[Pkg-puppet-devel] Bug#809786: Bug#809786: The "posix" provider of the "exec" resource seems to invoke a shell even though the documentation says it doesn't

[Markus Frosch]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 04.01.2016 02:52, Alexander Kurtz wrote:
> the puppet type reference describes the "posix" provider of the "exec" resource like this: [0]
> 
> posix Executes external binaries directly, without passing through a shell or performing any interpolation. This is a safer and more
> predictable way to execute most commands, but prevents the use of globbing and shell built-ins (including control logic like “for” and
> “if” statements). [...] I'm not really sure what to make of this, but it seems... unexpected. What do you guys think?


I had a look in the code lately and it seems like this part is very much abstracted.

I expect this to be the culprit:
https://github.com/puppetlabs/puppet/blob/master/lib/puppet/util/execution.rb#L273

It seems like this behavior broke at some point without anyone noticing.

I also bet it hasn't been fixed in Puppet 4 either. Have you already forwarded that bug to Puppetlabs?

Cheers
Markus Frosch
- -- 
markus at lazyfrosch.de / lazyfrosch at debian.org
http://www.lazyfrosch.de
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJWlNxmAAoJEPJhXZqrmHturPQIAIDKhAthwner4PS+jbWcVwnP
s+Xhrqn7C+XUpUcxwSpbCRQBfqNYjxD3KKD5aPJoW2+GZ5IjOesDOUwVQXrn3QrE
daEvNf/twkM9v3WCwsraaNqRXZU833XBmSY8SatmWFWoXdoINnx6oRXYIFjpk+z1
SxCSV5LFQDDsO+Xgu4ti0St+EH6lY2P4B2xJbx6jT6xNmqrLSMUAx29/03n5IAJE
1+ZmjG0MN4lulgiEOr6wzEIbuzwQYk1/NiJoZvtdZ3ofmqpLPBxkE8Gdgjmy6yDp
jkatgZXCAVogMN2i4aOTAsPA5e3e/CTM/xLgbqn2suO1/6QghNct61auZDk7BLw=
=D3XM
-----END PGP SIGNATURE-----