Force command action to not be executed by the shell unless specifically enabled

library/system/service

@@ -207,7 +207,9 @@ class Service(object):
                 os._exit(0)
 
             # Start the command
-            p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, preexec_fn=lambda: os.close(pipe[1]))
+            if isinstance(cmd, basestring):
+                cmd = shlex.split(cmd)
+            p = subprocess.Popen(cmd, shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE, preexec_fn=lambda: os.close(pipe[1]))
             stdout = ""
             stderr = ""
             fds = [p.stdout, p.stderr]

library/system/setup

@@ -29,7 +29,6 @@ import socket
 import struct
 import datetime
 import getpass
-import subprocess
 import ConfigParser
 import StringIO
 
@@ -1432,7 +1431,8 @@ class LinuxNetwork(Network):
     """
     platform = 'Linux'
 
-    def __init__(self):
+    def __init__(self, module):
+        self.module = module
         Network.__init__(self)
 
     def populate(self):
@@ -1618,12 +1618,15 @@ class LinuxNetwork(Network):
                             ips['all_ipv6_addresses'].append(address)
 
             ip_path = module.get_bin_path("ip")
-            primary_data = subprocess.Popen(
-                [ip_path, 'addr', 'show', 'primary', device],
-                stdout=subprocess.PIPE, stderr=subprocess.PIPE).communicate()[0]
-            secondary_data = subprocess.Popen(
-                [ip_path, 'addr', 'show', 'secondary', device],
-                stdout=subprocess.PIPE, stderr=subprocess.PIPE).communicate()[0]
+
+            args = [ip_path, 'addr', 'show', 'primary', device]
+            rc, stdout, stderr = self.module.run_command(args)
+            primary_data = stdout
+
+            args = [ip_path, 'addr', 'show', 'secondary', device]
+            rc, stdout, stderr = self.module.run_command(args)
+            secondary_data = stdout
+
             parse_ip_output(primary_data)
             parse_ip_output(secondary_data, secondary=True)
 
@@ -2283,11 +2286,11 @@ def get_file_content(path, default=None):
             data = default
     return data
 
-def ansible_facts():
+def ansible_facts(module):
     facts = {}
     facts.update(Facts().populate())
     facts.update(Hardware().populate())
-    facts.update(Network().populate())
+    facts.update(Network(module).populate())
     facts.update(Virtual().populate())
     return facts
 
@@ -2296,7 +2299,7 @@ def ansible_facts():
 def run_setup(module):
 
     setup_options = {}
-    facts = ansible_facts()
+    facts = ansible_facts(module)
 
     for (k, v) in facts.items():
         setup_options["ansible_%s" % k.replace('-', '_')] = v