toaster: localhostbectrl Pass DATABASE_URL in via the process environment

Instead of putting the DATABASE_URL as part of the command for launching
the bitbake observer process set it as part of environment.

This fixes two issues 1. Where the value isn't quoted and therefore will be
interpreted in the shell and 2. Anyone being able to see the value of
DATABASE_URL in the process tree.

[YOCTO #8669]

Signed-off-by: Michael Wood <michael.g.wood@intel.com>
Signed-off-by: Elliot Smith <elliot.smith@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

1 files changed, 10 insertions, 3 deletions

diff --git a/lib/toaster/bldcontrol/localhostbecontroller.py b/lib/toaster/bldcontrol/localhostbecontroller.py
index b5cf5591f..854a6bbfe 100644
--- a/lib/toaster/bldcontrol/localhostbecontroller.py
+++ b/lib/toaster/bldcontrol/localhostbecontroller.py
@@ -48,7 +48,6 @@ class LocalhostBEController(BuildEnvironmentController):
 
     def __init__(self, be):
         super(LocalhostBEController, self).__init__(be)
-        self.dburl = settings.getDATABASE_URL()
         self.pokydirname = None
         self.islayerset = False
 
@@ -126,9 +125,17 @@ class LocalhostBEController(BuildEnvironmentController):
                     port = i.split(" ")[-1]
                     logger.debug("localhostbecontroller: Found bitbake server port %s" % port)
 
-        cmd = "bash -c \"source %s/oe-init-build-env-memres -1 %s && DATABASE_URL=%s %s --observe-only -u toasterui --remote-server=0.0.0.0:-1 -t xmlrpc\"" % (self.pokydirname, self.be.builddir, self.dburl, own_bitbake)
+        cmd = "bash -c \"source %s/oe-init-build-env-memres -1 %s && %s --observe-only -u toasterui --remote-server=0.0.0.0:-1 -t xmlrpc\"" % \
+                (self.pokydirname, self.be.builddir, own_bitbake)
+
+        # Use a copy of the current environment and add the DATABASE_URL
+        # for the bitbake observer process.
+        env = os.environ.copy()
+        env['DATABASE_URL'] = settings.getDATABASE_URL()
+
         with open(toaster_ui_log_filepath, "a+") as f:
-            p = subprocess.Popen(cmd, cwd = self.be.builddir, shell=True, stdout=f, stderr=f)
+            p = subprocess.Popen(cmd, cwd = self.be.builddir, shell=True,
+                                 stdout=f, stderr=f, env=env)
 
         def _toaster_ui_started(filepath, filepos = 0):
             if not os.path.exists(filepath):