diff --git a/libpromises/bootstrap.c b/libpromises/bootstrap.c
index 58e40fdccc..e79a92294a 100644
--- a/libpromises/bootstrap.c
+++ b/libpromises/bootstrap.c
@@ -215,12 +215,14 @@ bool WriteAmPolicyHubFile(bool am_policy_hub)
     {
         if (!GetAmPolicyHub())
         {
-            if (creat(filename, 0600) == -1)
+            int fd = creat(filename, 0600);
+            if (fd == -1)
             {
                 Log(LOG_LEVEL_ERR, "Error writing marker file '%s'", filename);
                 free(filename);
                 return false;
             }
+            close(fd);
         }
     }
     else
diff --git a/tests/acceptance/testall b/tests/acceptance/testall
index adc73a6c9d..be3274b91b 100755
--- a/tests/acceptance/testall
+++ b/tests/acceptance/testall
@@ -109,7 +109,7 @@ DIFF=${DIFF:-}                      ; export DIFF
 LIBTOOL=${LIBTOOL:-}                ; export LIBTOOL
 INCLUDE_IN_WORKDIR=${INCLUDE_IN_WORKDIR:-} ; export INCLUDE_IN_WORKDIR
 
-VALGRIND_OPTS="${VALGRIND_OPTS:---leak-check=full --show-reachable=yes --suppressions=valgrind-suppressions}"
+VALGRIND_OPTS="${VALGRIND_OPTS:---leak-check=full --show-reachable=yes --suppressions=valgrind-suppressions --track-fds=yes}"
 export VALGRIND_OPTS
 
 export MAKEFLAGS
diff --git a/tests/valgrind-check/valgrind.sh b/tests/valgrind-check/valgrind.sh
index 34716fec64..211e13f57e 100644
--- a/tests/valgrind-check/valgrind.sh
+++ b/tests/valgrind-check/valgrind.sh
@@ -86,7 +86,7 @@ make install
 
 /var/cfengine/bin/cf-agent --version
 
-VG_OPTS="--leak-check=full --track-origins=yes --error-exitcode=1"
+VG_OPTS="--leak-check=full --track-origins=yes --error-exitcode=1 --track-fds=yes"
 BOOTSTRAP_IP="127.0.0.1"
 
 valgrind $VG_OPTS /var/cfengine/bin/cf-key 2>&1 | tee cf-key.txt