firewalld keeps file descriptors open when forking