diff --git a/Lib/test/subprocessdata/fd_status.py b/Lib/test/subprocessdata/fd_status.py
new file mode 100644
index 0000000..7d5c0e8
--- /dev/null
+++ b/Lib/test/subprocessdata/fd_status.py
@@ -0,0 +1,32 @@
+"""When called as a script, print a comma-separated list of the open
+file descriptors on stdout.
+
+Usage:
+fd_stats.py: check all file descriptors
+fd_status.py fd1 fd2 ...: check only specified file descriptors
+"""
+
+import errno
+import os
+import stat
+import sys
+
+if __name__ == "__main__":
+    fds = []
+    if len(sys.argv) == 1:
+        try:
+            _MAXFD = os.sysconf("SC_OPEN_MAX")
+        except:
+            _MAXFD = 256
+        test_fds = range(0, _MAXFD)
+    else:
+        test_fds = map(int, sys.argv[1:])
+    for fd in test_fds:
+        try:
+            st = os.fstat(fd)
+        except OSError as e:
+            if e.errno == errno.EBADF:
+                continue
+            raise
+        fds.append(fd)
+    print(','.join(map(str, fds)))
diff --git a/Lib/test/test_os.py b/Lib/test/test_os.py
index e84f457..e60faae 100644
--- a/Lib/test/test_os.py
+++ b/Lib/test/test_os.py
@@ -10,6 +10,7 @@
 import signal
 import subprocess
 import sysconfig
+import textwrap
 import time
 try:
     import resource
@@ -568,6 +569,33 @@
         data2 = self.get_urandom_subprocess(16)
         self.assertNotEqual(data1, data2)
 
+    def test_urandom_fd_non_inheritable(self):
+        # Issue #23458: os.urandom() keeps a file descriptor open, but it
+        # must be non inheritable
+        fd_status = test_support.findfile("fd_status.py", subdir="subprocessdata")
+
+        # Need a two subprocesses because the Python test suite opens other
+        # inheritable file descriptors, whereas the test is specific to
+        # os.urandom() file descriptor
+        code = textwrap.dedent("""
+            import os
+            import subprocess
+            import sys
+
+            # Ensure that the /dev/urandom file descriptor is open
+            os.urandom(1)
+
+            exitcode = subprocess.call([sys.executable, %r],
+                                       close_fds=False)
+            sys.exit(exitcode)
+        """ % fd_status)
+
+        proc = subprocess.Popen([sys.executable, "-c", code],
+                                stdout=subprocess.PIPE, close_fds=True)
+        output, error = proc.communicate()
+        open_fds = set(map(int, output.rstrip().split(',')))
+        self.assertEqual(open_fds - set(range(3)), set())
+
 
 HAVE_GETENTROPY = (sysconfig.get_config_var('HAVE_GETENTROPY') == 1)