System calls

I want to use a system call to copy (cp) a source file to a backup directory. I need to pass the source and destination paths via command prompt, but the only way I've been able to get the system call to work is by hard coding it (below). Can this be done?

Working line of code:

Code:

---

system("cp -r /home/myuser/prog.c /home/myuser/backup/prog.c");

---

Attempt to pass path via variable:

Code:

---

snprintf(destpath, MAX_LEN, "\"cp -r /home/myuser/prog.c /home/myuser/backup/prog.c\"");
printf("This is the destpath: %s\n", destpath);
system(destpath);

---

The output from the non-working attempt is:
sh: cp -r /home/myuser/prog.c /home/myuser/backup/prog.c: not found.

However, I can take the sh: error, copy the cp command and paste it on a unix prompt and successfully copy the file from source to destination.

The problem in your code is the single quotes which you have escaped that,
for ex:
snprintf(destpath, MAX_LEN, "\"cp -r /home/myuser/prog.c /home/myuser/backup/prog.c\"");

Actually it must be
snprintf(destpath, MAX_LEN, "cp -r /home/myuser/prog.c /home/myuser/backup/prog.c");

The above one is Ok when the command dont have the arguments
for ex :
system("\"ls\""); // Will work fine

system("\"ls -lrt\"") ; // wont work

Dear friend see the following example code, It will copy the file "plan" from one directory to another directory using the system call.

Example Code

Code:

---


#include<stdio.h>
#include<malloc.h>
#define MAX_LEN 1024

main()
{

        //system("ls /home/sugumar/SUGUMAR/");
        char *destpath;
        destpath=(char *)malloc(1024);
        snprintf(destpath, MAX_LEN, "cp -r /home/sugumar/plan /home/sugumar/SUGUMAR/");
        printf("\n\n\nThis is the destpath: %s\n", destpath);
        system(destpath);

        //system("ls /home/sugumar/SUGUMAR/");

}

---

you try with this above example. here I didn't escape the directory separator [ / ].

Thanks guys! This was a quick fix, I really appreciate your responses.

Alexander jack: After removing the quote characters and their corresponding escape characters, I got the results that I expected.

It would be preferable if you used API instead.
system has a lot of overhead and is subject to security issues.

Quote:

---

Originally Posted by Elysia

It would be preferable if you used API instead.
system has a lot of overhead and is subject to security issues.

---

I still don't see what kind of security issues system() could possibly have?

Quote:

---

Originally Posted by cpjust

I still don't see what kind of security issues system() could possibly have?

---

Replace the called program with a user-defined one. i.e. your program is running as root, someone replaces "ls" with their own. Bang, root access.

Inject strings if any part is user-defined.

Quote:

---

Originally Posted by zacs7

Replace the called program with a user-defined one. i.e. your program is running as root, someone replaces "ls" with their own. Bang, root access.

Inject strings if any part is user-defined.

---

But wouldn't you have exactly the same problems with OS API calls like CreateProcess...?

CreateProcess() has a security attribute. But sure, I guess.

Quote:

---

Originally Posted by zacs7

Replace the called program with a user-defined one. i.e. your program is running as root, someone replaces "ls" with their own. Bang, root access.

Inject strings if any part is user-defined.

---

Be real. If his box has been rooted to the point where ls et al has been replaced with trojans, he has far bigger problems than use of system() to run apps from /usr/bin, starting with his basic security habits and setup. The thing is, I think you know that.

The thing here is to avoid external programs and use API to do the dirty work instead.
system and APIs such as CreateProcess are both vulnerable to security issues. Copy API is less so.