.puts "bazam" }
 
           get_mode(target.path).should == mode
           File.read(target.path).should == "bazam\n"
         end
       end
 
       it "should copy the permissions of the source file before yielding" do
         set_mode(0555, target.path)
         inode = File.stat(target.path).ino unless Puppet.features.microsoft_windows?
 
         yielded = false
         subject.replace_file(target.path, 0600) do |fh|
           get_mode(fh.path).should == 0555
           yielded = true
         end
         yielded.should be_true
 
         # We can't check inode on Windows
         File.stat(target.path).ino.should_not == inode unless Puppet.features.microsoft_windows?
 
         get_mode(target.path).should == 0555
       end
 
       it "should use the default permissions if the source file doesn't exist" do
         new_target = target.path + '.foo'
         File.should_not be_exist(new_target)
 
         begin
           subject.replace_file(new_target, 0555) {|fh| fh.puts "foo" }
           get_mode(new_target).should == 0555
         ensure
           File.unlink(new_target) if File.exists?(new_target)
         end
       end
 
       it "should not replace the file if an exception is thrown in the block" do
         yielded = false
         threw   = false
 
         begin
           subject.replace_file(target.path, 0600) do |fh|
             yielded = true
             fh.puts "different content written, then..."
             raise "...throw some random failure"
           end
         rescue Exception => e
           if e.to_s =~ /some random failure/
             threw = true
           else
             raise
           end
         end
 
         yielded.should be_true
         threw.should be_true
 
         # ...and check the replacement was complete.
         File.read(target.path).should == "hello, world\n"
       end
     end
 
     describe "on Windows platforms" do
       it "should fail and complain" do
         Puppet.features.stubs(:microsoft_windows?).returns true
 
         expect { Puppet::Util.replace_file("C:/foo", 0644) {} }.to raise_error(Puppet::DevError, "replace_file is non-functional on Windows")
       end
     end
   end
 end