procenv

func Command ¶

func Command(name string, arg ...string) *exec.Cmd

Command wraps exec.Command and pre-sets a sanitized environment (systemd notify variables stripped). Use it for daemon-spawned helpers that do not participate in the systemd notification contract, so they cannot emit notifications on the daemon's behalf. Everything else in the environment is preserved.

Security boundary: this is a thin, general-purpose wrapper — it introduces no command/argument itself and adds no injection surface beyond stdlib exec.Command. The command name and args come entirely from the caller; every caller in this repo passes a static/validated command (the callers previously carried the per-site `#nosec G204 -- trusted constants` annotations). Input-safety therefore lives at the call sites, identical to using exec.Command directly. The Semgrep dangerous-exec-command finding on the pass-through below is a wrapper false positive (gosec G204 does not flag it); suppressed with justification.

func CommandContext ¶

func CommandContext(ctx context.Context, name string, arg ...string) *exec.Cmd

CommandContext is the context-aware counterpart of Command. Same security boundary as Command: input-safety lives at the call sites.

func SanitizedSystemdEnv ¶

func SanitizedSystemdEnv() []string

SanitizedSystemdEnv returns a copy of the current process environment with the systemd notification variables removed. Assign the result to exec.Cmd.Env for child processes that do not participate in the daemon's systemd notification contract. The returned slice is safe to mutate by the caller.

func StripSystemdVars ¶

func StripSystemdVars(env []string) []string

StripSystemdVars returns a NEW slice: a copy of env with exactly the three systemd notification variables removed. Exposed separately so it can be unit-tested without touching the real process environment.

Contract:

• the input slice is never mutated (a fresh slice is returned);
• only exact-name matches of NOTIFY_SOCKET / WATCHDOG_USEC / WATCHDOG_PID are removed — a variable that merely contains the substring is preserved;
• EVERY occurrence of a blocked key is removed (duplicate keys handled);
• every other entry passes through verbatim and in order, including any malformed entry that lacks '=' (we do not editorialize non-target entries; os.Environ never produces such entries, so this is a defensive guarantee).