An alternative would be to make sure that you reopen the file with the same security controls as tempfile uses, but I think that retaining a reference to the tempfile object as long as needed is the right answer.