import UBI dracut-049-246.git20260728.el8_10
This commit is contained in:
AlmaLinux RelEng Bot
parent
ad76d74847
commit
4285bae858
43
SOURCES/0244.patch
Normal file
43
SOURCES/0244.patch
Normal file
@ -0,0 +1,43 @@
|
||||
From d3d55e027b7628c7738d091fe301d8cb639cab24 Mon Sep 17 00:00:00 2001
|
||||
From: Pavel Valena <pvalena@redhat.com>
|
||||
Date: Tue, 28 Jul 2026 05:10:09 +0200
|
||||
Subject: [PATCH] fix(base): escape die() message in emergency hook script
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
die() appends its error message to $hookdir/emergency/01-die.sh using
|
||||
echo "warn dracut: FATAL: \"$*\"", which is later sourced by
|
||||
emergency_shell(). When die() is called with DHCP-controlled data —
|
||||
specifically $netroot derived from the DHCP ROOT_PATH option via
|
||||
netroot.sh's handler-resolution failure path — a command-substitution
|
||||
sequence such as $(cmd) embedded in that data executes as root when
|
||||
dracut sources the emergency hook directory.
|
||||
|
||||
Replace `echo` with `printf '%q'` to shell-escape the message before
|
||||
writing it into the hook script, preventing command injection via
|
||||
DHCP-controlled values that reach die() through error paths.
|
||||
|
||||
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
||||
|
||||
Resolves: RHEL-210935
|
||||
---
|
||||
modules.d/99base/dracut-lib.sh | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
|
||||
index 89a1d69ad..832435d21 100755
|
||||
--- a/modules.d/99base/dracut-lib.sh
|
||||
+++ b/modules.d/99base/dracut-lib.sh
|
||||
@@ -462,8 +462,8 @@ die() {
|
||||
} > /dev/kmsg
|
||||
|
||||
{
|
||||
- echo "warn dracut: FATAL: \"$*\"";
|
||||
- echo "warn dracut: Refusing to continue";
|
||||
+ printf 'warn dracut: FATAL: %q\n' "$*"
|
||||
+ echo "warn dracut: Refusing to continue"
|
||||
} >> $hookdir/emergency/01-die.sh
|
||||
[ -d /run/initramfs ] || mkdir -p -- /run/initramfs
|
||||
|
||||
|
||||
59
SOURCES/0245.patch
Normal file
59
SOURCES/0245.patch
Normal file
@ -0,0 +1,59 @@
|
||||
From b8f636d1cdcd2de0211cc5a7ad5424deee2a3568 Mon Sep 17 00:00:00 2001
|
||||
From: Pavel Valena <pvalena@redhat.com>
|
||||
Date: Wed, 29 Apr 2026 05:41:21 +0200
|
||||
Subject: [PATCH] fix(base): replace eval with safe variable indirection in
|
||||
splitsep and export_n
|
||||
|
||||
splitsep: use local nameref to avoid eval injection via single-quote breakout.
|
||||
export_n: use ${!var} and printf -v to avoid eval injection via double-quote breakout.
|
||||
|
||||
Related: RHEL-210935
|
||||
---
|
||||
modules.d/99base/dracut-lib.sh | 20 ++++++++++++--------
|
||||
1 file changed, 12 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
|
||||
index 832435d21..0a0604472 100755
|
||||
--- a/modules.d/99base/dracut-lib.sh
|
||||
+++ b/modules.d/99base/dracut-lib.sh
|
||||
@@ -395,12 +395,18 @@ splitsep() {
|
||||
|
||||
while [ -n "$str" -a "$#" -gt 1 ]; do
|
||||
tmp="${str%%$sep*}"
|
||||
- eval "$1='${tmp}'"
|
||||
+ local -n _splitsep_ref="$1"
|
||||
+ _splitsep_ref="$tmp"
|
||||
+ unset -n _splitsep_ref
|
||||
str="${str#"$tmp"}"
|
||||
str="${str#$sep}"
|
||||
shift
|
||||
done
|
||||
- [ -n "$str" -a -n "$1" ] && eval "$1='$str'"
|
||||
+ if [ -n "$str" -a -n "$1" ]; then
|
||||
+ local -n _splitsep_ref="$1"
|
||||
+ _splitsep_ref="$str"
|
||||
+ unset -n _splitsep_ref
|
||||
+ fi
|
||||
debug_on
|
||||
return 0
|
||||
}
|
||||
@@ -1168,15 +1174,13 @@ emergency_shell()
|
||||
}
|
||||
|
||||
# Retain the values of these variables but ensure that they are unexported
|
||||
-# This is a POSIX-compliant equivalent of bash's "export -n"
|
||||
-export_n()
|
||||
-{
|
||||
+export_n() {
|
||||
local var
|
||||
local val
|
||||
for var in "$@"; do
|
||||
- eval val=\$$var
|
||||
- unset $var
|
||||
- [ -n "$val" ] && eval $var=\"$val\"
|
||||
+ val="${!var}"
|
||||
+ unset "$var"
|
||||
+ [ -n "$val" ] && printf -v "$var" '%s' "$val"
|
||||
done
|
||||
}
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
# strip the automatically generated dep here and instead co-own the
|
||||
# directory.
|
||||
%global __requires_exclude pkg-config
|
||||
%define dist_free_release 244.git20260529
|
||||
%define dist_free_release 246.git20260728
|
||||
|
||||
Name: dracut
|
||||
Version: 049
|
||||
@ -271,6 +271,8 @@ Patch240: 0240.patch
|
||||
Patch241: 0241.patch
|
||||
Patch242: 0242.patch
|
||||
Patch243: 0243.patch
|
||||
Patch244: 0244.patch
|
||||
Patch245: 0245.patch
|
||||
|
||||
Source1: https://www.gnu.org/licenses/lgpl-2.1.txt
|
||||
|
||||
@ -727,6 +729,10 @@ echo '# Since rhel-8.3 dracut moved to use NetworkManager
|
||||
add_dracutmodules+=" network-legacy "' > /etc/dracut.conf.d/50-network-legacy.conf
|
||||
|
||||
%changelog
|
||||
* Tue Jul 28 2026 Pavel Valena <pvalena@redhat.com> - 049-246.git20260728
|
||||
- fix(base): escape die() message in emergency hook script
|
||||
- fix(base): replace eval with safe variable indirection in
|
||||
|
||||
* Fri May 29 2026 Pavel Valena <pvalena@redhat.com> - 049-244.git20260529
|
||||
- fix(network-manager): escape DHCP lease values in dhcpopts
|
||||
- fix(network-legacy): replace `echo` writes with `printf` to
|
||||
|
||||
Loading…
Reference in New Issue
Block a user