management: shell out external programs in a more secure way

management/utils.py

@@ -74,4 +74,14 @@ def is_pid_valid(pid):
         else: # EINVAL
             raise
     else:
-        return True
+        return True
+
+def shell(method, cmd_args, env={}, capture_stderr=False):
+    # A safe way to execute processes.
+    # Some processes like apt-get require being given a sane PATH.
+    import subprocess
+    env.update({ "PATH": "/sbin:/bin:/usr/sbin:/usr/bin" })
+    stderr = None if not capture_stderr else subprocess.STDOUT
+    ret = getattr(subprocess, method)(cmd_args, env=env, stderr=stderr)
+    if isinstance(ret, bytes): ret = ret.decode("utf8")
+    return ret