From: Daniel P. Berrangé <berrange@redhat.com> The subprocess.run command avoids using the shell and so is robust should sys.argv contain any whitespace or unexpected shell meta characters. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> --- scripts/check-file-access.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/scripts/check-file-access.py b/scripts/check-file-access.py index 2636eb4f96..71130d4dec 100755 --- a/scripts/check-file-access.py +++ b/scripts/check-file-access.py @@ -23,6 +23,7 @@ import os import re +import subprocess import sys import tempfile @@ -36,11 +37,9 @@ permitted_file = os.path.join(abs_srcdir, 'permitted_file_access.txt') os.environ['VIR_TEST_FILE_ACCESS_OUTPUT'] = access_file -test = ' '.join(sys.argv[1:]) +proc = subprocess.run(sys.argv[1:]) -ret = os.system(test) - -if ret != 0 or os.read(access_fd, 10) == b'': +if proc.returncode != 0 or os.read(access_fd, 10) == b'': os.close(access_fd) os.remove(access_file) sys.exit(ret) -- 2.51.1