execvp

10 files changed, 296 insertions, 248 deletions

diff --git a/nova/crypto.py b/nova/crypto.py
index b240a3958..dd24723b8 100644
--- a/nova/crypto.py
+++ b/nova/crypto.py
@@ -105,8 +105,10 @@ def generate_key_pair(bits=1024):
 
     tmpdir = tempfile.mkdtemp()
     keyfile = os.path.join(tmpdir, 'temp')
-    utils.execute('ssh-keygen','-q','-b',"%d" % bits,'-N','""','-f',keyfile)
-    (out, err) = utils.execute('ssh-keygen','-q','-l','-f',"%s.pub" % (keyfile))
+    utils.execute('ssh-keygen', '-q', '-b', '%d' % bits, '-N', '',
+                  '-f', keyfile)
+    (out, err) = utils.execute('ssh-keygen', '-q', '-l', '-f',
+                               '%s.pub' % (keyfile))
     fingerprint = out.split(' ')[1]
     private_key = open(keyfile).read()
     public_key = open(keyfile + '.pub').read()
@@ -118,7 +120,7 @@ def generate_key_pair(bits=1024):
     # bio = M2Crypto.BIO.MemoryBuffer()
     # key.save_pub_key_bio(bio)
     # public_key = bio.read()
-    # public_key, err = execute('ssh-keygen','-y','-f','/dev/stdin', private_key)
+    # public_key, err = execute('ssh-keygen', '-y', '-f', '/dev/stdin', private_key)
 
     return (private_key, public_key, fingerprint)
 
@@ -143,9 +145,10 @@ def revoke_cert(project_id, file_name):
     start = os.getcwd()
     os.chdir(ca_folder(project_id))
     # NOTE(vish): potential race condition here
-    utils.execute('openssl','ca','-config','./openssl.cnf','-revoke',"'%s'" % file_name)
-    utils.execute('openssl','ca','-gencrl','-config','./openssl.cnf','-out',"'%s'" %
-                  FLAGS.crl_file)
+    utils.execute('openssl', 'ca', '-config', './openssl.cnf', '-revoke',
+                  '%s' % file_name)
+    utils.execute('openssl', 'ca', '-gencrl', '-config', './openssl.cnf',
+                  '-out', '%s' % FLAGS.crl_file)
     os.chdir(start)
 
 
@@ -193,8 +196,9 @@ def generate_x509_cert(user_id, project_id, bits=1024):
     tmpdir = tempfile.mkdtemp()
     keyfile = os.path.abspath(os.path.join(tmpdir, 'temp.key'))
     csrfile = os.path.join(tmpdir, 'temp.csr')
-    utils.execute('openssl','genrsa','-out',keyfile,bits)
-    utils.execute('openssl','req','-new','-key',keyfile,'-out',csrfile,'-batch','-subj',subject)
+    utils.execute('openssl', 'genrsa', '-out', keyfile, bits)
+    utils.execute('openssl', 'req', '-new', '-key', keyfile, '-out', csrfile,
+                  '-batch', '-subj', subject)
     private_key = open(keyfile).read()
     csr = open(csrfile).read()
     shutil.rmtree(tmpdir)
@@ -211,7 +215,8 @@ def _ensure_project_folder(project_id):
     if not os.path.exists(ca_path(project_id)):
         start = os.getcwd()
         os.chdir(ca_folder())
-        utils.execute('sh','geninter.sh',project_id, _project_cert_subject(project_id))
+        utils.execute('sh', 'geninter.sh', project_id,
+                      _project_cert_subject(project_id))
         os.chdir(start)
 
 
@@ -226,7 +231,7 @@ def generate_vpn_files(project_id):
     start = os.getcwd()
     os.chdir(ca_folder())
     # TODO(vish): the shell scripts could all be done in python
-    utils.execute('sh','genvpn.sh',
+    utils.execute('sh', 'genvpn.sh',
                   project_id, _vpn_cert_subject(project_id))
     with open(csr_fn, "r") as csrfile:
         csr_text = csrfile.read()
@@ -257,9 +262,10 @@ def _sign_csr(csr_text, ca_folder):
     start = os.getcwd()
     # Change working dir to CA
     os.chdir(ca_folder)
-    utils.execute('openssl','ca','-batch','-out',outbound,'-config'
-                  './openssl.cnf','-infiles',inbound)
-    out, _err = utils.execute('openssl','x509','-in',outbound','-serial','-noout')
+    utils.execute('openssl', 'ca', '-batch', '-out', outbound, '-config',
+                  './openssl.cnf', '-infiles', inbound)
+    out, _err = utils.execute('openssl', 'x509', '-in', outbound,
+                              '-serial', '-noout')
     serial = out.rpartition("=")[2]
     os.chdir(start)
     with open(outbound, "r") as crtfile:
diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 535ce87bc..ad019a8c0 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -65,113 +65,117 @@ flags.DEFINE_string('dmz_cidr', '10.128.0.0/24',
 
 def metadata_forward():
     """Create forwarding rule for metadata"""
-    _confirm_rule("PREROUTING", "-t nat -s 0.0.0.0/0 "
-             "-d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j DNAT "
-             "--to-destination %s:%s" % (FLAGS.ec2_dmz_host, FLAGS.ec2_port))
+    _confirm_rule("PREROUTING", '-t', 'nat', '-s', '0.0.0.0/0',
+             '-d', '169.254.169.254/32', '-p', 'tcp', '-m', 'tcp',
+             '--dport', '80', '-j', 'DNAT',
+             '--to-destination', '%s:%s' % (FLAGS.ec2_dmz_host, FLAGS.ec2_port))
 
 
 def init_host():
     """Basic networking setup goes here"""
 
     if FLAGS.use_nova_chains:
-        _execute("sudo iptables -N nova_input", check_exit_code=False)
-        _execute("sudo iptables -D %s -j nova_input" % FLAGS.input_chain,
+        _execute('sudo', 'iptables', '-N', 'nova_input', check_exit_code=False)
+        _execute('sudo', 'iptables', '-D', FLAGS.input_chain,
+                 '-j', 'nova_input',
                  check_exit_code=False)
-        _execute("sudo iptables -A %s -j nova_input" % FLAGS.input_chain)
-
-        _execute("sudo iptables -N nova_forward", check_exit_code=False)
-        _execute("sudo iptables -D FORWARD -j nova_forward",
+        _execute('sudo', 'iptables', '-A', FLAGS.input_chain,
+                 '-j', 'nova_input')
+        _execute('sudo', 'iptables', '-N', 'nova_forward',
                  check_exit_code=False)
-        _execute("sudo iptables -A FORWARD -j nova_forward")
-
-        _execute("sudo iptables -N nova_output", check_exit_code=False)
-        _execute("sudo iptables -D OUTPUT -j nova_output",
+        _execute('sudo', 'iptables', '-D', 'FORWARD', '-j', 'nova_forward',
                  check_exit_code=False)
-        _execute("sudo iptables -A OUTPUT -j nova_output")
-
-        _execute("sudo iptables -t nat -N nova_prerouting",
+        _execute('sudo', 'iptables', '-A', 'FORWARD', '-j', 'nova_forward')
+        _execute('sudo', 'iptables', '-N', 'nova_output', check_exit_code=False)
+        _execute('sudo', 'iptables', '-D', 'OUTPUT', '-j', 'nova_output',
                  check_exit_code=False)
-        _execute("sudo iptables -t nat -D PREROUTING -j nova_prerouting",
+        _execute('sudo', 'iptables', '-A', 'OUTPUT', '-j', 'nova_output')
+        _execute('sudo', 'iptables', '-t', 'nat', '-N', 'nova_prerouting',
                  check_exit_code=False)
-        _execute("sudo iptables -t nat -A PREROUTING -j nova_prerouting")
-
-        _execute("sudo iptables -t nat -N nova_postrouting",
+        _execute('sudo', 'iptables', '-t', 'nat', '-D', 'PREROUTING',
+                 '-j', 'nova_prerouting', check_exit_code=False)
+        _execute('sudo', 'iptables', '-t', 'nat', '-A', 'PREROUTING',
+                 '-j', 'nova_prerouting')
+        _execute('sudo', 'iptables', '-t', 'nat', '-N', 'nova_postrouting',
                  check_exit_code=False)
-        _execute("sudo iptables -t nat -D POSTROUTING -j nova_postrouting",
+        _execute('sudo', 'iptables', '-t', 'nat', '-D', 'POSTROUTING',
+                 '-j', 'nova_postrouting', check_exit_code=False)
+        _execute('sudo', 'iptables', '-t', 'nat', '-A', 'POSTROUTING',
+                 '-j', 'nova_postrouting')
+        _execute('sudo', 'iptables', '-t', 'nat', '-N', 'nova_snatting',
                  check_exit_code=False)
-        _execute("sudo iptables -t nat -A POSTROUTING -j nova_postrouting")
-
-        _execute("sudo iptables -t nat -N nova_snatting",
+        _execute('sudo', 'iptables', '-t', 'nat', '-D', 'POSTROUTING',
+                 '-j nova_snatting', check_exit_code=False)
+        _execute('sudo', 'iptables', '-t', 'nat', '-A', 'POSTROUTING',
+                 '-j', 'nova_snatting')
+        _execute('sudo', 'iptables', '-t', 'nat', '-N', 'nova_output',
                  check_exit_code=False)
-        _execute("sudo iptables -t nat -D POSTROUTING -j nova_snatting",
-                 check_exit_code=False)
-        _execute("sudo iptables -t nat -A POSTROUTING -j nova_snatting")
-
-        _execute("sudo iptables -t nat -N nova_output", check_exit_code=False)
-        _execute("sudo iptables -t nat -D OUTPUT -j nova_output",
-                 check_exit_code=False)
-        _execute("sudo iptables -t nat -A OUTPUT -j nova_output")
+        _execute('sudo', 'iptables', '-t', 'nat', '-D', 'OUTPUT',
+                 '-j nova_output', check_exit_code=False)
+        _execute('sudo', 'iptables', '-t', 'nat', '-A', 'OUTPUT',
+                 '-j', 'nova_output')
     else:
         # NOTE(vish): This makes it easy to ensure snatting rules always
         #             come after the accept rules in the postrouting chain
-        _execute("sudo iptables -t nat -N SNATTING",
-                 check_exit_code=False)
-        _execute("sudo iptables -t nat -D POSTROUTING -j SNATTING",
+        _execute('sudo', 'iptables', '-t', 'nat', '-N', 'SNATTING',
                  check_exit_code=False)
-        _execute("sudo iptables -t nat -A POSTROUTING -j SNATTING")
+        _execute('sudo', 'iptables', '-t', 'nat', '-D', 'POSTROUTING',
+                 '-j', 'SNATTING', check_exit_code=False)
+        _execute('sudo', 'iptables', '-t', 'nat', '-A', 'POSTROUTING',
+                 '-j', 'SNATTING')
 
     # NOTE(devcamcar): Cloud public SNAT entries and the default
     # SNAT rule for outbound traffic.
-    _confirm_rule("SNATTING", "-t nat -s %s "
-             "-j SNAT --to-source %s"
-             % (FLAGS.fixed_range, FLAGS.routing_source_ip), append=True)
+    _confirm_rule("SNATTING", '-t', 'nat', '-s', FLAGS.fixed_range,
+             '-j', 'SNAT', '--to-source', FLAGS.routing_source_ip,
+             append=True)
 
-    _confirm_rule("POSTROUTING", "-t nat -s %s -d %s -j ACCEPT" %
-                  (FLAGS.fixed_range, FLAGS.dmz_cidr))
-    _confirm_rule("POSTROUTING", "-t nat -s %(range)s -d %(range)s -j ACCEPT" %
-                  {'range': FLAGS.fixed_range})
+    _confirm_rule("POSTROUTING", '-t', 'nat', '-s', FLAGS.fixed_range,
+                  '-d', FLAGS.dmz_cidr, '-j', 'ACCEPT')
+    _confirm_rule("POSTROUTING", '-t', 'nat', '-s', FLAGS.fixed_range,
+                  '-d', FLAGS.fixed_range, '-j', 'ACCEPT')
 
 
 def bind_floating_ip(floating_ip, check_exit_code=True):
     """Bind ip to public interface"""
-    _execute("sudo ip addr add %s dev %s" % (floating_ip,
-                                             FLAGS.public_interface),
+    _execute('sudo', 'ip', 'addr', 'add', floating_ip,
+             'dev', FLAGS.public_interface),
              check_exit_code=check_exit_code)
 
 
 def unbind_floating_ip(floating_ip):
     """Unbind a public ip from public interface"""
-    _execute("sudo ip addr del %s dev %s" % (floating_ip,
-                                             FLAGS.public_interface))
+    _execute('sudo', 'ip', 'addr', 'del', floating_ip,
+             'dev', FLAGS.public_interface))
 
 
 def ensure_vlan_forward(public_ip, port, private_ip):
     """Sets up forwarding rules for vlan"""
-    _confirm_rule("FORWARD", "-d %s -p udp --dport 1194 -j ACCEPT" %
-                  private_ip)
-    _confirm_rule("PREROUTING",
-                  "-t nat -d %s -p udp --dport %s -j DNAT --to %s:1194"
-            % (public_ip, port, private_ip))
+    _confirm_rule("FORWARD", '-d', private_ip, '-p', 'udp',
+                  '--dport', '1194', '-j', 'ACCEPT')
+    _confirm_rule("PREROUTING", '-t', 'nat', '-d', public_ip, '-p', 'udp',
+                  '--dport', port, '-j', 'DNAT', '--to', '%s:1194'
+                  % private_ip)
 
 
 def ensure_floating_forward(floating_ip, fixed_ip):
     """Ensure floating ip forwarding rule"""
-    _confirm_rule("PREROUTING", "-t nat -d %s -j DNAT --to %s"
-                           % (floating_ip, fixed_ip))
-    _confirm_rule("OUTPUT", "-t nat -d %s -j DNAT --to %s"
-                           % (floating_ip, fixed_ip))
-    _confirm_rule("SNATTING", "-t nat -s %s -j SNAT --to %s"
-                           % (fixed_ip, floating_ip))
+    _confirm_rule("PREROUTING", '-t', 'nat', '-d', floating_ip, '-j', 'DNAT',
+                  '--to', fixed_ip)
+    _confirm_rule("OUTPUT", '-t', 'nat', '-d', floating_ip, '-j', 'DNAT',
+                  '--to', fixed_ip)
+    _confirm_rule("SNATTING", '-t', 'nat', '-s', fixed_ip, '-j', 'SNAT',
+                  '--to', floating_ip)
 
 
 def remove_floating_forward(floating_ip, fixed_ip):
     """Remove forwarding for floating ip"""
-    _remove_rule("PREROUTING", "-t nat -d %s -j DNAT --to %s"
-                          % (floating_ip, fixed_ip))
-    _remove_rule("OUTPUT", "-t nat -d %s -j DNAT --to %s"
-                          % (floating_ip, fixed_ip))
-    _remove_rule("SNATTING", "-t nat -s %s -j SNAT --to %s"
-                          % (fixed_ip, floating_ip))
+    _remove_rule("PREROUTING", '-t', 'nat', '-d', floating_ip, '-j', 'DNAT',
+                 '--to', fixed_ip)
+    _remove_rule("OUTPUT", '-t', 'nat', '-d', floating_ip, '-j', 'DNAT',
+                 '--to', fixed_ip)
+    _remove_rule("SNATTING", '-t', 'nat', '-s', fixed_ip, '-j', 'SNAT',
+                 '--to', floating_ip)
 
 
 def ensure_vlan_bridge(vlan_num, bridge, net_attrs=None):
@@ -185,9 +189,9 @@ def ensure_vlan(vlan_num):
     interface = "vlan%s" % vlan_num
     if not _device_exists(interface):
         LOG.debug(_("Starting VLAN inteface %s"), interface)
-        _execute("sudo vconfig set_name_type VLAN_PLUS_VID_NO_PAD")
-        _execute("sudo vconfig add %s %s" % (FLAGS.vlan_interface, vlan_num))
-        _execute("sudo ip link set %s up" % interface)
+        _execute('sudo', 'vconfig', 'set_name_type', 'VLAN_PLUS_VID_NO_PAD')
+        _execute('sudo', 'vconfig', 'add', FLAGS.vlan_interface, vlan_num)
+        _execute('sudo', 'ip', 'link', 'set', interface, 'up')
     return interface
 
 
@@ -206,52 +210,54 @@ def ensure_bridge(bridge, interface, net_attrs=None):
     """
     if not _device_exists(bridge):
         LOG.debug(_("Starting Bridge interface for %s"), interface)
-        _execute("sudo brctl addbr %s" % bridge)
-        _execute("sudo brctl setfd %s 0" % bridge)
+        _execute('sudo', 'brctl', 'addbr', bridge)
+        _execute('sudo', 'brctl', 'setfd', bridge, 0)
         # _execute("sudo brctl setageing %s 10" % bridge)
-        _execute("sudo brctl stp %s off" % bridge)
-        _execute("sudo ip link set %s up" % bridge)
+        _execute('sudo', 'brctl', 'stp', bridge', 'off')
+        _execute('sudo', 'ip', 'link', 'set', bridge, up)
     if net_attrs:
         # NOTE(vish): The ip for dnsmasq has to be the first address on the
         #             bridge for it to respond to reqests properly
         suffix = net_attrs['cidr'].rpartition('/')[2]
-        out, err = _execute("sudo ip addr add %s/%s brd %s dev %s" %
-                            (net_attrs['gateway'],
-                             suffix,
-                             net_attrs['broadcast'],
-                             bridge),
+        out, err = _execute('sudo', 'ip', 'addr', 'add',
+                            "%s/%s" % 
+                            (net_attrs['gateway'], suffix),
+                            'brd',
+                            net-attrs['broadcast'],
+                            'dev',
+                            bridge,
                             check_exit_code=False)
         if err and err != "RTNETLINK answers: File exists\n":
             raise exception.Error("Failed to add ip: %s" % err)
         if(FLAGS.use_ipv6):
-            _execute("sudo ip -f inet6 addr change %s dev %s" %
-                     (net_attrs['cidr_v6'], bridge))
+            _execute('sudo', 'ip', '-f', 'inet6', 'addr',
+                     'change', net_attrs['cidr_v6'],
+                     'dev', bridge)
         # NOTE(vish): If the public interface is the same as the
         #             bridge, then the bridge has to be in promiscuous
         #             to forward packets properly.
         if(FLAGS.public_interface == bridge):
-            _execute("sudo ip link set dev %s promisc on" % bridge)
+            _execute('sudo', 'ip', 'link', 'set', 'dev', bridge, 'promisc', 'on')
     if interface:
         # NOTE(vish): This will break if there is already an ip on the
         #             interface, so we move any ips to the bridge
         gateway = None
-        out, err = _execute("sudo route -n")
+        out, err = _execute('sudo', 'route', '-n')
         for line in out.split("\n"):
             fields = line.split()
             if fields and fields[0] == "0.0.0.0" and fields[-1] == interface:
                 gateway = fields[1]
-        out, err = _execute("sudo ip addr show dev %s scope global" %
-                            interface)
+        out, err = _execute('sudo', 'ip', 'addr', 'show', 'dev', interface,
+                            'scope', 'global')
         for line in out.split("\n"):
             fields = line.split()
             if fields and fields[0] == "inet":
                 params = ' '.join(fields[1:-1])
-                _execute("sudo ip addr del %s dev %s" % (params, fields[-1]))
-                _execute("sudo ip addr add %s dev %s" % (params, bridge))
+                _execute('sudo', 'ip', 'addr', 'del', params, 'dev', fields[-1])
+                _execute('sudo', 'ip', 'addr', 'add', params, 'dev', bridge)
         if gateway:
-            _execute("sudo route add 0.0.0.0 gw %s" % gateway)
-        out, err = _execute("sudo brctl addif %s %s" %
-                            (bridge, interface),
+            _execute('sudo', 'route', 'add', '0.0.0.0', 'gw', gateway)
+        out, err = _execute('sudo', 'brctl', 'addif, bridge, interface,
                             check_exit_code=False)
 
         if (err and err != "device %s is already a member of a bridge; can't "
@@ -259,18 +265,18 @@ def ensure_bridge(bridge, interface, net_attrs=None):
             raise exception.Error("Failed to add interface: %s" % err)
 
     if FLAGS.use_nova_chains:
-        (out, err) = _execute("sudo iptables -N nova_forward",
+        (out, err) = _execute('sudo', 'iptables', '-N', 'nova_forward,
                               check_exit_code=False)
         if err != 'iptables: Chain already exists.\n':
             # NOTE(vish): chain didn't exist link chain
-            _execute("sudo iptables -D FORWARD -j nova_forward",
+            _execute('sudo', 'iptables, '-D', 'FORWARD', '-j', 'nova_forward',
                      check_exit_code=False)
-            _execute("sudo iptables -A FORWARD -j nova_forward")
+            _execute('sudo', 'iptables', '-A', 'FORWARD', '-j', 'nova_forward')
 
-    _confirm_rule("FORWARD", "--in-interface %s -j ACCEPT" % bridge)
-    _confirm_rule("FORWARD", "--out-interface %s -j ACCEPT" % bridge)
-    _execute("sudo iptables -N nova-local", check_exit_code=False)
-    _confirm_rule("FORWARD", "-j nova-local")
+    _confirm_rule("FORWARD", '--in-interface', bridge, '-j', 'ACCEPT')
+    _confirm_rule("FORWARD", '--out-interface', bridge, '-j', 'ACCEPT')
+    _execute('sudo', 'iptables', '-N', 'nova-local', check_exit_code=False)
+    _confirm_rule("FORWARD", '-j', 'nova-local')
 
 
 def get_dhcp_hosts(context, network_id):
@@ -304,11 +310,11 @@ def update_dhcp(context, network_id):
 
     # if dnsmasq is already running, then tell it to reload
     if pid:
-        out, _err = _execute('cat /proc/%d/cmdline' % pid,
+        out, _err = _execute('cat', "/proc/%d/cmdline" % pid,
                              check_exit_code=False)
         if conffile in out:
             try:
-                _execute('sudo kill -HUP %d' % pid)
+                _execute('sudo', 'kill', '-HUP', pid)
                 return
             except Exception as exc:  # pylint: disable-msg=W0703
                 LOG.debug(_("Hupping dnsmasq threw %s"), exc)
@@ -349,11 +355,11 @@ interface %s
 
     # if radvd is already running, then tell it to reload
     if pid:
-        out, _err = _execute('cat /proc/%d/cmdline'
+        out, _err = _execute('cat', "/proc/%d/cmdline'
                              % pid, check_exit_code=False)
         if conffile in out:
             try:
-                _execute('sudo kill %d' % pid)
+                _execute('sudo', 'kill', pid)
             except Exception as exc:  # pylint: disable-msg=W0703
                 LOG.debug(_("killing radvd threw %s"), exc)
         else:
@@ -374,23 +380,23 @@ def _host_dhcp(fixed_ip_ref):
                                    fixed_ip_ref['address'])
 
 
-def _execute(cmd, *args, **kwargs):
+def _execute(*cmd, **kwargs):
     """Wrapper around utils._execute for fake_network"""
     if FLAGS.fake_network:
-        LOG.debug("FAKE NET: %s", cmd)
+        LOG.debug("FAKE NET: %s", ' '.join(cmd))
         return "fake", 0
     else:
-        return utils.execute(cmd, *args, **kwargs)
+        return utils.execute(*cmd, **kwargs)
 
 
 def _device_exists(device):
     """Check if ethernet device exists"""
-    (_out, err) = _execute("ip link show dev %s" % device,
+    (_out, err) = _execute('ip', 'link', 'show', 'dev', device,
                            check_exit_code=False)
     return not err
 
 
-def _confirm_rule(chain, cmd, append=False):
+def _confirm_rule(chain, *cmd, append=False):
     """Delete and re-add iptables rule"""
     if FLAGS.use_nova_chains:
         chain = "nova_%s" % chain.lower()
@@ -398,16 +404,16 @@ def _confirm_rule(chain, cmd, append=False):
         loc = "-A"
     else:
         loc = "-I"
-    _execute("sudo iptables --delete %s %s" % (chain, cmd),
+    _execute('sudo', 'iptables', '--delete', chain, *cmd,
              check_exit_code=False)
-    _execute("sudo iptables %s %s %s" % (loc, chain, cmd))
+    _execute('sudo', 'iptables', loc, chain, *cmd)
 
 
-def _remove_rule(chain, cmd):
+def _remove_rule(chain, *cmd):
     """Remove iptables rule"""
     if FLAGS.use_nova_chains:
         chain = "%s" % chain.lower()
-    _execute("sudo iptables --delete %s %s" % (chain, cmd))
+    _execute('sudo', 'iptables', '--delete', chain, *cmd)
 
 
 def _dnsmasq_cmd(net):
@@ -444,7 +450,7 @@ def _stop_dnsmasq(network):
 
     if pid:
         try:
-            _execute('sudo kill -TERM %d' % pid)
+            _execute('sudo', 'kill', '-TERM', pid)
         except Exception as exc:  # pylint: disable-msg=W0703
             LOG.debug(_("Killing dnsmasq threw %s"), exc)
 
diff --git a/nova/tests/test_network.py b/nova/tests/test_network.py
index ce1c77210..6d2d8b771 100644
--- a/nova/tests/test_network.py
+++ b/nova/tests/test_network.py
@@ -343,13 +343,13 @@ def lease_ip(private_ip):
                                           private_ip)
     instance_ref = db.fixed_ip_get_instance(context.get_admin_context(),
                                             private_ip)
-    cmd = "%s add %s %s fake" % (binpath('nova-dhcpbridge'),
-                                 instance_ref['mac_address'],
-                                 private_ip)
+    cmd = (binpath('nova-dhcpbridge'), 'add'
+           instance_ref['mac_address'],
+           private_ip, 'fake')
     env = {'DNSMASQ_INTERFACE': network_ref['bridge'],
            'TESTING': '1',
            'FLAGFILE': FLAGS.dhcpbridge_flagfile}
-    (out, err) = utils.execute(cmd, addl_env=env)
+    (out, err) = utils.execute(*cmd, addl_env=env)
     LOG.debug("ISSUE_IP: %s, %s ", out, err)
 
 
@@ -359,11 +359,11 @@ def release_ip(private_ip):
                                           private_ip)
     instance_ref = db.fixed_ip_get_instance(context.get_admin_context(),
                                             private_ip)
-    cmd = "%s del %s %s fake" % (binpath('nova-dhcpbridge'),
-                                 instance_ref['mac_address'],
-                                 private_ip)
+    cmd = (binpath('nova-dhcpbridge'), 'del',
+           instance_ref['mac_address'],
+           private_ip, 'fake')
     env = {'DNSMASQ_INTERFACE': network_ref['bridge'],
            'TESTING': '1',
            'FLAGFILE': FLAGS.dhcpbridge_flagfile}
-    (out, err) = utils.execute(cmd, addl_env=env)
+    (out, err) = utils.execute(*cmd, addl_env=env)
     LOG.debug("RELEASE_IP: %s, %s ", out, err)
diff --git a/nova/utils.py b/nova/utils.py
index 40a8d8d8c..c96b85294 100644
--- a/nova/utils.py
+++ b/nova/utils.py
@@ -125,15 +125,15 @@ def fetchfile(url, target):
 #    c.perform()
 #    c.close()
 #    fp.close()
-    execute("curl","--fail",url,"-o",target)
+    execute("curl", "--fail", url, "-o", target)
 
 
-def execute(cmd, process_input=None, addl_env=None, check_exit_code=True):
-    LOG.debug(_("Running cmd (subprocess): %s"), cmd)
+def execute(*cmd, process_input=None, addl_env=None, check_exit_code=True):
+    LOG.debug(_("Running cmd (subprocess): %s"), ' '.join(cmd))
     env = os.environ.copy()
     if addl_env:
         env.update(addl_env)
-    obj = subprocess.Popen(cmd, stdin=subprocess.PIPE,
+    obj = subprocess.Popen(*cmd, stdin=subprocess.PIPE,
         stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=env)
     result = None
     if process_input != None:
@@ -148,7 +148,7 @@ def execute(cmd, process_input=None, addl_env=None, check_exit_code=True):
             raise ProcessExecutionError(exit_code=obj.returncode,
                                         stdout=stdout,
                                         stderr=stderr,
-                                        cmd=cmd)
+                                        cmd=' '.join(cmd))
     # NOTE(termie): this appears to be necessary to let the subprocess call
     #               clean something up in between calls, without it two
     #               execute calls in a row hangs the second one
@@ -158,7 +158,7 @@ def execute(cmd, process_input=None, addl_env=None, check_exit_code=True):
 
 def ssh_execute(ssh, cmd, process_input=None,
                 addl_env=None, check_exit_code=True):
-    LOG.debug(_("Running cmd (SSH): %s"), cmd)
+    LOG.debug(_("Running cmd (SSH): %s"), ' '.join(cmd))
     if addl_env:
         raise exception.Error("Environment not supported over SSH")
 
@@ -187,7 +187,7 @@ def ssh_execute(ssh, cmd, process_input=None,
             raise exception.ProcessExecutionError(exit_code=exit_status,
                                                   stdout=stdout,
                                                   stderr=stderr,
-                                                  cmd=cmd)
+                                                  cmd=' '.join(cmd))
 
     return (stdout, stderr)
 
@@ -254,7 +254,7 @@ def last_octet(address):
 
 def  get_my_linklocal(interface):
     try:
-        if_str = execute("ip","-f","inet6","-o","addr","show", interface)
+        if_str = execute("ip", "-f", "inet6", "-o", "addr", "show", interface)
         condition = "\s+inet6\s+([0-9a-f:]+)/\d+\s+scope\s+link"
         links = [re.search(condition, x) for x in if_str[0].split('\n')]
         address = [w.group(1) for w in links if w is not None]
diff --git a/nova/virt/disk.py b/nova/virt/disk.py
index 2bded07a4..203517275 100644
--- a/nova/virt/disk.py
+++ b/nova/virt/disk.py
@@ -49,10 +49,10 @@ def extend(image, size):
     file_size = os.path.getsize(image)
     if file_size >= size:
         return
-    utils.execute('truncate -s %s %s' % (size, image))
+    utils.execute('truncate', '-s', size, image)
     # NOTE(vish): attempts to resize filesystem
-    utils.execute('e2fsck -fp %s' % image, check_exit_code=False)
-    utils.execute('resize2fs %s' % image, check_exit_code=False)
+    utils.execute('e2fsck', '-fp', mage, check_exit_code=False)
+    utils.execute('resize2fs', image, check_exit_code=False)
 
 
 def inject_data(image, key=None, net=None, partition=None, nbd=False):
@@ -68,7 +68,7 @@ def inject_data(image, key=None, net=None, partition=None, nbd=False):
     try:
         if not partition is None:
             # create partition
-            out, err = utils.execute('sudo kpartx -a %s' % device)
+            out, err = utils.execute('sudo', 'kpartx', '-a', device)
             if err:
                 raise exception.Error(_('Failed to load partition: %s') % err)
             mapped_device = '/dev/mapper/%sp%s' % (device.split('/')[-1],
@@ -84,13 +84,14 @@ def inject_data(image, key=None, net=None, partition=None, nbd=False):
                                   mapped_device)
 
         # Configure ext2fs so that it doesn't auto-check every N boots
-        out, err = utils.execute('sudo tune2fs -c 0 -i 0 %s' % mapped_device)
+        out, err = utils.execute('sudo', 'tune2fs',
+                                 '-c', 0, '-i', 0, mapped_device)
 
         tmpdir = tempfile.mkdtemp()
         try:
             # mount loopback to dir
             out, err = utils.execute(
-                    'sudo mount %s %s' % (mapped_device, tmpdir))
+                    'sudo', 'mount', mapped_device, tmpdir)
             if err:
                 raise exception.Error(_('Failed to mount filesystem: %s')
                                       % err)
@@ -103,13 +104,13 @@ def inject_data(image, key=None, net=None, partition=None, nbd=False):
                     _inject_net_into_fs(net, tmpdir)
             finally:
                 # unmount device
-                utils.execute('sudo umount %s' % mapped_device)
+                utils.execute('sudo', 'umount', mapped_device)
         finally:
             # remove temporary directory
-            utils.execute('rmdir %s' % tmpdir)
+            utils.execute('rmdir', tmpdir)
             if not partition is None:
                 # remove partitions
-                utils.execute('sudo kpartx -d %s' % device)
+                utils.execute('sudo', 'kpartx', '-d', device)
     finally:
         _unlink_device(device, nbd)
 
@@ -118,7 +119,7 @@ def _link_device(image, nbd):
     """Link image to device using loopback or nbd"""
     if nbd:
         device = _allocate_device()
-        utils.execute('sudo qemu-nbd -c %s %s' % (device, image))
+        utils.execute('sudo', 'qemu-nbd', '-c', device, image)
         # NOTE(vish): this forks into another process, so give it a chance
         #             to set up before continuuing
         for i in xrange(FLAGS.timeout_nbd):
@@ -127,7 +128,7 @@ def _link_device(image, nbd):
             time.sleep(1)
         raise exception.Error(_('nbd device %s did not show up') % device)
     else:
-        out, err = utils.execute('sudo losetup --find --show %s' % image)
+        out, err = utils.execute('sudo', 'losetup', '--find', '--show', image)
         if err:
             raise exception.Error(_('Could not attach image to loopback: %s')
                                   % err)
@@ -137,10 +138,10 @@ def _link_device(image, nbd):
 def _unlink_device(device, nbd):
     """Unlink image from device using loopback or nbd"""
     if nbd:
-        utils.execute('sudo qemu-nbd -d %s' % device)
+        utils.execute('sudo', 'qemu-nbd', '-d', device)
         _free_device(device)
     else:
-        utils.execute('sudo losetup --detach %s' % device)
+        utils.execute('sudo', 'losetup', '--detach', device)
 
 
 _DEVICES = ['/dev/nbd%s' % i for i in xrange(FLAGS.max_nbd_devices)]
@@ -170,11 +171,12 @@ def _inject_key_into_fs(key, fs):
     fs is the path to the base of the filesystem into which to inject the key.
     """
     sshdir = os.path.join(fs, 'root', '.ssh')
-    utils.execute('sudo mkdir -p %s' % sshdir)  # existing dir doesn't matter
-    utils.execute('sudo chown root %s' % sshdir)
-    utils.execute('sudo chmod 700 %s' % sshdir)
+    utils.execute('sudo', 'mkdir', '-p', sshdir)  # existing dir doesn't matter
+    utils.execute('sudo', 'chown', 'root', sshdir)
+    utils.execute('sudo', 'chmod', '700', sshdir)
     keyfile = os.path.join(sshdir, 'authorized_keys')
-    utils.execute('sudo tee -a %s' % keyfile, '\n' + key.strip() + '\n')
+    # TODO:EWINDISCH: not sure about the following /w execv patch
+    utils.execute('sudo', 'tee', '-a', keyfile, '\n' + key.strip() + '\n')
 
 
 def _inject_net_into_fs(net, fs):
@@ -183,8 +185,8 @@ def _inject_net_into_fs(net, fs):
     net is the contents of /etc/network/interfaces.
     """
     netdir = os.path.join(os.path.join(fs, 'etc'), 'network')
-    utils.execute('sudo mkdir -p %s' % netdir)  # existing dir doesn't matter
-    utils.execute('sudo chown root:root %s' % netdir)
-    utils.execute('sudo chmod 755 %s' % netdir)
+    utils.execute('sudo', 'mkdir', '-p', netdir)  # existing dir doesn't matter
+    utils.execute('sudo', 'chown', 'root:root', netdir)
+    utils.execute('sudo', 'chmod', 755, netdir)
     netfile = os.path.join(netdir, 'interfaces')
-    utils.execute('sudo tee %s' % netfile, net)
+    utils.execute('sudo', 'tee', netfile, net)
diff --git a/nova/virt/images.py b/nova/virt/images.py
index 7a6fef330..4b11d1667 100644
--- a/nova/virt/images.py
+++ b/nova/virt/images.py
@@ -94,8 +94,7 @@ def _fetch_s3_image(image, path, user, project):
             cmd += ['-H', '\'%s: %s\'' % (k, v)]
 
         cmd += ['-o', path]
-        cmd_out = ' '.join(cmd)
-        return utils.execute(cmd_out)
+        return utils.execute(*cmd)
 
 
 def _fetch_local_image(image, path, user, project):
@@ -103,7 +102,7 @@ def _fetch_local_image(image, path, user, project):
     if sys.platform.startswith('win'):
         return shutil.copy(source, path)
     else:
-        return utils.execute('cp %s %s' % (source, path))
+        return utils.execute('cp', source, path)
 
 
 def _image_path(path):
diff --git a/nova/virt/libvirt_conn.py b/nova/virt/libvirt_conn.py
index 4e0fd106f..464ec475c 100644
--- a/nova/virt/libvirt_conn.py
+++ b/nova/virt/libvirt_conn.py
@@ -438,8 +438,10 @@ class LibvirtConnection(object):
 
         if virsh_output.startswith('/dev/'):
             LOG.info(_("cool, it's a device"))
-            out, err = utils.execute("sudo dd if=%s iflag=nonblock" %
-                                     virsh_output, check_exit_code=False)
+            out, err = utils.execute('sudo', 'dd',
+                                     "if=%s" % virsh_output,
+                                     'iflag=nonblock',
+                                     check_exit_code=False)
             return out
         else:
             return ''
@@ -461,11 +463,11 @@ class LibvirtConnection(object):
         console_log = os.path.join(FLAGS.instances_path, instance['name'],
                                    'console.log')
 
-        utils.execute('sudo chown %d %s' % (os.getuid(), console_log))
+        utils.execute('sudo', 'chown', s.getuid(), console_log)
 
         if FLAGS.libvirt_type == 'xen':
             # Xen is special
-            virsh_output = utils.execute("virsh ttyconsole %s" %
+            virsh_output = utils.execute('virsh', 'ttyconsole',
                                          instance['name'])
             data = self._flush_xen_console(virsh_output)
             fpath = self._append_to_file(data, console_log)
@@ -482,7 +484,10 @@ class LibvirtConnection(object):
                 port = random.randint(int(start_port), int(end_port))
                 # netcat will exit with 0 only if the port is in use,
                 # so a nonzero return value implies it is unused
-                cmd = 'netcat 0.0.0.0 %s -w 1 </dev/null || echo free' % (port)
+
+                # TODO:ewindisch: subprocess lets us do this...
+                # but utils.execute abstracts it away from us
+                cmd = 'netcat', '0.0.0.0', port, '-w', '1', '</dev/null || echo free' % (port)
                 stdout, stderr = utils.execute(cmd)
                 if stdout.strip() == 'free':
                     return port
@@ -533,11 +538,11 @@ class LibvirtConnection(object):
             if not os.path.exists(base):
                 fn(target=base, *args, **kwargs)
             if cow:
-                utils.execute('qemu-img create -f qcow2 -o '
-                              'cluster_size=2M,backing_file=%s %s'
-                              % (base, target))
+                utils.execute('qemu-img', 'create', '-f', 'qcow2', "'-o'',
+                              "cluster_size=2M,backing_file=%s" % base,
+                              target)
             else:
-                utils.execute('cp %s %s' % (base, target))
+                utils.execute('cp', base, target)
 
     def _fetch_image(self, target, image_id, user, project, size=None):
         """Grab image and optionally attempt to resize it"""
@@ -547,7 +552,7 @@ class LibvirtConnection(object):
 
     def _create_local(self, target, local_gb):
         """Create a blank image of specified size"""
-        utils.execute('truncate %s -s %dG' % (target, local_gb))
+        utils.execute('truncate', target, '-s', "%dG" local_gb)
         # TODO(vish): should we format disk by default?
 
     def _create_image(self, inst, libvirt_xml, suffix='', disk_images=None):
@@ -558,7 +563,7 @@ class LibvirtConnection(object):
                                 fname + suffix)
 
         # ensure directories exist and are writable
-        utils.execute('mkdir -p %s' % basepath(suffix=''))
+        utils.execute('mkdir', '-p', basepath(suffix='')
 
         LOG.info(_('instance %s: Creating image'), inst['name'])
         f = open(basepath('libvirt.xml'), 'w')
@@ -658,7 +663,7 @@ class LibvirtConnection(object):
                         ' data into image %(img_id)s (%(e)s)') % locals())
 
         if FLAGS.libvirt_type == 'uml':
-            utils.execute('sudo chown root %s' % basepath('disk'))
+            utils.execute('sudo', 'chown', 'root', basepath('disk'))
 
     def to_xml(self, instance, rescue=False):
         # TODO(termie): cache?
@@ -1240,13 +1245,14 @@ class IptablesFirewallDriver(FirewallDriver):
         current_filter, _ = self.execute('sudo iptables-save -t filter')
         current_lines = current_filter.split('\n')
         new_filter = self.modify_rules(current_lines, 4)
-        self.execute('sudo iptables-restore',
+        self.execute('sudo', 'iptables-restore',
                      process_input='\n'.join(new_filter))
         if(FLAGS.use_ipv6):
-            current_filter, _ = self.execute('sudo ip6tables-save -t filter')
+            current_filter, _ = self.execute('sudo', 'ip6tables-save',
+                                             '-t', 'filter')
             current_lines = current_filter.split('\n')
             new_filter = self.modify_rules(current_lines, 6)
-            self.execute('sudo ip6tables-restore',
+            self.execute('sudo', 'ip6tables-restore',
                          process_input='\n'.join(new_filter))
 
     def modify_rules(self, current_lines, ip_version=4):
diff --git a/nova/virt/xenapi/vm_utils.py b/nova/virt/xenapi/vm_utils.py
index 564a25057..873dfce5e 100644
--- a/nova/virt/xenapi/vm_utils.py
+++ b/nova/virt/xenapi/vm_utils.py
@@ -736,13 +736,14 @@ def _write_partition(virtual_size, dev):
     LOG.debug(_('Writing partition table %(primary_first)d %(primary_last)d'
             ' to %(dest)s...') % locals())
 
-    def execute(cmd, process_input=None, check_exit_code=True):
-        return utils.execute(cmd=cmd,
+    def execute(*cmd, process_input=None, check_exit_code=True):
+        return utils.execute(*cmd,
                              process_input=process_input,
                              check_exit_code=check_exit_code)
 
-    execute('parted --script %s mklabel msdos' % dest)
-    execute('parted --script %s mkpart primary %ds %ds' %
-            (dest, primary_first, primary_last))
+    execute('parted', '--script', dest, 'mklabel', 'msdos')
+    execute('parted', '--script', dest, 'mkpart', 'primary',
+            '%ds' % primary_first,
+            '%ds' % primary_last)
 
     LOG.debug(_('Writing partition table %s done.'), dest)
diff --git a/nova/volume/driver.py b/nova/volume/driver.py
index e73202b73..220c9ef9d 100644
--- a/nova/volume/driver.py
+++ b/nova/volume/driver.py
@@ -65,14 +65,14 @@ class VolumeDriver(object):
         self._execute = execute
         self._sync_exec = sync_exec
 
-    def _try_execute(self, command):
+    def _try_execute(self, *command):
         # NOTE(vish): Volume commands can partially fail due to timing, but
         #             running them a second time on failure will usually
         #             recover nicely.
         tries = 0
         while True:
             try:
-                self._execute(command)
+                self._execute(*command)
                 return True
             except exception.ProcessExecutionError:
                 tries = tries + 1
@@ -84,7 +84,7 @@ class VolumeDriver(object):
 
     def check_for_setup_error(self):
         """Returns an error if prerequisites aren't met"""
-        out, err = self._execute("sudo vgs --noheadings -o name")
+        out, err = self._execute('sudo', 'vgs', '--noheadings', '-o', 'name')
         volume_groups = out.split()
         if not FLAGS.volume_group in volume_groups:
             raise exception.Error(_("volume group %s doesn't exist")
@@ -97,21 +97,21 @@ class VolumeDriver(object):
             sizestr = '100M'
         else:
             sizestr = '%sG' % volume['size']
-        self._try_execute('sudo','lvcreate','-L',sizestr,'-n',
+        self._try_execute('sudo', 'lvcreate', '-L', sizestr, '-n',
                            volume['name'],
                            FLAGS.volume_group)
 
     def delete_volume(self, volume):
         """Deletes a logical volume."""
         try:
-            self._try_execute('sudo','lvdisplay','%s/%s" %
+            self._try_execute('sudo', 'lvdisplay', '%s/%s" %
                               (FLAGS.volume_group,
                                volume['name']))
         except Exception as e:
             # If the volume isn't present, then don't attempt to delete
             return True
 
-        self._try_execute('sudo','lvremove','-f',"%s/%s" %
+        self._try_execute('sudo', 'lvremove', '-f',"%s/%s" %
                           (FLAGS.volume_group,
                            volume['name']))
 
@@ -167,7 +167,7 @@ class AOEDriver(VolumeDriver):
          blade_id) = self.db.volume_allocate_shelf_and_blade(context,
                                                              volume['id'])
         self._try_execute(
-                'sudo','vblade-persist','setup',
+                'sudo', 'vblade-persist', 'setup',
                  shelf_id,
                  blade_id,
                  FLAGS.aoe_eth_dev,
@@ -182,9 +182,9 @@ class AOEDriver(VolumeDriver):
         #             just wait a bit for the current volume to
         #             be ready and ignore any errors.
         time.sleep(2)
-        self._execute('sudo','vblade-persist','auto','all',
+        self._execute('sudo', 'vblade-persist', 'auto', 'all',
                       check_exit_code=False)
-        self._execute('sudo','vblade-persist','start','all',
+        self._execute('sudo', 'vblade-persist', 'start', 'all',
                       check_exit_code=False)
 
     def remove_export(self, context, volume):
@@ -192,15 +192,15 @@ class AOEDriver(VolumeDriver):
         (shelf_id,
          blade_id) = self.db.volume_get_shelf_and_blade(context,
                                                         volume['id'])
-        self._try_execute('sudo','vblade-persist','stop',
+        self._try_execute('sudo', 'vblade-persist', 'stop',
                           shelf_id, blade_id)
-        self._try_execute('sudo','vblade-persist','destroy',
+        self._try_execute('sudo', 'vblade-persist', 'destroy',
                           shelf_id, blade_id)
 
     def discover_volume(self, _volume):
         """Discover volume on a remote host."""
-        self._execute('sudo','aoe-discover')
-        self._execute('sudo','aoe-stat', check_exit_code=False)
+        self._execute('sudo', 'aoe-discover')
+        self._execute('sudo', 'aoe-stat', check_exit_code=False)
 
     def undiscover_volume(self, _volume):
         """Undiscover volume on a remote host."""
@@ -252,12 +252,12 @@ class ISCSIDriver(VolumeDriver):
 
         iscsi_name = "%s%s" % (FLAGS.iscsi_target_prefix, volume['name'])
         volume_path = "/dev/%s/%s" % (FLAGS.volume_group, volume['name'])
-        self._sync_exec('sudo','ietadm','--op','new',
+        self._sync_exec('sudo', 'ietadm', '--op', 'new',
                         "--tid=%s" % iscsi_target,
                         '--params',
                         "Name=%s" % iscsi-name,
                         check_exit_code=False)
-        self._sync_exec('sudo','ietadm','--op','new',
+        self._sync_exec('sudo', 'ietadm', '--op', 'new',
                         "--tid=%s" % iscsi_target,
                         '--lun=0',
                         '--params',
@@ -282,12 +282,13 @@ class ISCSIDriver(VolumeDriver):
                                                       volume['host'])
         iscsi_name = "%s%s" % (FLAGS.iscsi_target_prefix, volume['name'])
         volume_path = "/dev/%s/%s" % (FLAGS.volume_group, volume['name'])
-        self._execute("sudo ietadm --op new "
-                      "--tid=%s --params Name=%s" %
+        self._execute('sudo', 'ietadm', '--op', 'new',
+                      '--tid=%s --params Name=%s' %
                       (iscsi_target, iscsi_name))
-        self._execute("sudo ietadm --op new --tid=%s "
-                      "--lun=0 --params Path=%s,Type=fileio" %
-                      (iscsi_target, volume_path))
+        self._execute('sudo', 'ietadm', '--op', 'new',
+                      '--tid=%s' % iscsi_target,
+                      '--lun=0', '--params',
+                      'Path=%s,Type=fileio' % volume_path)
 
     def remove_export(self, context, volume):
         """Removes an export for a logical volume."""
@@ -302,16 +303,18 @@ class ISCSIDriver(VolumeDriver):
         try:
             # ietadm show will exit with an error
             # this export has already been removed
-            self._execute("sudo ietadm --op show --tid=%s " % iscsi_target)
+            self._execute('sudo', 'ietadm', '--op', 'show',
+                          '--tid=%s' % iscsi_target)
         except Exception as e:
             LOG.info(_("Skipping remove_export. No iscsi_target " +
                        "is presently exported for volume: %d"), volume['id'])
             return
 
-        self._execute("sudo ietadm --op delete --tid=%s "
-                      "--lun=0" % iscsi_target)
-        self._execute("sudo ietadm --op delete --tid=%s" %
-                      iscsi_target)
+        self._execute('sudo', 'ietadm', '--op', 'delete',
+                      '--tid=%s' % iscsi_target,
+                      '--lun=0')
+        self._execute('sudo', 'ietadm', '--op', 'delete',
+                      '--tid=%s' % iscsi_target)
 
     def _do_iscsi_discovery(self, volume):
         #TODO(justinsb): Deprecate discovery and use stored info
@@ -320,8 +323,8 @@ class ISCSIDriver(VolumeDriver):
 
         volume_name = volume['name']
 
-        (out, _err) = self._execute("sudo iscsiadm -m discovery -t "
-                                    "sendtargets -p %s" % (volume['host']))
+        (out, _err) = self._execute('sudo', 'iscsiadm', '-m', 'discovery',
+                                    '-t', 'sendtargets', '-p', volume['host'])
         for target in out.splitlines():
             if FLAGS.iscsi_ip_prefix in target and volume_name in target:
                 return target
@@ -481,7 +484,7 @@ class RBDDriver(VolumeDriver):
 
     def check_for_setup_error(self):
         """Returns an error if prerequisites aren't met"""
-        (stdout, stderr) = self._execute("rados lspools")
+        (stdout, stderr) = self._execute('rados', 'lspools')
         pools = stdout.split("\n")
         if not FLAGS.rbd_pool in pools:
             raise exception.Error(_("rbd has no pool %s") %
@@ -493,12 +496,12 @@ class RBDDriver(VolumeDriver):
             size = 100
         else:
             size = int(volume['size']) * 1024
-        self._try_execute('rbd','--pool',FLAGS.rbd_pool,
-                          '--size', size,'create', volume['name'])
+        self._try_execute('rbd', '--pool', FLAGS.rbd_pool,
+                          '--size', size, 'create', volume['name'])
 
     def delete_volume(self, volume):
         """Deletes a logical volume."""
-        self._try_execute('rbd','--pool',FLAGS.rbd_pool,
+        self._try_execute('rbd', '--pool', FLAGS.rbd_pool,
                           'rm', voluname['name'])
 
     def local_path(self, volume):
@@ -534,7 +537,7 @@ class SheepdogDriver(VolumeDriver):
     def check_for_setup_error(self):
         """Returns an error if prerequisites aren't met"""
         try:
-            (out, err) = self._execute('collie','cluster','info')
+            (out, err) = self._execute('collie', 'cluster', 'info')
             if not out.startswith('running'):
                 raise exception.Error(_("Sheepdog is not working: %s") % out)
         except exception.ProcessExecutionError:
@@ -546,13 +549,13 @@ class SheepdogDriver(VolumeDriver):
             sizestr = '100M'
         else:
             sizestr = '%sG' % volume['size']
-        self._try_execute('qemu-img','create',
+        self._try_execute('qemu-img', 'create',
                           "sheepdog:%s" %s" % volume['name'],
                           sizestr)
 
     def delete_volume(self, volume):
         """Deletes a logical volume"""
-        self._try_execute('collie','vdi','delete',volume['name'])
+        self._try_execute('collie', 'vdi', 'delete', volume['name'])
 
     def local_path(self, volume):
         return "sheepdog:%s" % volume['name']
diff --git a/plugins/xenserver/networking/etc/xensource/scripts/vif_rules.py b/plugins/xenserver/networking/etc/xensource/scripts/vif_rules.py
index d60816ce7..2c34f7b1d 100755
--- a/plugins/xenserver/networking/etc/xensource/scripts/vif_rules.py
+++ b/plugins/xenserver/networking/etc/xensource/scripts/vif_rules.py
@@ -30,13 +30,14 @@ import simplejson as json
 
 
 def main(dom_id, command, only_this_vif=None):
-    xsls = execute("/usr/bin/xenstore-ls /local/domain/%s/vm-data/networking" \
-                  % dom_id, True)
+    xsls = execute('/usr/bin/xenstore-ls',
+                   '/local/domain/%s/vm-data/networking' % dom_id, True)
     macs = [line.split("=")[0].strip() for line in xsls.splitlines()]
 
     for mac in macs:
-        xsr = "/usr/bin/xenstore-read /local/domain/%s/vm-data/networking/%s"
-        xsread = execute(xsr % (dom_id, mac), True)
+        xsread = execute('/usr/bin/enstore-read',
+                         '/local/domain/%s/vm-data/networking/%s' %
+                         (dom_id, mac), True)
         data = json.loads(xsread)
         for ip in data['ips']:
             if data["label"] == "public":
@@ -53,7 +54,7 @@ def main(dom_id, command, only_this_vif=None):
 
 def execute(command, return_stdout=False):
     devnull = open(os.devnull, 'w')
-    proc = subprocess.Popen(command, shell=True, close_fds=True,
+    proc = subprocess.Popen(command, close_fds=True,
                             stdout=subprocess.PIPE, stderr=devnull)
     devnull.close()
     if return_stdout:
@@ -67,45 +68,69 @@ def execute(command, return_stdout=False):
 
 
 def apply_iptables_rules(command, params):
-    iptables = lambda rule: execute("/sbin/iptables %s" % rule)
+    iptables = lambda *rule: execute('/sbin/iptables', *rule)
 
-    iptables("-D FORWARD -m physdev --physdev-in %(VIF)s -s %(IP)s \
-              -j ACCEPT" % params)
+    iptables('-D', 'FORWARD', '-m', 'physdev',
+             '--physdev-in', '%(VIF)s' % params,
+             '-s', '%(IP)s' % params,
+             '-j', 'ACCEPT')
     if command == 'online':
-        iptables("-A FORWARD -m physdev --physdev-in %(VIF)s -s %(IP)s \
-                  -j ACCEPT" % params)
+        iptables('-A', 'FORWARD', '-m', 'physdev',
+                 '--physdev-in', '%(VIF)s' % params,
+                 '-s', '%(IP)s' % params,
+                 '-j', 'ACCEPT')
 
 
 def apply_arptables_rules(command, params):
-    arptables = lambda rule: execute("/sbin/arptables %s" % rule)
-
-    arptables("-D FORWARD --opcode Request --in-interface %(VIF)s \
-               --source-ip %(IP)s --source-mac %(MAC)s -j ACCEPT" % params)
-    arptables("-D FORWARD --opcode Reply --in-interface %(VIF)s \
-               --source-ip %(IP)s --source-mac %(MAC)s -j ACCEPT" % params)
+    arptables = lambda *rule: execute('/sbin/arptables', *rule)
+
+    arptables('-D', 'FORWARD', '--opcode', 'Request',
+              '--in-interface', '%(VIF)s' % params,
+              '--source-ip', '%(IP)s' % params,
+              '--source-mac', '%(MAC)s' % params,
+              '-j', 'ACCEPT')
+    arptables('-D', 'FORWARD', '--opcode', 'Reply',
+              '--in-interface', '%(VIF)s' % params,
+              '--source-ip', '%(IP)s' % params,
+              '--source-mac', '%(MAC)s' % params,
+              '-j', 'ACCEPT')
     if command == 'online':
-        arptables("-A FORWARD --opcode Request --in-interface %(VIF)s \
-                  --source-ip %(IP)s --source-mac %(MAC)s -j ACCEPT" % params)
-        arptables("-A FORWARD --opcode Reply --in-interface %(VIF)s \
-                  --source-ip %(IP)s --source-mac %(MAC)s -j ACCEPT" % params)
+        arptables('-A', 'FORWARD', '--opcode', 'Request',
+                  '--in-interface', '%(VIF)s' % params
+                  '--source-ip', '%(IP)s' % params,
+                  '--source-mac', '%(MAC)s' % params,
+                  '-j', 'ACCEPT')
+        arptables('-A', 'FORWARD', '--opcode', 'Reply',
+                  '--in-interface', '%(VIF)s' % params,
+                  '--source-ip', '%(IP)s' % params,
+                  '--source-mac', '%(MAC)s' % params,
+                  '-j', 'ACCEPT')
 
 
 def apply_ebtables_rules(command, params):
-    ebtables = lambda rule: execute("/sbin/ebtables %s" % rule)
-
-    ebtables("-D FORWARD -p 0806 -o %(VIF)s --arp-ip-dst %(IP)s -j ACCEPT" %
-             params)
-    ebtables("-D FORWARD -p 0800 -o %(VIF)s --ip-dst %(IP)s -j ACCEPT" %
-             params)
+    ebtables = lambda *rule: execute("/sbin/ebtables", *rule)
+
+    ebtables('-D', 'FORWARD', '-p', '0806', '-o', '%(VIF)s' % params,
+             '--arp-ip-dst', '%(IP)s' % params,
+             '-j', 'ACCEPT')
+    ebtables('-D', 'FORWARD', '-p', '0800', '-o',
+             '%(VIF)s' % params, '--ip-dst', '%(IP)s' % params,
+             '-j', 'ACCEPT')
     if command == 'online':
-        ebtables("-A FORWARD -p 0806 -o %(VIF)s --arp-ip-dst %(IP)s \
-                  -j ACCEPT" % params)
-        ebtables("-A FORWARD -p 0800 -o %(VIF)s --ip-dst %(IP)s \
-                  -j ACCEPT" % params)
-
-    ebtables("-D FORWARD -s ! %(MAC)s -i %(VIF)s -j DROP" % params)
+        ebtables('-A', 'FORWARD', '-p', '0806',
+                 '-o', '%(VIF)s' % params
+                 '--arp-ip-dst', '%(IP)s' % params,
+                 '-j', 'ACCEPT')
+        ebtables('-A', 'FORWARD', '-p', '0800',
+                 '-o', '%(VIF)s' % params,
+                 '--ip-dst', '%(IP)s' % params,
+                 '-j', 'ACCEPT')
+
+    ebtables('-D', 'FORWARD', '-s', '!', '%(MAC)s' % params,
+             '-i', '%(VIF)s' % params, '-j', 'DROP')
     if command == 'online':
-        ebtables("-I FORWARD 1 -s ! %(MAC)s -i %(VIF)s -j DROP" % params)
+        ebtables('-I', 'FORWARD', '1', '-s', '!', '%(MAC)s' % params,
+                 '-i', '%(VIF)s', '-j', 'DROP')
 
 
 if __name__ == "__main__":