system: replace exec() in config encrypt/decrypt #9325
Although these are very safe the calls are much more portable now
and this was also the last exec() in the MVC code. Plus, Shell
class was already being used elsewhere here.
firewall: remove mutes from 3 execution calls
Mute is used when we know the operation could fail but these don't
look like it and shouldn't. In the shaper case the script even ends
using exit 0 without a set -e so that's going to be fine all the time.
interfaces: stop command in variable usage in wlan code
Actually transforms unsafe commands either run or embedded into the
script. Pretty cool that we can also secure script generation with
exec_safe() ;)
backend: move exec_safe, pass_safe and shell_safe to a class #9325
Do a clean cut to a class for these functions first. We need them in the
MVC code and this is a good opportunity to try and add them to the legacy
code via the wrappers.
The others should follow but let's settle on better names first perhaps.
backend: extend exec_safe() to allow array of format strings #9325
For years this has bothered me and the last couple of weeks I've tried
and failed to introduce something reasonable into $args handling that
can better do dynamic command generation paired with ease of use.
The irony is the solution was already in the code: $args supports arrays
and join(' ', $cmds) was used in caller code to construct the final
format string which is safe by default.
By making $format an array we can keep the separation of format and args
and are otherwise totally flexible in providing these to arrays and avoiding
any sort of ordering problems a number of other failed attempts at extending
this suffered from.
backend: also introduce pass_safe()
All these functions are bound to take a dynamic argument at some point.
Add a few callers although by no means complete for now.
system: mark these mwexec() as safe by switching to mwexecf() and a minor simplification #9325
We still have join() in there but arguments are properly fed from exec_safe().
We can clean this up later. Historically, these parts have had a few
regressions and problems so glossing over them is not the best idea.
backend: move Safe to Shell class
Migrate the one user in the Monit migration to shell_safe() because
that is the most appropriate here (no error code needed, just output).
backend: fiddle with mwexecf_bg for #9325
Never mute a background action, also because it is used nowhere and
I cannot recall an instance where we had to mute it either. Debug
output for backgrounding action failure is likely valuable information.
