http://www.perlmonks.org?node_id=1219288


in reply to Re^2: setuid system() calls on Solaris 11
in thread setuid system() calls on Solaris 11

Using
system( '/bin/sh', '-pc', "cmd string w/optional stderr and stdout red +irection" );
worked! Excellent. What we had experienced in migrating to the newer OS (Solaris 11) was that some of our system() calls were honoring setuid/setgid and some were not. Yet they were all quite similar (i.e. system( "single param string")). And the Perl docs were not clear (to me) regarding the nuances:
If there are no shell metacharacters in the argument, it is split into words and passed directly to "execvp", ...
Anynow, I'm off to make many changes, replacing system() calls and backticks with calls to a ssystem() wrapper function. Thanks all! Mark

Replies are listed 'Best First'.
Re^4: setuid system() calls on Solaris 11
by haukex (Bishop) on Jul 26, 2018 at 08:36 UTC
    backticks

    You may want to look at IPC::System::Simple's capturex, a replacement for backticks that allows the same multi-argument calling convention that avoids the shell (allowing you to call the shell explicitly in the same way I showed above).