title: Python 2.6 subprocess.call() appears to be invoking setgid behavior triggering Perl's taint checks. How can I resolve?
body: <p>I've got some strange behavioral differences between Python's subprocess.call() and os.system() that appears to be related to setgid. The difference is causing Perl's taint checks to be invoked when subprocess.call() is used, which creates problems because I do not have the ability to modify all the Perl scripts that would need untaint code added to them.</p>
  
  <p>Example, "process.py"</p>
  
  <pre><code>#!/usr/bin/python
  
  import os, subprocess
  
  print "Python calling os.system"
  os.system('perl subprocess.pl true')
  print "Python done calling os.system"
  print "Python calling subprocess.call"
  subprocess.call(['perl', 'subprocess.pl', 'true'])
  print "Python done calling subprocess.call"
  </code></pre>
  
  <p>"subprocess.pl"</p>
  
  <pre><code>#!/usr/bin/perl
  
  print "perl subprocess\n";
  `$ARGV[0]`;
  print "perl subprocess done\n";
  </code></pre>
  
  <p>The output - both runs of subprocess.pl should be the same, but the one run with subprocess.call() gets a taint error:</p>
  
  <pre><code>mybox&gt; process.py
  Python calling os.system
  perl subprocess
  perl subprocess done
  Python done calling os.system
  Python calling subprocess.call
  perl subprocess
  Insecure dependency in `` while running setgid at subprocess.pl line 4.
  Python done calling subprocess.call
  mybox&gt;
  </code></pre>
  
  <p>While using os.system() works, I would really rather be using subprocess.check_call() as it's more forward-compatible and has nice checking behaviors.</p>
  
  <p>Any suggestions or documentation that might explain why these two are different? Is it possible this is some strange setting in my local unix environment that is invoking these behaviors?</p>