It might be safer to use an rsync lib that calls librsync or at least wraps the calls for you. I'm always suspicious of sub-shelling