2009/327 [system_noshell]

[Roland Mainz]

Casper.Dik at sun.com wrote:
> >I think it would be helpful to see a few worked examples that show how
> >system_noshell() and its variants make things simpler than using
> >posix_spawn().
> >
> >    Date: Fri, 29 May 2009 10:41:30 -0700
> >    From: Sumanth Naropanth <Sumanth.Naropanth at sun.com>
> >    Subject: Re: system_noshell [PSARC/2009/327 FastTrack timeout
> >           06/05/2009]
> >
> >    ...
> >
> >    system_noshell("/bin/rm /tmp/tmpfile") is simpler than
> >    posix_spawn(pid, "rm", NULL, NULL, argv, NULL) which also includes
> >    populating an argv vector.
> >
> >The example given above is a start, but I'd like to see something more
> >realistic.
> 
> If we're going to *parse* commands using spaces or what not, I vote
> no, right now!

I agree with Casper... we had that kind of proposal with |exec_system()|
a while ago (AFAIK in security-discuss at opensolaris.org) and that
proposal was "eaten&&trampled alive" (there should be always an option
to pass _any_ content (except '\0') via arguments and environment
variables and using a whitespace character for argument splitting
violates that).

----

Bye,
Roland

-- 
  __ .  . __
 (o.\ \/ /.o) roland.mainz at nrubsig.org
  \__\/\/__/  MPEG specialist, C&&JAVA&&Sun&&Unix programmer
  /O /==\ O\  TEL +49 641 3992797
 (;O/ \/ \O;)