This is to prevent leaking file descriptors. QubesOS/qubes-issues#2622
Tool to be called from template's rpm post-installation script.