Since these functions run shell commands, which is a common vector for security-related bugs (see
* http://cwe.mitre.org/data/definitions/78.html
* http://cwe.mitre.org/data/definitions/88.html
), I suggest that they should have security warning boxes analogous to the one for the `subprocess` module:
https://docs.python.org/2/library/subprocess.html#frequently-used-arguments

Here is a patch that adds the necessary warnings from issue 7950.
Please review it when you get a chance.

Left a comment in Rietveld.

After discussion in Rietveld, the patch looks good to me.

Since Raymond is the person who tends to object most strongly to warning boxes in the docs, let's get his opinion on this.  I'm not sure that the warning box is necessary, the text may be sufficient.  On the other hand, this *is* a significant insecurity vector.

As far as the text goes, I'd combine the two paragraphs and introduce the text from the second one with "Alternatively, ...".  And if it isn't a warning box, the the language should be refocused to be positive: "Use the Popen module with shell=False to avoid the common security issues involved in using unsanitized input from untrusted sources..."

Python 3.5 doc has no red warning in the subprocess module, but a nice section:
https://docs.python.org/dev/library/subprocess.html#security-considerations

Why not simply copying the note of the subprocess doc?
"Note: Read the Security Considerations section before using shell=True."

subprocess.getstatusoutput(cmd) needs also this note (or warning).