From 27071960669a6ff05fb56237c1baeb0afa89db79 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Thu, 3 Sep 2026 07:39:46 -0400 Subject: [PATCH] import CS dracut-057-126.git20260813.el9 --- SOURCES/0111.patch | 65 +++++++++++++++ SOURCES/0112.patch | 30 +++++++ SOURCES/0113.patch | 185 +++++++++++++++++++++++++++++++++++++++++ SOURCES/0114.patch | 97 ++++++++++++++++++++++ SOURCES/0115.patch | 46 +++++++++++ SOURCES/0116.patch | 71 ++++++++++++++++ SOURCES/0117.patch | 47 +++++++++++ SOURCES/0120.patch | 168 +++++++++++++++++++++++++++++++++++++ SOURCES/0121.patch | 43 ++++++++++ SOURCES/0122.patch | 60 ++++++++++++++ SOURCES/0123.patch | 200 +++++++++++++++++++++++++++++++++++++++++++++ SOURCES/0124.patch | 83 +++++++++++++++++++ SOURCES/0125.patch | 26 ++++++ SPECS/dracut.spec | 32 +++++++- 14 files changed, 1152 insertions(+), 1 deletion(-) create mode 100644 SOURCES/0111.patch create mode 100644 SOURCES/0112.patch create mode 100644 SOURCES/0113.patch create mode 100644 SOURCES/0114.patch create mode 100644 SOURCES/0115.patch create mode 100644 SOURCES/0116.patch create mode 100644 SOURCES/0117.patch create mode 100644 SOURCES/0120.patch create mode 100644 SOURCES/0121.patch create mode 100644 SOURCES/0122.patch create mode 100644 SOURCES/0123.patch create mode 100644 SOURCES/0124.patch create mode 100644 SOURCES/0125.patch diff --git a/SOURCES/0111.patch b/SOURCES/0111.patch new file mode 100644 index 0000000..986be06 --- /dev/null +++ b/SOURCES/0111.patch @@ -0,0 +1,65 @@ +From f64e4f1d9d8c715c45db1374f2786d6c384e94c7 Mon Sep 17 00:00:00 2001 +From: Pavel Valena +Date: Tue, 10 Feb 2026 03:35:26 +0100 +Subject: [PATCH] feat(resume): add device used for resume + +regardless of whether it's mounted. + +(cherry picked from commit 9d63c6ad9180fde668cb7d259e8f445d1f5677ea) + +Resolves: RHEL-119785 +--- + modules.d/95resume/module-setup.sh | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/modules.d/95resume/module-setup.sh b/modules.d/95resume/module-setup.sh +index 4b8d8422..66383b39 100755 +--- a/modules.d/95resume/module-setup.sh ++++ b/modules.d/95resume/module-setup.sh +@@ -19,26 +19,43 @@ check() { + } + + # called by dracut +-cmdline() { ++_get_resume_dev() { + local _resume + + for dev in "${!host_fs_types[@]}"; do + [[ ${host_fs_types[$dev]} =~ ^(swap|swsuspend|swsupend)$ ]] || continue + _resume=$(shorten_persistent_dev "$(get_persistent_dev "$dev")") +- [[ -n ${_resume} ]] && printf " resume=%s" "${_resume}" ++ [[ -n ${_resume} ]] && echo "${_resume}" + done + } + ++# called by dracut ++cmdline() { ++ local _resume ++ _resume=$(_get_resume_dev) ++ [[ -n ${_resume} ]] && printf " resume=%s" "${_resume}" ++} ++ + # called by dracut + install() { + local _bin + local _resumeconf ++ local _dev + + if [[ $hostonly_cmdline == "yes" ]]; then + _resumeconf=$(cmdline) + [[ $_resumeconf ]] && printf "%s\n" "$_resumeconf" >> "${initdir}/etc/cmdline.d/95resume.conf" + fi + ++ # If we have a resume device on cmdline, we its drivers in initrd regardless whether it's currently mounted ++ # check current cmdline as well as fstab one ++ _dev=$(_get_resume_dev) ++ [[ $_dev ]] && push_user_devs "$_dev" ++ ++ _dev=$(grep -oP "resume=\K([^ ]*)" /proc/cmdline) ++ _dev=$(shorten_persistent_dev "$(get_persistent_dev "$_dev")") ++ [[ $_dev ]] && push_user_devs "$_dev" ++ + # if systemd is included and has the hibernate-resume tool, use it and nothing else + if dracut_module_included "systemd" && [[ -x $dracutsysrootdir$systemdutildir/systemd-hibernate-resume ]]; then + inst_multiple -o \ + diff --git a/SOURCES/0112.patch b/SOURCES/0112.patch new file mode 100644 index 0000000..451a6e7 --- /dev/null +++ b/SOURCES/0112.patch @@ -0,0 +1,30 @@ +From 124a6ae95b58d10047c4b866e36db16e768eb03a Mon Sep 17 00:00:00 2001 +From: Li Tian +Date: Wed, 14 Jan 2026 13:24:36 +0800 +Subject: [PATCH] fix(dracut): remove trailing null characters from SBATs when + building UKIs + +SBAT of kernel has null character paddings at the end. Using tools +like ukify will display massive amount of '\0' in SBAT. Ukify is +doing ".rstrip('b\x00')" when merging SBATs. + +(cherry picked from commit cbe71b639522c3f328d2a1757a3c54214df66b31) + +Resolves: RHEL-140458 +--- + dracut.sh | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/dracut.sh b/dracut.sh +index 47adee2f..4b6410c0 100755 +--- a/dracut.sh ++++ b/dracut.sh +@@ -2641,6 +2641,7 @@ get_sbat_string() { + local inp=$1 + local out=$uefi_outdir/$2 + objcopy -O binary --only-section=.sbat "$inp" "$out" ++ sed -i 's/\x00*$//' "$out" + clean_sbat_string "$out" + } + + diff --git a/SOURCES/0113.patch b/SOURCES/0113.patch new file mode 100644 index 0000000..b84646a --- /dev/null +++ b/SOURCES/0113.patch @@ -0,0 +1,185 @@ +From b20496bc5a74e9d7ed15ab1888bc0687741bfa64 Mon Sep 17 00:00:00 2001 +From: Pavel Valena +Date: Thu, 23 Apr 2026 17:20:04 +0200 +Subject: [PATCH] fix(network-legacy): replace `echo` writes with `printf` to + prevent injection via DHCP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +DHCP-provided variables (hostname, gateway) were written with echo into +files later sourced as shell by net-lib.sh — allowing command injection +from a rogue DHCP server. + +Use printf with explicit variable escaping `%q` for sourced files: + - .hostname files (DHCP hostname, sourced at net-lib.sh:131) + - .gw files (DHCP routers, sourced at net-lib.sh:140) + - do_static gateway and hostname (kernel cmdline ip= parameter) + +Plain text config files (.resolv.conf) are left as echo — they are +read by awk, not sourced as shell, so %q escaping would be incorrect. + +Resolves: RHEL-170858 +--- + modules.d/35network-legacy/dhclient-script.sh | 24 +++++++++++++++------- + modules.d/35network-legacy/ifup.sh | 29 ++++++++++++++++++--------- + 2 files changed, 36 insertions(+), 17 deletions(-) + +diff --git a/modules.d/35network-legacy/dhclient-script.sh b/modules.d/35network-legacy/dhclient-script.sh +index 82fc7e2c..2272c4c0 100755 +--- a/modules.d/35network-legacy/dhclient-script.sh ++++ b/modules.d/35network-legacy/dhclient-script.sh +@@ -48,22 +48,24 @@ setup_interface() { + if [ -n "$gw" ]; then + if [ "$mask" = "255.255.255.255" ]; then + # point-to-point connection => set explicit route to gateway +- echo ip route add "$gw" dev "$netif" > /tmp/net."$netif".gw ++ printf 'ip route add %q dev %q\n' "$gw" "$netif" > /tmp/net."$netif".gw + fi + + echo "$gw" | { + IFS=' ' read -r main_gw other_gw +- echo ip route replace default via "$main_gw" dev "$netif" >> /tmp/net."$netif".gw ++ printf 'ip route replace default via %q dev %q\n' "$main_gw" "$netif" >> /tmp/net."$netif".gw + if [ -n "$other_gw" ]; then + for g in $other_gw; do +- echo ip route add default via "$g" dev "$netif" >> /tmp/net."$netif".gw ++ printf 'ip route add default via %q dev %q\n' "$g" "$netif" >> /tmp/net."$netif".gw + done + fi + } + fi + + if getargbool 1 rd.peerdns; then +- [ -n "${search}${domain}" ] && echo "search $search $domain" > /tmp/net."$netif".resolv.conf ++ if [ -n "${search}${domain}" ]; then ++ echo "search $search $domain" > /tmp/net."$netif".resolv.conf ++ fi + if [ -n "$namesrv" ]; then + for s in $namesrv; do + echo nameserver "$s" +@@ -72,7 +74,10 @@ setup_interface() { + fi + # Note: hostname can be fqdn OR short hostname, so chop off any + # trailing domain name and explicity add any domain if set. +- [ -n "$hostname" ] && echo "echo ${hostname%.$domain}${domain:+.$domain} > /proc/sys/kernel/hostname" > /tmp/net."$netif".hostname ++ if [ -n "$hostname" ]; then ++ safe_hostname=$(printf '%s' "${hostname%."$domain"}${domain:+.$domain}") ++ printf 'echo %q > /proc/sys/kernel/hostname\n' "$safe_hostname" > /tmp/net."$netif".hostname ++ fi + } + + setup_interface6() { +@@ -95,7 +100,9 @@ setup_interface6() { + ${preferred_lft:+preferred_lft ${preferred_lft}} + + if getargbool 1 rd.peerdns; then +- [ -n "${search}${domain}" ] && echo "search $search $domain" > /tmp/net."$netif".resolv.conf ++ if [ -n "${search}${domain}" ]; then ++ echo "search $search $domain" > /tmp/net."$netif".resolv.conf ++ fi + if [ -n "$namesrv" ]; then + for s in $namesrv; do + echo nameserver "$s" +@@ -105,7 +112,10 @@ setup_interface6() { + + # Note: hostname can be fqdn OR short hostname, so chop off any + # trailing domain name and explicity add any domain if set. +- [ -n "$hostname" ] && echo "echo ${hostname%.$domain}${domain:+.$domain} > /proc/sys/kernel/hostname" > /tmp/net."$netif".hostname ++ if [ -n "$hostname" ]; then ++ safe_hostname=$(printf '%s' "${hostname%."$domain"}${domain:+.$domain}") ++ printf 'echo %q > /proc/sys/kernel/hostname\n' "$safe_hostname" > /tmp/net."$netif".hostname ++ fi + } + + parse_option_121() { +diff --git a/modules.d/35network-legacy/ifup.sh b/modules.d/35network-legacy/ifup.sh +index 0dc9541c..84c53dc4 100755 +--- a/modules.d/35network-legacy/ifup.sh ++++ b/modules.d/35network-legacy/ifup.sh +@@ -28,7 +28,7 @@ do_dhcp_parallel() { + # event for nfsroot + # XXX add -V vendor class and option parsing per kernel + +- [ -e "/tmp/dhclient.$netif.pid" ] && return 0 ++ [ -e "/tmp/dhclient.${netif}.pid" ] && return 0 + + if ! iface_has_carrier "$netif"; then + warn "No carrier detected on interface $netif" +@@ -121,8 +121,10 @@ do_ipv6auto() { + wait_for_ipv6_auto "$netif" + ret=$? + +- [ -n "$hostname" ] && echo "echo $hostname > /proc/sys/kernel/hostname" > "/tmp/net.${netif}.hostname" +- ++ if [ -n "$hostname" ]; then ++ safe_hostname=$(printf '%s' "${hostname}") ++ printf 'echo %q > /proc/sys/kernel/hostname\n' "$safe_hostname" > /tmp/net."$netif".hostname ++ fi + return "$ret" + } + +@@ -134,7 +136,10 @@ do_ipv6link() { + echo 0 > /proc/sys/net/ipv6/conf/"${netif}"/accept_redirects + linkup "$netif" + +- [ -n "$hostname" ] && echo "echo $hostname > /proc/sys/kernel/hostname" > "/tmp/net.${netif}.hostname" ++ if [ -n "$hostname" ]; then ++ safe_hostname=$(printf '%s' "${hostname}") ++ printf 'echo %q > /proc/sys/kernel/hostname\n' "$safe_hostname" > /tmp/net."$netif".hostname ++ fi + + return "$ret" + } +@@ -187,8 +192,12 @@ do_static() { + ip addr add "$ip/$mask" ${srv:+peer "$srv"} brd + dev "$netif" + fi + +- [ -n "$gw" ] && echo "ip route replace default via '$gw' dev '$netif'" > "/tmp/net.$netif.gw" +- [ -n "$hostname" ] && echo "echo '$hostname' > /proc/sys/kernel/hostname" > "/tmp/net.$netif.hostname" ++ [ -n "$gw" ] && printf "ip route replace default via %q dev %q\n" "$gw" "$netif" > "/tmp/net.${netif}.gw" ++ ++ if [ -n "$hostname" ]; then ++ safe_hostname=$(printf '%s' "${hostname}") ++ printf 'echo %q > /proc/sys/kernel/hostname\n' "$safe_hostname" > /tmp/net."$netif".hostname ++ fi + + return 0 + } +@@ -417,7 +426,7 @@ fi + [ -n "$2" -a "$2" = "-m" ] && [ -z "$netroot" ] && manualup="$2" + + if [ -n "$manualup" ]; then +- : > "/tmp/net.$netif.manualup" ++ : > "/tmp/net.${netif}.manualup" + rm -f "/tmp/net.${netif}.did-setup" + else + [ -e "/tmp/net.${netif}.did-setup" ] && exit 0 +@@ -458,7 +467,7 @@ for p in $(getargs ip=); do + # Store config for later use + for i in ip srv gw mask hostname macaddr mtu dns1 dns2; do + eval '[ "$'$i'" ] && echo '$i'="$'$i'"' +- done > "/tmp/net.$netif.override" ++ done > "/tmp/net.${netif}.override" + + for autoopt in $(str_replace "$autoconf" "," " "); do + case $autoopt in +@@ -492,7 +501,7 @@ for p in $(getargs ip=); do + # setup nameserver + for s in "$dns1" "$dns2" $(getargs nameserver); do + [ -n "$s" ] || continue +- echo "nameserver $s" >> "/tmp/net.$netif.resolv.conf" ++ echo "nameserver $s" >> "/tmp/net.${netif}.resolv.conf" + done + + if [ $ret -eq 0 ]; then +@@ -546,7 +555,7 @@ if [ -z "$NO_AUTO_DHCP" ] && [ ! -e "/tmp/net.${netif}.up" ]; then + + for s in $(getargs nameserver); do + [ -n "$s" ] || continue +- echo "nameserver $s" >> "/tmp/net.$netif.resolv.conf" ++ echo "nameserver $s" >> "/tmp/net.${netif}.resolv.conf" + done + + if [ "$ret" -eq 0 ] && [ -n "$(ls "/tmp/leaseinfo.${netif}"* 2> /dev/null)" ]; then + diff --git a/SOURCES/0114.patch b/SOURCES/0114.patch new file mode 100644 index 0000000..e02ec9a --- /dev/null +++ b/SOURCES/0114.patch @@ -0,0 +1,97 @@ +From a633292e4c661c6baaabf9f8d8fc818ca3e0233d Mon Sep 17 00:00:00 2001 +From: Pavel Valena +Date: Wed, 29 Apr 2026 04:46:15 +0200 +Subject: [PATCH] fix(iscsi): replace `echo` writes with `printf` to prevent + variable injection +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Use printf with explicit variable escaping `%q` for shell scripts: + - mount-lun.sh hookdir script (iscsi_lun variable) + - udev rule (iscsi_lun sanitized via tr -d '"') + - initiatorname.iscsi (sourced as shell at iscsiroot.sh:161-163) + +Note: initiatorname.iscsi is also read by iscsid as plain text (no +shell unquoting). For valid IQNs ([a-z0-9.:_-]), %q is a no-op, so +iscsid sees the value unchanged. For malicious values with special +characters, %q would produce shell escaping that iscsid reads +literally — breaking the connection rather than allowing injection. + +Related: RHEL-170858 +--- + modules.d/95iscsi/iscsiroot.sh | 10 +++++----- + modules.d/95iscsi/parse-iscsiroot.sh | 4 ++-- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/modules.d/95iscsi/iscsiroot.sh b/modules.d/95iscsi/iscsiroot.sh +index 63b4ce19..24d9f5bb 100755 +--- a/modules.d/95iscsi/iscsiroot.sh ++++ b/modules.d/95iscsi/iscsiroot.sh +@@ -145,7 +145,7 @@ handle_netroot() { + + if [ -z "$iscsi_initiator" ] && [ -f /sys/firmware/ibft/initiator/initiator-name ] && ! [ -f /tmp/iscsi_set_initiator ]; then + iscsi_initiator=$(while read -r line || [ -n "$line" ]; do echo "$line"; done < /sys/firmware/ibft/initiator/initiator-name) +- echo "InitiatorName=$iscsi_initiator" > /run/initiatorname.iscsi ++ printf 'InitiatorName=%q\n' "$iscsi_initiator" > /run/initiatorname.iscsi + rm -f /etc/iscsi/initiatorname.iscsi + mkdir -p /etc/iscsi + ln -fs /run/initiatorname.iscsi /etc/iscsi/initiatorname.iscsi +@@ -166,7 +166,7 @@ handle_netroot() { + + if [ -z "$iscsi_initiator" ]; then + iscsi_initiator=$(iscsi-iname) +- echo "InitiatorName=$iscsi_initiator" > /run/initiatorname.iscsi ++ printf 'InitiatorName=%q\n' "$iscsi_initiator" > /run/initiatorname.iscsi + rm -f /etc/iscsi/initiatorname.iscsi + mkdir -p /etc/iscsi + ln -fs /run/initiatorname.iscsi /etc/iscsi/initiatorname.iscsi +@@ -190,7 +190,7 @@ handle_netroot() { + iscsi_lun=0 + fi + +- echo "InitiatorName=$iscsi_initiator" > /run/initiatorname.iscsi ++ printf 'InitiatorName=%q\n' "$iscsi_initiator" > /run/initiatorname.iscsi + ln -fs /run/initiatorname.iscsi /dev/.initiatorname.iscsi + if ! [ -e /etc/iscsi/initiatorname.iscsi ]; then + mkdir -p /etc/iscsi +@@ -211,14 +211,14 @@ handle_netroot() { + + if [ "$root" = "dhcp" ] || [ "$netroot" = "dhcp" ]; then + # if root is not specified try to mount the whole iSCSI LUN +- printf 'SYMLINK=="disk/by-path/*-iscsi-*-%s", SYMLINK+="root"\n' "$iscsi_lun" >> /etc/udev/rules.d/99-iscsi-root.rules ++ printf 'SYMLINK=="disk/by-path/*-iscsi-*-%s", SYMLINK+="root"\n' "$(printf '%s' "$iscsi_lun" | tr -d '"')" >> /etc/udev/rules.d/99-iscsi-root.rules + udevadm control --reload + write_fs_tab /dev/root + wait_for_dev -n /dev/root + + # install mount script + [ -z "$DRACUT_SYSTEMD" ] \ +- && echo "iscsi_lun=$iscsi_lun . /bin/mount-lun.sh " > "$hookdir"/mount/01-$$-iscsi.sh ++ && printf 'iscsi_lun=%q . /bin/mount-lun.sh\n' "$iscsi_lun" > "$hookdir"/mount/01-$$-iscsi.sh + fi + + if strglobin "$iscsi_target_ip" '*:*:*' && ! strglobin "$iscsi_target_ip" '['; then +diff --git a/modules.d/95iscsi/parse-iscsiroot.sh b/modules.d/95iscsi/parse-iscsiroot.sh +index 75747111..1a102b12 100755 +--- a/modules.d/95iscsi/parse-iscsiroot.sh ++++ b/modules.d/95iscsi/parse-iscsiroot.sh +@@ -105,7 +105,7 @@ fi + + if arg=$(getarg rd.iscsi.initiator -d iscsi_initiator=) && [ -n "$arg" ] && ! [ -f /run/initiatorname.iscsi ]; then + iscsi_initiator=$arg +- echo "InitiatorName=$iscsi_initiator" > /run/initiatorname.iscsi ++ printf 'InitiatorName=%q\n' "$iscsi_initiator" > /run/initiatorname.iscsi + ln -fs /run/initiatorname.iscsi /dev/.initiatorname.iscsi + rm -f /etc/iscsi/initiatorname.iscsi + mkdir -p /etc/iscsi +@@ -121,7 +121,7 @@ fi + if [ -z "$iscsi_initiator" ] && [ -f /sys/firmware/ibft/initiator/initiator-name ] && ! [ -f /tmp/iscsi_set_initiator ]; then + iscsi_initiator=$(while read -r line || [ -n "$line" ]; do echo "$line"; done < /sys/firmware/ibft/initiator/initiator-name) + if [ -n "$iscsi_initiator" ]; then +- echo "InitiatorName=$iscsi_initiator" > /run/initiatorname.iscsi ++ printf 'InitiatorName=%q\n' "$iscsi_initiator" > /run/initiatorname.iscsi + rm -f /etc/iscsi/initiatorname.iscsi + mkdir -p /etc/iscsi + ln -fs /run/initiatorname.iscsi /etc/iscsi/initiatorname.iscsi + diff --git a/SOURCES/0115.patch b/SOURCES/0115.patch new file mode 100644 index 0000000..1531ca5 --- /dev/null +++ b/SOURCES/0115.patch @@ -0,0 +1,46 @@ +From 8823fab4f32315e5e7c376116954b9f84b2576dd Mon Sep 17 00:00:00 2001 +From: Pavel Valena +Date: Tue, 12 May 2026 03:25:20 +0200 +Subject: [PATCH] fix(network): warn on suspicious shell metacharacters in + hostname file +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +setup_net() sources /tmp/net.$netif.hostname as shell, which is written +by dhclient-script.sh or ifup.sh. Add a defensive check that warns if +the file contains shell metacharacters ($, `, ;, &, |, () that should +never appear in a legitimate hostname, indicating possible DHCP-based +command injection attempts. + +The file is still sourced for compatibility — the writer-side fix +(printf '%q') already prevents execution of injected content. + +Co-Authored-By: Claude Opus 4.6 + +Related: RHEL-170858 +--- + modules.d/40network/net-lib.sh | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/modules.d/40network/net-lib.sh b/modules.d/40network/net-lib.sh +index a294a390..03be4c6d 100755 +--- a/modules.d/40network/net-lib.sh ++++ b/modules.d/40network/net-lib.sh +@@ -127,8 +127,13 @@ setup_net() { + [ -e "/tmp/net.ifaces" ] && read -r IFACES < /tmp/net.ifaces + [ -z "$IFACES" ] && IFACES="$netif" + # run the scripts written by ifup +- # shellcheck disable=SC1090 +- [ -e /tmp/net."$netif".hostname ] && . /tmp/net."$netif".hostname ++ if [ -e /tmp/net."$netif".hostname ]; then ++ if grep -qE '[$`;&|(]' /tmp/net."$netif".hostname 2> /dev/null; then ++ warn "setup_net $netif: /tmp/net.$netif.hostname contains suspicious shell metacharacters" ++ fi ++ # shellcheck disable=SC1090 ++ . /tmp/net."$netif".hostname ++ fi + # shellcheck disable=SC1090 + [ -e /tmp/net."$netif".override ] && . /tmp/net."$netif".override + # shellcheck disable=SC1090 + diff --git a/SOURCES/0116.patch b/SOURCES/0116.patch new file mode 100644 index 0000000..54b38fe --- /dev/null +++ b/SOURCES/0116.patch @@ -0,0 +1,71 @@ +From 9d48f561951fbcec26387e4ca626562bc9ee9b22 Mon Sep 17 00:00:00 2001 +From: Pavel Valena +Date: Tue, 12 May 2026 03:27:22 +0200 +Subject: [PATCH] fix(base): escape arguments in initqueue hook script + generation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +initqueue.sh writes arguments directly into generated hook scripts +via `echo "$exe" "$@"`. These scripts are later sourced by +dracut-initqueue.sh, so shell metacharacters in arguments (e.g. +DHCP-derived $netroot passed from parse-iscsiroot.sh) execute as +root in initramfs. + +Replace `echo` with `printf '%q'` to shell-escape all arguments +before writing them into the hook script, preventing command +injection via DHCP-controlled netroot values. + +Remove the fragile embedded single-quote wrapping ("'$var'") from +parse-iscsiroot.sh call sites (lines 90, 102) — those relied on +echo writing quotes verbatim for the shell to strip when sourcing. +With printf '%q', initqueue now handles escaping centrally, so the +manual wrapping is no longer needed and would cause literal quote +characters to leak into iscsiroot arguments. + +Co-Authored-By: Claude Opus 4.6 + +Related: RHEL-170858 +--- + modules.d/95iscsi/parse-iscsiroot.sh | 4 ++-- + modules.d/99base/initqueue.sh | 3 ++- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/modules.d/95iscsi/parse-iscsiroot.sh b/modules.d/95iscsi/parse-iscsiroot.sh +index 1a102b12..80aae95f 100755 +--- a/modules.d/95iscsi/parse-iscsiroot.sh ++++ b/modules.d/95iscsi/parse-iscsiroot.sh +@@ -87,7 +87,7 @@ if [ -n "$iscsi_firmware" ]; then + echo "${DRACUT_SYSTEMD+systemctl is-active initrd-root-device.target || }[ -f '/tmp/iscsistarted-firmware' ]" > "$hookdir"/initqueue/finished/iscsi_started.sh + initqueue --unique --online /sbin/iscsiroot online "iscsi:" "$NEWROOT" + initqueue --unique --onetime --timeout /sbin/iscsiroot timeout "iscsi:" "$NEWROOT" +- initqueue --unique --onetime --settled /sbin/iscsiroot online "iscsi:" "'$NEWROOT'" ++ initqueue --unique --onetime --settled /sbin/iscsiroot online "iscsi:" "$NEWROOT" + fi + + # ISCSI actually supported? +@@ -99,7 +99,7 @@ modprobe --all -b -q qla4xxx cxgb3i cxgb4i bnx2i be2iscsi + + if [ -n "$netroot" ] && [ "$root" != "/dev/root" ] && [ "$root" != "dhcp" ]; then + if ! getargbool 1 rd.neednet > /dev/null || ! getarg "ip="; then +- initqueue --unique --onetime --settled /sbin/iscsiroot dummy "'$netroot'" "'$NEWROOT'" ++ initqueue --unique --onetime --settled /sbin/iscsiroot dummy "$netroot" "$NEWROOT" + fi + fi + +diff --git a/modules.d/99base/initqueue.sh b/modules.d/99base/initqueue.sh +index 2c490793..672effd6 100755 +--- a/modules.d/99base/initqueue.sh ++++ b/modules.d/99base/initqueue.sh +@@ -64,7 +64,8 @@ fi + # shellcheck disable=SC2016 + [ -n "$onetime" ] && echo '[ -e "$job" ] && rm -f -- "$job"' + [ -n "$env" ] && echo "$env" +- echo "$exe" "$@" ++ printf '%q ' "$exe" "$@" ++ printf '\n' + } > "/tmp/$$-${job}.sh" + + mv -f "/tmp/$$-${job}.sh" "$hookdir/initqueue${qname}/${job}.sh" + diff --git a/SOURCES/0117.patch b/SOURCES/0117.patch new file mode 100644 index 0000000..70d4035 --- /dev/null +++ b/SOURCES/0117.patch @@ -0,0 +1,47 @@ +From 365b910c00331ba0c0734919e1ea8b5f8d2503ab Mon Sep 17 00:00:00 2001 +From: Pavel Valena +Date: Wed, 24 Jun 2026 22:54:40 +0200 +Subject: [PATCH] revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless + excluded" + +This reverts commit 35e125e0b8c013e759b4a1b819d73a99adcbf347. + +Resolves: RHEL-178488 +--- + modules.d/10i18n/module-setup.sh | 23 +---------------------- + 1 file changed, 1 insertion(+), 22 deletions(-) + +diff --git a/modules.d/10i18n/module-setup.sh b/modules.d/10i18n/module-setup.sh +index 11aedb0c..35bda36f 100755 +--- a/modules.d/10i18n/module-setup.sh ++++ b/modules.d/10i18n/module-setup.sh +@@ -11,28 +11,7 @@ check() { + + # called by dracut + depends() { +- # Include "drm" / "simpledrm" to be able to set the console font properly +- local _module _drm +- local -a _modules=(drm simpledrm) +- +- for _module in "${_modules[@]}"; do +- if dracut_module_included "$_module"; then +- _drm="$_module" +- break +- fi +- done +- +- if [[ -z $_drm ]]; then +- for _module in "${_modules[@]}"; do +- module_check "$_module" > /dev/null 2>&1 +- if [[ $? == 255 ]] && ! [[ " $omit_dracutmodules " == *\ $_module\ * ]]; then +- _drm="$_module" +- break +- fi +- done +- fi +- +- echo "$_drm" ++ return 0 + } + + # called by dracut diff --git a/SOURCES/0120.patch b/SOURCES/0120.patch new file mode 100644 index 0000000..41a375d --- /dev/null +++ b/SOURCES/0120.patch @@ -0,0 +1,168 @@ +From d9ea05a69bc4b1aa5396e3205338ccc6200a506c Mon Sep 17 00:00:00 2001 +From: Antonio Alvarez Feijoo +Date: Mon, 4 Nov 2024 13:31:13 +0100 +Subject: [PATCH] fix(dracut): rework timeout for devices added via --mount and + --add-device + +Currently, dracut adds a systemd dropin that sets an infinite timeout _only_ for +the underlying persistent devices of each host device that must be active in the +initrd. E.g.: + +``` +localhost:~ # dracut -f --stdlog 3 --install "/mnt" --mount "/dev/sda1 /mnt btrfs rw,relatime" +localhost:~ # lsinitrd | grep timeout.conf +-rw-r--r-- 2 root root 0 Oct 28 14:21 etc/systemd/system/dev-disk-by\x2duuid-0d1b24c2\x2df112\x2d48ef\x2d8442\x2d1001cffc92f0.device.d/timeout.conf +localhost:~ # ls -l /dev/disk/by-uuid/0d1b24c2-f112-48ef-8442-1001cffc92f0 +lrwxrwxrwx 1 root root 10 Oct 28 11:43 /dev/disk/by-uuid/0d1b24c2-f112-48ef-8442-1001cffc92f0 -> ../../sda1 +``` + +It can be verified in the emergency shell: + +``` +sh-5.2# systemctl show --property JobRunningTimeoutUSec /dev/disk/by-uuid/0d1b24c2-f112-48ef-8442-1001cffc92f0 +JobRunningTimeoutUSec=infinity +sh-5.2# systemctl show --property JobRunningTimeoutUSec /dev/sda1 +JobRunningTimeoutUSec=1min 30s +``` + +This can cause a problem if a user application expects to mount /dev/sda1 in the +initrd (that's why it was explicitly added `--mount "/dev/sda1 ..."`), but for +some reason the link is not created within 1min 30s. + +(cherry picked from commit c79fc8fd0d4b9aaa8e753296cbafdb1f82781d08) + +Resolves: RHEL-212601 +--- + dracut-functions.sh | 8 ++++---- + dracut.sh | 20 +++++++++++++++----- + modules.d/99base/module-setup.sh | 18 +++++++++++++++++- + 3 files changed, 36 insertions(+), 10 deletions(-) + +diff --git a/dracut-functions.sh b/dracut-functions.sh +index 0cf605dcd..894c132cd 100755 +--- a/dracut-functions.sh ++++ b/dracut-functions.sh +@@ -593,9 +593,9 @@ for_each_host_dev_and_slaves_all() { + local _dev + local _ret=1 + +- [[ "${host_devs[*]}" ]] || return 2 ++ [[ "${host_devs[*]}" ]] || [[ "${user_devs[*]}" ]] || return 2 + +- for _dev in "${host_devs[@]}"; do ++ for _dev in "${host_devs[@]}" "${user_devs[@]}"; do + [[ -b $_dev ]] || continue + if check_block_and_slaves_all "$_func" "$(get_maj_min "$_dev")"; then + _ret=0 +@@ -608,9 +608,9 @@ for_each_host_dev_and_slaves() { + local _func="$1" + local _dev + +- [[ "${host_devs[*]}" ]] || return 2 ++ [[ "${host_devs[*]}" ]] || [[ "${user_devs[*]}" ]] || return 2 + +- for _dev in "${host_devs[@]}"; do ++ for _dev in "${host_devs[@]}" "${user_devs[@]}"; do + [[ -b $_dev ]] || continue + check_block_and_slaves "$_func" "$(get_maj_min "$_dev")" && return 0 + done +diff --git a/dracut.sh b/dracut.sh +index 4b6410c0b..fb967bbb2 100755 +--- a/dracut.sh ++++ b/dracut.sh +@@ -330,6 +330,16 @@ read_arg() { + fi + } + ++# Fills up user_devs stack variable and makes sure there are no duplicates ++push_user_devs() { ++ local _dev ++ for _dev in "$@"; do ++ [[ -z $_dev ]] && continue ++ [[ " ${user_devs[*]} " == *" $_dev "* ]] && return ++ user_devs+=("$_dev") ++ done ++} ++ + check_conf_file() { + if grep -H -e '^[^#]*[+]=\("[^ ]\|.*[^ ]"\)' "$@"; then + printf '\ndracut: WARNING: +=" ": should have surrounding white spaces!\n' >&2 +@@ -1576,7 +1586,7 @@ for line in "${fstab_lines[@]}"; do + push_host_devs "$mp" + done + fi +- push_host_devs "$dev" ++ push_user_devs "$dev" + host_fs_types["$dev"]="$3" + done + +@@ -1588,12 +1598,12 @@ for f in $add_fstab; do + done + + for dev in $add_device; do +- push_host_devs "$dev" ++ push_user_devs "$dev" + done + + if ((${#add_device_l[@]})); then + add_device+=" ${add_device_l[*]} " +- push_host_devs "${add_device_l[@]}" ++ push_user_devs "${add_device_l[@]}" + fi + + if [[ $hostonly ]] && [[ $hostonly_default_device != "no" ]]; then +@@ -1715,7 +1725,7 @@ _get_fs_type() { + return 1 + } + +-for dev in "${host_devs[@]}"; do ++for dev in "${host_devs[@]}" "${user_devs[@]}"; do + _get_fs_type "$dev" + check_block_and_slaves_all _get_fs_type "$(get_maj_min "$dev")" + done +@@ -1943,7 +1953,7 @@ export initdir dracutbasedir \ + omit_drivers mdadmconf lvmconf root_devs \ + use_fstab fstab_lines libdirs fscks nofscks ro_mnt \ + stdloglvl sysloglvl fileloglvl kmsgloglvl logfile \ +- debug host_fs_types host_devs swap_devs sshkey add_fstab \ ++ debug host_fs_types host_devs user_devs swap_devs sshkey add_fstab \ + DRACUT_VERSION udevdir udevconfdir udevrulesdir udevrulesconfdir \ + prefix filesystems drivers dbus dbusconfdir dbusinterfaces \ + dbusinterfacesconfdir dbusservices dbusservicesconfdir dbussession \ +diff --git a/modules.d/99base/module-setup.sh b/modules.d/99base/module-setup.sh +index 3fa2659aa..74971cc50 100755 +--- a/modules.d/99base/module-setup.sh ++++ b/modules.d/99base/module-setup.sh +@@ -104,7 +104,7 @@ install() { + + ## save host_devs which we need bring up + if [[ $hostonly_cmdline == "yes" ]]; then +- if [[ -n ${host_devs[*]} ]]; then ++ if [[ -n ${host_devs[*]} ]] || [[ -n ${user_devs[*]} ]]; then + dracut_need_initqueue + fi + if [[ -f $initdir/lib/dracut/need-initqueue ]] || ! dracut_module_included "systemd"; then +@@ -137,6 +137,22 @@ install() { + *) ;; + esac + done ++ ++ for _dev in "${user_devs[@]}"; do ++ ++ case "$_dev" in ++ /dev/?*) wait_for_dev "$_dev" 0 ;; ++ *) ;; ++ esac ++ ++ _pdev=$(get_persistent_dev "$_dev") ++ [[ $_dev == "$_pdev" ]] && continue ++ ++ case "$_pdev" in ++ /dev/?*) wait_for_dev "$_pdev" 0 ;; ++ *) ;; ++ esac ++ done + ) + fi + fi + diff --git a/SOURCES/0121.patch b/SOURCES/0121.patch new file mode 100644 index 0000000..6cd1d4b --- /dev/null +++ b/SOURCES/0121.patch @@ -0,0 +1,43 @@ +From 804569a4bb90a440d777c045c5f4cc4aa844b193 Mon Sep 17 00:00:00 2001 +From: Pavel Valena +Date: Tue, 28 Jul 2026 05:10:09 +0200 +Subject: [PATCH] fix(base): escape die() message in emergency hook script +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +die() appends its error message to $hookdir/emergency/01-die.sh using +echo "warn dracut: FATAL: \"$*\"", which is later sourced by +emergency_shell(). When die() is called with DHCP-controlled data — +specifically $netroot derived from the DHCP ROOT_PATH option via +netroot.sh's handler-resolution failure path — a command-substitution +sequence such as $(cmd) embedded in that data executes as root when +dracut sources the emergency hook directory. + +Replace `echo` with `printf '%q'` to shell-escape the message before +writing it into the hook script, preventing command injection via +DHCP-controlled values that reach die() through error paths. + +Co-Authored-By: Claude Opus 4.6 + +(cherry picked from commit 626ec6752ec5eb6902c2a2424f58b8873b34c7a0) + +Resolves: RHEL-210940 +--- + modules.d/99base/dracut-lib.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh +index 43b023e14..b1ea95255 100755 +--- a/modules.d/99base/dracut-lib.sh ++++ b/modules.d/99base/dracut-lib.sh +@@ -451,7 +451,7 @@ die() { + } > /dev/kmsg + + { +- echo "warn dracut: FATAL: \"$*\"" ++ printf 'warn dracut: FATAL: %q\n' "$*" + echo "warn dracut: Refusing to continue" + } >> $hookdir/emergency/01-die.sh + [ -d /run/initramfs ] || mkdir -p -- /run/initramfs + diff --git a/SOURCES/0122.patch b/SOURCES/0122.patch new file mode 100644 index 0000000..e5a2303 --- /dev/null +++ b/SOURCES/0122.patch @@ -0,0 +1,60 @@ +From 1a00697dfa5d58bc298fe77e48f2b586c0a0659e Mon Sep 17 00:00:00 2001 +From: Pavel Valena +Date: Wed, 29 Apr 2026 05:41:21 +0200 +Subject: [PATCH] fix(base): replace eval with safe variable indirection in + splitsep and export_n + +splitsep: use local nameref to avoid eval injection via single-quote breakout. +export_n: use ${!var} and printf -v to avoid eval injection via double-quote breakout. + +(cherry picked from commit efa38e72f2742456dc93060fb1ac28d98217ac21) + +Related: RHEL-210940 +--- + modules.d/99base/dracut-lib.sh | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh +index b1ea95255..1c753ba16 100755 +--- a/modules.d/99base/dracut-lib.sh ++++ b/modules.d/99base/dracut-lib.sh +@@ -374,12 +374,18 @@ splitsep() { + + while [ -n "$str" -a "$#" -gt 1 ]; do + tmp="${str%%$sep*}" +- eval "$1='${tmp}'" ++ local -n _splitsep_ref="$1" ++ _splitsep_ref="$tmp" ++ unset -n _splitsep_ref + str="${str#"$tmp"}" + str="${str#$sep}" + shift + done +- [ -n "$str" -a -n "$1" ] && eval "$1='$str'" ++ if [ -n "$str" -a -n "$1" ]; then ++ local -n _splitsep_ref="$1" ++ _splitsep_ref="$str" ++ unset -n _splitsep_ref ++ fi + debug_on + return 0 + } +@@ -1016,14 +1022,13 @@ emergency_shell() { + } + + # Retain the values of these variables but ensure that they are unexported +-# This is a POSIX-compliant equivalent of bash's "export -n" + export_n() { + local var + local val + for var in "$@"; do +- eval val=\$$var +- unset $var +- [ -n "$val" ] && eval "$var=\"$val\"" ++ val="${!var}" ++ unset "$var" ++ [ -n "$val" ] && printf -v "$var" '%s' "$val" + done + } + + diff --git a/SOURCES/0123.patch b/SOURCES/0123.patch new file mode 100644 index 0000000..6b7f04c --- /dev/null +++ b/SOURCES/0123.patch @@ -0,0 +1,200 @@ +From 1b9026ddbbfafa006bc3cef01fc99047b4002282 Mon Sep 17 00:00:00 2001 +From: Steffen Maier +Date: Wed, 24 May 2023 19:02:09 +0200 +Subject: [PATCH] refactor(cms): use zdev to simplify handling CMSDASD=... boot + option + +This is just internal to initrd, so we can already migrate the code to +consolidated dasd device configuration with zdev +https://github.com/ibm-s390-linux/s390-tools/tree/master/zdev/. +The code change is transparent to users after dracut switch root. + +Signed-off-by: Steffen Maier + +(cherry picked from commit 6c55657e5278b3ab16dc20af1df315d62e9d690d) + +Resolves: RHEL-151848 +--- + modules.d/80cms/cmssetup.sh | 108 +++++++--------------------------------- + modules.d/80cms/module-setup.sh | 3 +- + 2 files changed, 21 insertions(+), 90 deletions(-) + +diff --git a/modules.d/80cms/cmssetup.sh b/modules.d/80cms/cmssetup.sh +index 68e45632f..23e81ca98 100755 +--- a/modules.d/80cms/cmssetup.sh ++++ b/modules.d/80cms/cmssetup.sh +@@ -2,34 +2,16 @@ + + type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh + +-function sysecho() { +- file="$1" +- shift +- local i=1 +- while [ $i -le 10 ]; do +- if [ ! -f "$file" ]; then +- sleep 1 +- i=$((i + 1)) +- else +- break +- fi +- done +- local status +- read -r status < "$file" +- if [[ $status != "$*" ]]; then +- [ -f "$file" ] && echo "$*" > "$file" +- fi +-} +- + function dasd_settle() { +- local dasd_status=/sys/bus/ccw/devices/$1/status ++ local dasd_status ++ dasd_status=$(lszdev dasd "$1" --columns ATTRPATH:status --no-headings --active) + if [ ! -f "$dasd_status" ]; then + return 1 + fi + local i=1 + while [ $i -le 60 ]; do + local status +- read -r status < "$dasd_status" ++ status=$(lszdev dasd "$1" --columns ATTR:status --no-headings --active) + case $status in + online | unformatted) + return 0 +@@ -43,77 +25,23 @@ function dasd_settle() { + return 1 + } + +-function dasd_settle_all() { +- for dasdccw in $(while read -r line || [ -n "$line" ]; do echo "${line%%(*}"; done < /proc/dasd/devices); do +- if ! dasd_settle "$dasdccw"; then +- echo $"Could not access DASD $dasdccw in time" +- return 1 +- fi +- done +- return 0 +-} +- +-# prints a canonocalized device bus ID for a given devno of any format +-function canonicalize_devno() { +- case ${#1} in +- 3) echo "0.0.0${1}" ;; +- 4) echo "0.0.${1}" ;; +- *) echo "${1}" ;; +- esac +- return 0 +-} +- + # read file from CMS and write it to /tmp + function readcmsfile() { # $1=dasdport $2=filename + local dev +- local numcpus + local devname + local ret=0 + if [ $# -ne 2 ]; then return; fi +- # precondition: udevd created dasda block device node +- if ! dasd_cio_free -d "$1"; then +- echo $"DASD $1 could not be cleared from device blacklist" +- return 1 +- fi +- +- modprobe dasd_mod dasd="$CMSDASD" +- modprobe dasd_eckd_mod +- udevadm settle +- +- # precondition: dasd_eckd_mod driver incl. dependencies loaded, +- # dasd_mod must be loaded without setting any DASD online +- dev=$(canonicalize_devno "$1") +- numcpus=$( +- while read -r line || [ -n "$line" ]; do +- if strstr "$line" "# processors"; then +- echo "${line##*:}" +- break +- fi +- done < /proc/cpuinfo +- ) ++ # precondition: udevd created block device node + +- if [ "${numcpus}" -eq 1 ]; then +- echo 1 > /sys/bus/ccw/devices/"$dev"/online +- else +- if ! sysecho /sys/bus/ccw/devices/"$dev"/online 1; then +- echo $"DASD $dev could not be set online" +- return 1 +- fi +- udevadm settle +- if ! dasd_settle "$dev"; then +- echo $"Could not access DASD $dev in time" +- return 1 +- fi ++ dev="$1" ++ chzdev --enable --active --yes --quiet --no-root-update --force dasd "$dev" || return 1 ++ if ! dasd_settle "$dev"; then ++ echo $"Could not access DASD $dev in time" ++ return 1 + fi + +- udevadm settle +- +- devname=$( +- cd /sys/bus/ccw/devices/"$dev"/block || exit +- set -- * +- [ -b /dev/"$1" ] && echo "$1" +- ) +- devname=${devname:-dasda} ++ devname=$(lszdev dasd "$dev" --columns NAMES --no-headings --active) ++ [[ -n $devname ]] || return 1 + + [[ -d /mnt ]] || mkdir -p /mnt + if cmsfs-fuse --to=UTF-8 -a /dev/"$devname" /mnt; then +@@ -125,20 +53,22 @@ function readcmsfile() { # $1=dasdport $2=filename + ret=1 + fi + +- if ! sysecho /sys/bus/ccw/devices/"$dev"/online 0; then +- echo $"DASD $dev could not be set offline again" +- #return 1 +- fi +- udevadm settle ++ chzdev --disable --active --yes --quiet --no-root-update --force dasd "$dev" + + # unbind all dasds to unload the dasd modules for a clean start + ( + cd /sys/bus/ccw/drivers/dasd-eckd || exit +- for i in *.*; do echo "$i" > unbind; done ++ for i in *.*; do echo "$i" > unbind 2> /dev/null; done ++ ) ++ ( ++ cd /sys/bus/ccw/drivers/dasd-fba || exit ++ for i in *.*; do echo "$i" > unbind 2> /dev/null; done + ) + udevadm settle + modprobe -r dasd_eckd_mod + udevadm settle ++ modprobe -r dasd_fba_mod ++ udevadm settle + modprobe -r dasd_diag_mod + udevadm settle + modprobe -r dasd_mod +diff --git a/modules.d/80cms/module-setup.sh b/modules.d/80cms/module-setup.sh +index 2b280e0f3..4872734b1 100755 +--- a/modules.d/80cms/module-setup.sh ++++ b/modules.d/80cms/module-setup.sh +@@ -4,6 +4,7 @@ + check() { + arch=${DRACUT_ARCH:-$(uname -m)} + [ "$arch" = "s390" -o "$arch" = "s390x" ] || return 1 ++ require_binaries chzdev lszdev || return 1 + return 255 + } + +@@ -28,7 +29,7 @@ install() { + # shellcheck disable=SC2046 + inst_multiple /etc/cmsfs-fuse/filetypes.conf /etc/udev/rules.d/99-fuse.rules /etc/fuse.conf \ + cmsfs-fuse fusermount bash insmod rmmod cat normalize_dasd_arg sed \ +- $(rpm -ql s390utils-base) awk getopt ++ $(rpm -ql s390utils-base) awk getopt chzdev lszdev + + inst_libdir_file "gconv/*" + #inst /usr/lib/locale/locale-archive + diff --git a/SOURCES/0124.patch b/SOURCES/0124.patch new file mode 100644 index 0000000..643f9ad --- /dev/null +++ b/SOURCES/0124.patch @@ -0,0 +1,83 @@ +From c5997ed914de814eb0a616165a9947affee616a3 Mon Sep 17 00:00:00 2001 +From: Steffen Maier +Date: Wed, 24 May 2023 19:04:48 +0200 +Subject: [PATCH] refactor(cms): use consolidated dasd config with zdev from + s390-tools + +Depends on https://github.com/ibm-s390-linux/s390-tools commit +9b2fb1d4d2e2 ("zdev: add helper to convert from dasd_mod.dasd to zdev +config"). + +This is just internal to initrd, so it's possible to migrate the code to +consolidated dasd device configuration with zdev +https://github.com/ibm-s390-linux/s390-tools/tree/master/zdev/. +The code change is transparent to users after dracut switch root. + +The generated persistent config of chzdev are pure udev rules so it has no +dependency on other dracut modules such as zdev, dasd, or dasd_mod. +Instead now install the corresponding kernel device drivers here directly. + +Signed-off-by: Steffen Maier + +(cherry picked from commit 168c0c667d0fb14a8565e999c367494c85c7262c) + +Resolves: RHEL-151848 +--- + modules.d/80cms/cmssetup.sh | 6 +++--- + modules.d/80cms/module-setup.sh | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/modules.d/80cms/cmssetup.sh b/modules.d/80cms/cmssetup.sh +index 23e81ca98..b80ce23ab 100755 +--- a/modules.d/80cms/cmssetup.sh ++++ b/modules.d/80cms/cmssetup.sh +@@ -1,6 +1,7 @@ + #!/bin/bash + + type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh ++type zdev_parse_dasd_list > /dev/null 2>&1 || . /lib/s390-tools/zdev-from-dasd_mod.dasd + + function dasd_settle() { + local dasd_status +@@ -112,9 +113,8 @@ processcmsfile() { + fi + + if [[ $DASD ]] && [[ $DASD != "none" ]]; then +- echo "$DASD" | normalize_dasd_arg > /etc/dasd.conf +- echo "options dasd_mod dasd=$DASD" > /etc/modprobe.d/dasd_mod.conf +- dasd_cio_free ++ echo "$DASD" | zdev_parse_dasd_list globals 2>&1 | vinfo ++ echo "$DASD" | zdev_parse_dasd_list ranges 2>&1 | vinfo + fi + + unset _do_zfcp +diff --git a/modules.d/80cms/module-setup.sh b/modules.d/80cms/module-setup.sh +index 4872734b1..622d397e9 100755 +--- a/modules.d/80cms/module-setup.sh ++++ b/modules.d/80cms/module-setup.sh +@@ -12,13 +12,13 @@ check() { + depends() { + arch=${DRACUT_ARCH:-$(uname -m)} + [ "$arch" = "s390" -o "$arch" = "s390x" ] || return 1 +- echo znet zfcp dasd dasd_mod bash ++ echo znet zfcp bash + return 0 + } + + # called by dracut + installkernel() { +- instmods zfcp ++ instmods zfcp dasd_mod dasd_eckd_mod dasd_fba_mod dasd_diag_mod + } + + # called by dracut +@@ -28,7 +28,7 @@ install() { + inst_script "$moddir/cmsifup.sh" /sbin/cmsifup + # shellcheck disable=SC2046 + inst_multiple /etc/cmsfs-fuse/filetypes.conf /etc/udev/rules.d/99-fuse.rules /etc/fuse.conf \ +- cmsfs-fuse fusermount bash insmod rmmod cat normalize_dasd_arg sed \ ++ cmsfs-fuse fusermount bash insmod rmmod cat /lib/s390-tools/zdev-from-dasd_mod.dasd sed \ + $(rpm -ql s390utils-base) awk getopt chzdev lszdev + + inst_libdir_file "gconv/*" + diff --git a/SOURCES/0125.patch b/SOURCES/0125.patch new file mode 100644 index 0000000..a87ac84 --- /dev/null +++ b/SOURCES/0125.patch @@ -0,0 +1,26 @@ +From 869e8c5c3673b30d8899311aca273fe370bb2123 Mon Sep 17 00:00:00 2001 +From: Pavel Valena +Date: Wed, 12 Aug 2026 22:55:18 +0200 +Subject: [PATCH] fix(qemu): add missing bochs module explicitly + +As it is needed to display console properly, and doesn't get detected in some cases. + +(cherry picked from commit 6328318f17933798a4a1a4e3b974b27070a470ad) + +Resolves: RHEL-217597 +--- + modules.d/90qemu/module-setup.sh | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/modules.d/90qemu/module-setup.sh b/modules.d/90qemu/module-setup.sh +index 01bc0c3de..a873fca5a 100755 +--- a/modules.d/90qemu/module-setup.sh ++++ b/modules.d/90qemu/module-setup.sh +@@ -19,4 +19,7 @@ installkernel() { + virtio_scsi virtio_console virtio_rng virtio_mem \ + spapr-vscsi \ + qemu_fw_cfg ++ ++ # needed for displaying console properly ++ hostonly='' instmods bochs + } diff --git a/SPECS/dracut.spec b/SPECS/dracut.spec index fb0524f..8bb6a63 100644 --- a/SPECS/dracut.spec +++ b/SPECS/dracut.spec @@ -5,7 +5,7 @@ # strip the automatically generated dep here and instead co-own the # directory. %global __requires_exclude pkg-config -%define dist_free_release 110.git20260130 +%define dist_free_release 126.git20260813 Name: dracut Version: 057 @@ -135,6 +135,19 @@ Patch106: 0106.patch Patch107: 0107.patch Patch108: 0108.patch Patch109: 0109.patch +Patch111: 0111.patch +Patch112: 0112.patch +Patch113: 0113.patch +Patch114: 0114.patch +Patch115: 0115.patch +Patch116: 0116.patch +Patch117: 0117.patch +Patch120: 0120.patch +Patch121: 0121.patch +Patch122: 0122.patch +Patch123: 0123.patch +Patch124: 0124.patch +Patch125: 0125.patch Source1: https://www.gnu.org/licenses/lgpl-2.1.txt @@ -591,6 +604,23 @@ echo 'dracut_rescue_image="yes"' > $RPM_BUILD_ROOT%{dracutlibdir}/dracut.conf.d/ %{_prefix}/lib/kernel/install.d/51-dracut-rescue.install %changelog +* Thu Aug 13 2026 Pavel Valena - 057-126.git20260813 +- fix(dracut): rework timeout for devices added via --mount and +- fix(base): escape die() message in emergency hook script +- fix(base): replace eval with safe variable indirection in +- refactor(cms): use zdev to simplify handling CMSDASD=... boot +- refactor(cms): use consolidated dasd config with zdev from +- fix(qemu): add missing bochs module explicitly + +* Thu Jun 25 2026 Pavel Valena - 057-118.git20260624 +- feat(resume): add device used for resume +- fix(dracut): remove trailing null characters from SBATs when +- fix(network-legacy): replace `echo` writes with `printf` to +- fix(iscsi): replace `echo` writes with `printf` to prevent +- fix(network): warn on suspicious shell metacharacters in +- fix(base): escape arguments in initqueue hook script +- revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless + * Fri Jan 30 2026 Pavel Valena - 057-110.git20260130 - fix(systemd-repart): allow partition format - feat(install.d):according to the changes of