I want to call an rpm command with flags, from my C++ code and get the output, but I don't want to use shell in the process.
I think about using popen, but saw it uses shell to execute command which I don't want. I can use the pipe\fork\exec long method, but I want to read line by line and not sure how to do it with it, so I thought of using popen() instead if it's possible to exec with it without a middle shell.
My question is if there is a way to use popen() without it calling the shell and just invoke the binary provided itself with it's flag (for example /usr/bin/rpm -qa)? or I will have to go with the long route?
The only two options here are, indeed, either to use popen, or pipe+fork+exec. These are the only options on Linux for running a program and capturing its output. That's it, there are no other possibilities. All system and C library calls on Linux have publicly available documentation, and there's nothing else.
It's theoretically possible for a popen implementation to parse the command and determine whether it contains any shell wildcards or special characters; if not then split it into words and exec the resulting program. Whether or not popen does that can be determined by running a simple test for this under strace with the -f flag, and seeing what actually gets executed by the spawned child process.
But even if you discover, yourself, that your current glibc does this, this not a guarantee, of course, that it will always work this way in the future.