diff --git a/setup/start/sudoers b/setup/start/sudoers
index 7781d0504..324804c38 100644
--- a/setup/start/sudoers
+++ b/setup/start/sudoers
@@ -32,6 +32,7 @@ Defaults!/home/yellowtent/box/src/scripts/configurelogrotate.sh env_keep="HOME B
 yellowtent ALL=(root) NOPASSWD: /home/yellowtent/box/src/scripts/configurelogrotate.sh
 
 Defaults!/home/yellowtent/box/src/backupupload.js env_keep="HOME BOX_ENV"
+Defaults!/home/yellowtent/box/src/backupupload.js closefrom_override
 yellowtent ALL=(root) NOPASSWD:SETENV: /home/yellowtent/box/src/backupupload.js
 
 Defaults!/home/yellowtent/box/src/scripts/restart.sh env_keep="HOME BOX_ENV"
diff --git a/src/backups.js b/src/backups.js
index 89fe1856f..c36e8c498 100644
--- a/src/backups.js
+++ b/src/backups.js
@@ -600,16 +600,22 @@ function runBackupUpload(backupId, format, dataDir, callback) {
     assert.strictEqual(typeof dataDir, 'string');
     assert.strictEqual(typeof callback, 'function');
 
-    shell.sudo(`backup-${backupId}`, [ BACKUP_UPLOAD_CMD, backupId, format, dataDir ], { preserveEnv: true }, function (error) {
+    let result = '';
+
+    let cp = shell.sudo(`backup-${backupId}`, [ BACKUP_UPLOAD_CMD, backupId, format, dataDir ], { preserveEnv: true, ipc: true }, function (error) {
         if (error && (error.code === null /* signal */ || (error.code !== 0 && error.code !== 50))) { // backuptask crashed
             return callback(new BackupsError(BackupsError.INTERNAL_ERROR, 'Backuptask crashed'));
         } else if (error && error.code === 50) { // exited with error
-            var result = safe.fs.readFileSync(paths.BACKUP_RESULT_FILE, 'utf8') || safe.error.message;
             return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, result));
         }
 
         callback();
     });
+
+    cp.on('message', function (message) {
+        debug(`runBackupUpload: message - ${message}`);
+        result = message.result;
+    });
 }
 
 function getSnapshotInfo(id) {
diff --git a/src/backupupload.js b/src/backupupload.js
index 2bd52b64f..da7377417 100755
--- a/src/backupupload.js
+++ b/src/backupupload.js
@@ -36,14 +36,12 @@ process.on('SIGTERM', function () {
 initialize(function (error) {
     if (error) throw error;
 
-    safe.fs.writeFileSync(paths.BACKUP_RESULT_FILE, '');
-
     backups.upload(backupId, format, dataDir, function resultHandler(error) {
         if (error) debug('upload completed with error', error);
 
         debug('upload completed');
 
-        safe.fs.writeFileSync(paths.BACKUP_RESULT_FILE, error ? error.message : '');
+        process.send({ result: error ? error.message : '' });
 
         // https://nodejs.org/api/process.html are exit codes used by node. apps.js uses the value below
         // to check apptask crashes
diff --git a/src/shell.js b/src/shell.js
index 287aaff74..0dfe70aef 100644
--- a/src/shell.js
+++ b/src/shell.js
@@ -40,6 +40,8 @@ function spawn(tag, file, args, options, callback) {
 
     debug(tag + ' spawn: %s %s', file, args.join(' '));
 
+    if (options.ipc) options.stdio = ['pipe', 'pipe', 'pipe', 'ipc'];
+
     var cp = child_process.spawn(file, args, options);
     if (options.logStream) {
         cp.stdout.pipe(options.logStream);
@@ -78,8 +80,11 @@ function sudo(tag, args, options, callback) {
     assert.strictEqual(typeof options, 'object');
     assert.strictEqual(typeof callback, 'function');
 
-    // -S makes sudo read stdin for password. -E preserves environment
-    var cp = spawn(tag, SUDO, [ options.preserveEnv ? '-SE' : '-S' ].concat(args), options, callback);
+    let sudoArgs = [ '-S' ]; // -S makes sudo read stdin for password
+    if (options.preserveEnv) sudoArgs.push('-E'); // -E preserves environment
+    if (options.ipc) sudoArgs.push('--close-from=4'); // keep the ipc open. requires closefrom_override in sudoers file
+
+    var cp = spawn(tag, SUDO, sudoArgs.concat(args), options, callback);
     cp.stdin.end();
     return cp;
 }