{
    local %ENV = (
        PATH => '/bin:/usr/bin:/usr/local/bin",
        IFS  => " \t\n",
        LOGNAME => $ENV{LOGNAME}, # propagate values known to be secure
        ...
    }
    ...
    system( ... )
}