On 02/13/2014 10:26 PM, roger riggs wrote:
Having folks stumbling over process creation and problems of quoting, especially on windows, it seems useful to log the native commands and arguments. They are proposed to be logged using the PlatformLogger at Level.FINE which will not be logged by default. The environment is useful in some cases, but verbose, that it should be Logged at FINER. The pid of the spawned process logged as well for traceability.
It may make sense to expose something like getProcessID() to the public because it is independently useful on systems with /proc.
In the src/solaris version, Arrays::toString(Object[]) does not quote the arguments, so the argument boundary is lost in the logging. I think something that performs quoting (using the Java language rules, not shell) would be helpful in this context. Although on non-Windows platforms, this information can easily be obtained with tools such as strace or truss.
-- Florian Weimer / Red Hat Product Security Team
