Page MenuHomeVyOS Platform

Introduce new vyos.utils.process.cmdl() helper for improved security
Closed, ResolvedPublicFEATURE REQUEST

Description

Add a new helper vyos.utils.process.cmdl() that behaves like vyos.utils.process.cmd(), but requires the command to be passed as a list of arguments instead of a string. It should also support a new sudo: bool = False argument to allow privileged execution.

The motivation for this change is security hardening. Many current call sites build commands with f-strings or other string formatting before passing them to cmd(), which makes escaping harder to reason about and increases the risk of arbitrary command injection. A list-based helper provides a safer and more explicit interface for subprocess execution.

This task should add cmdl() (with l for list) with behavior matching cmd() as closely as possible, while enabling gradual refactoring of existing string-based command invocations to the new helper where appropriate. This is intended primarily as a security-focused refactoring rather than a new feature.

See also: https://github.com/vyos/vyos-1x/pull/5274

Details

Version
-
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)