import UBI dracut-107-9.el10_2
This commit is contained in:
AlmaLinux RelEng Bot
parent
db147c7875
commit
5993b1add6
@ -0,0 +1,45 @@
|
||||
From 508599e7864c8902bbc5480a0f4d20804d9dd41a Mon Sep 17 00:00:00 2001
|
||||
From: Pavel Valena <pvalena@redhat.com>
|
||||
Date: Tue, 28 Jul 2026 04:03:13 +0200
|
||||
Subject: [PATCH 38/38] fix(base): escape die() message in emergency hook
|
||||
script
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
die() appends its error message to $hookdir/emergency/01-die.sh using
|
||||
echo "warn dracut: FATAL: \"$*\"", which is later sourced by
|
||||
emergency_shell(). When die() is called with DHCP-controlled data —
|
||||
specifically $netroot derived from the DHCP ROOT_PATH option via
|
||||
netroot.sh's handler-resolution failure path — a command-substitution
|
||||
sequence such as $(cmd) embedded in that data executes as root when
|
||||
dracut sources the emergency hook directory.
|
||||
|
||||
Replace `echo` with `printf '%q'` to shell-escape the message before
|
||||
writing it into the hook script, preventing command injection via
|
||||
DHCP-controlled values that reach die() through error paths.
|
||||
|
||||
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
||||
|
||||
Resolves: RHEL-210942
|
||||
---
|
||||
modules.d/99base/dracut-lib.sh | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
|
||||
index 05c361c6..855305b3 100755
|
||||
--- a/modules.d/99base/dracut-lib.sh
|
||||
+++ b/modules.d/99base/dracut-lib.sh
|
||||
@@ -410,7 +410,8 @@ die() {
|
||||
} > /dev/kmsg
|
||||
|
||||
{
|
||||
- echo "warn dracut: FATAL: \"$*\""
|
||||
+ printf 'warn dracut: FATAL: %q\n' "$*"
|
||||
+
|
||||
echo "warn dracut: Refusing to continue"
|
||||
} >> $hookdir/emergency/01-die.sh
|
||||
[ -d /run/initramfs ] || mkdir -p -- /run/initramfs
|
||||
--
|
||||
2.55.0
|
||||
|
||||
@ -0,0 +1,61 @@
|
||||
From fb2cf96988040a6ef21074024b41c2d322f14452 Mon Sep 17 00:00:00 2001
|
||||
From: Pavel Valena <pvalena@redhat.com>
|
||||
Date: Thu, 7 May 2026 00:59:05 +0200
|
||||
Subject: [PATCH 39/39] fix(base): replace eval with safe variable indirection
|
||||
in splitsep and export_n
|
||||
|
||||
splitsep: use local nameref to avoid eval injection via single-quote breakout.
|
||||
export_n: use ${!var} and printf -v to avoid eval injection via double-quote breakout.
|
||||
|
||||
(cherry picked from commit 1488eb683109cc5b2e5e038e1e89851ab0cd9508)
|
||||
|
||||
Related: RHEL-210942
|
||||
---
|
||||
modules.d/99base/dracut-lib.sh | 15 ++++++++++-----
|
||||
1 file changed, 10 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
|
||||
index 855305b3..48dfd590 100755
|
||||
--- a/modules.d/99base/dracut-lib.sh
|
||||
+++ b/modules.d/99base/dracut-lib.sh
|
||||
@@ -329,12 +329,18 @@ splitsep() {
|
||||
|
||||
while [ -n "$str" ] && [ "$#" -gt 1 ]; do
|
||||
tmp="${str%%"$sep"*}"
|
||||
- eval "$1='${tmp}'"
|
||||
+ local -n _splitsep_ref="$1"
|
||||
+ _splitsep_ref="$tmp"
|
||||
+ unset -n _splitsep_ref
|
||||
str="${str#"$tmp"}"
|
||||
str="${str#"$sep"}"
|
||||
shift
|
||||
done
|
||||
- [ -n "$str" ] && [ -n "$1" ] && eval "$1='$str'"
|
||||
+ if [ -n "$str" -a -n "$1" ]; then
|
||||
+ local -n _splitsep_ref="$1"
|
||||
+ _splitsep_ref="$str"
|
||||
+ unset -n _splitsep_ref
|
||||
+ fi
|
||||
debug_on
|
||||
return 0
|
||||
}
|
||||
@@ -923,14 +929,13 @@ emergency_shell() {
|
||||
}
|
||||
|
||||
# Retain the values of these variables but ensure that they are unexported
|
||||
-# This is a POSIX-compliant equivalent of bash's "export -n"
|
||||
export_n() {
|
||||
local var
|
||||
local val
|
||||
for var in "$@"; do
|
||||
- eval "val=\$$var"
|
||||
+ val="${!var}"
|
||||
unset "$var"
|
||||
- [ -n "$val" ] && eval "$var=\"$val\""
|
||||
+ [ -n "$val" ] && printf -v "$var" '%s' "$val"
|
||||
done
|
||||
}
|
||||
|
||||
--
|
||||
2.55.0
|
||||
|
||||
12
dracut.spec
12
dracut.spec
@ -8,7 +8,7 @@
|
||||
|
||||
Name: dracut
|
||||
Version: 107
|
||||
Release: 8%{?dist}
|
||||
Release: 9%{?dist}
|
||||
|
||||
Summary: Initramfs generator using udev
|
||||
|
||||
@ -133,6 +133,12 @@ Patch36: 0036-fix-systemd-networkd-escape-DHCP-lease-values-in-dhc.patch
|
||||
# revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless excluded"
|
||||
# Author: Pavel Valena <pvalena@redhat.com>
|
||||
Patch37: 0037-revert-feat-i18n-pull-drm-or-simpledrm-module-unless.patch
|
||||
# fix(base): escape die() message in emergency hook script
|
||||
# Author: Pavel Valena <pvalena@redhat.com>
|
||||
Patch38: 0038-fix-base-escape-die-message-in-emergency-hook-script.patch
|
||||
# fix(base): replace eval with safe variable indirection in splitsep and export_n
|
||||
# Author: Pavel Valena <pvalena@redhat.com>
|
||||
Patch39: 0039-fix-base-replace-eval-with-safe-variable-indirection.patch
|
||||
|
||||
# Please use source-git to work with this spec file:
|
||||
# HowTo: https://packit.dev/source-git/work-with-source-git
|
||||
@ -555,6 +561,10 @@ echo 'dracut_rescue_image="yes"' > $RPM_BUILD_ROOT%{dracutlibdir}/dracut.conf.d/
|
||||
%{_prefix}/lib/kernel/install.d/51-dracut-rescue.install
|
||||
|
||||
%changelog
|
||||
* Tue Jul 28 2026 Pavel Valena <pvalena@redhat.com> - 107-9
|
||||
- fix(base): escape die() message in emergency hook script
|
||||
- fix(base): replace eval with safe variable indirection in splitsep and export_n
|
||||
|
||||
* Thu Jun 25 2026 Pavel Valena <pvalena@redhat.com> - 107-8
|
||||
- revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless excluded"
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user