From 5993b1add6f1eeff8998d2f491d5afb158b05539 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Thu, 13 Aug 2026 19:06:35 -0400 Subject: [PATCH] import UBI dracut-107-9.el10_2 --- ...die-message-in-emergency-hook-script.patch | 45 ++++++++++++++ ...-eval-with-safe-variable-indirection.patch | 61 +++++++++++++++++++ dracut.spec | 12 +++- 3 files changed, 117 insertions(+), 1 deletion(-) create mode 100644 0038-fix-base-escape-die-message-in-emergency-hook-script.patch create mode 100644 0039-fix-base-replace-eval-with-safe-variable-indirection.patch diff --git a/0038-fix-base-escape-die-message-in-emergency-hook-script.patch b/0038-fix-base-escape-die-message-in-emergency-hook-script.patch new file mode 100644 index 0000000..fb6f946 --- /dev/null +++ b/0038-fix-base-escape-die-message-in-emergency-hook-script.patch @@ -0,0 +1,45 @@ +From 508599e7864c8902bbc5480a0f4d20804d9dd41a Mon Sep 17 00:00:00 2001 +From: Pavel Valena +Date: Tue, 28 Jul 2026 04:03:13 +0200 +Subject: [PATCH 38/38] fix(base): escape die() message in emergency hook + script +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +die() appends its error message to $hookdir/emergency/01-die.sh using +echo "warn dracut: FATAL: \"$*\"", which is later sourced by +emergency_shell(). When die() is called with DHCP-controlled data — +specifically $netroot derived from the DHCP ROOT_PATH option via +netroot.sh's handler-resolution failure path — a command-substitution +sequence such as $(cmd) embedded in that data executes as root when +dracut sources the emergency hook directory. + +Replace `echo` with `printf '%q'` to shell-escape the message before +writing it into the hook script, preventing command injection via +DHCP-controlled values that reach die() through error paths. + +Co-Authored-By: Claude Opus 4.6 + +Resolves: RHEL-210942 +--- + modules.d/99base/dracut-lib.sh | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh +index 05c361c6..855305b3 100755 +--- a/modules.d/99base/dracut-lib.sh ++++ b/modules.d/99base/dracut-lib.sh +@@ -410,7 +410,8 @@ die() { + } > /dev/kmsg + + { +- echo "warn dracut: FATAL: \"$*\"" ++ printf 'warn dracut: FATAL: %q\n' "$*" ++ + echo "warn dracut: Refusing to continue" + } >> $hookdir/emergency/01-die.sh + [ -d /run/initramfs ] || mkdir -p -- /run/initramfs +-- +2.55.0 + diff --git a/0039-fix-base-replace-eval-with-safe-variable-indirection.patch b/0039-fix-base-replace-eval-with-safe-variable-indirection.patch new file mode 100644 index 0000000..9a59666 --- /dev/null +++ b/0039-fix-base-replace-eval-with-safe-variable-indirection.patch @@ -0,0 +1,61 @@ +From fb2cf96988040a6ef21074024b41c2d322f14452 Mon Sep 17 00:00:00 2001 +From: Pavel Valena +Date: Thu, 7 May 2026 00:59:05 +0200 +Subject: [PATCH 39/39] fix(base): replace eval with safe variable indirection + in splitsep and export_n + +splitsep: use local nameref to avoid eval injection via single-quote breakout. +export_n: use ${!var} and printf -v to avoid eval injection via double-quote breakout. + +(cherry picked from commit 1488eb683109cc5b2e5e038e1e89851ab0cd9508) + +Related: RHEL-210942 +--- + modules.d/99base/dracut-lib.sh | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh +index 855305b3..48dfd590 100755 +--- a/modules.d/99base/dracut-lib.sh ++++ b/modules.d/99base/dracut-lib.sh +@@ -329,12 +329,18 @@ splitsep() { + + while [ -n "$str" ] && [ "$#" -gt 1 ]; do + tmp="${str%%"$sep"*}" +- eval "$1='${tmp}'" ++ local -n _splitsep_ref="$1" ++ _splitsep_ref="$tmp" ++ unset -n _splitsep_ref + str="${str#"$tmp"}" + str="${str#"$sep"}" + shift + done +- [ -n "$str" ] && [ -n "$1" ] && eval "$1='$str'" ++ if [ -n "$str" -a -n "$1" ]; then ++ local -n _splitsep_ref="$1" ++ _splitsep_ref="$str" ++ unset -n _splitsep_ref ++ fi + debug_on + return 0 + } +@@ -923,14 +929,13 @@ emergency_shell() { + } + + # Retain the values of these variables but ensure that they are unexported +-# This is a POSIX-compliant equivalent of bash's "export -n" + export_n() { + local var + local val + for var in "$@"; do +- eval "val=\$$var" ++ val="${!var}" + unset "$var" +- [ -n "$val" ] && eval "$var=\"$val\"" ++ [ -n "$val" ] && printf -v "$var" '%s' "$val" + done + } + +-- +2.55.0 + diff --git a/dracut.spec b/dracut.spec index 17ac233..3e57afa 100644 --- a/dracut.spec +++ b/dracut.spec @@ -8,7 +8,7 @@ Name: dracut Version: 107 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Initramfs generator using udev @@ -133,6 +133,12 @@ Patch36: 0036-fix-systemd-networkd-escape-DHCP-lease-values-in-dhc.patch # revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless excluded" # Author: Pavel Valena Patch37: 0037-revert-feat-i18n-pull-drm-or-simpledrm-module-unless.patch +# fix(base): escape die() message in emergency hook script +# Author: Pavel Valena +Patch38: 0038-fix-base-escape-die-message-in-emergency-hook-script.patch +# fix(base): replace eval with safe variable indirection in splitsep and export_n +# Author: Pavel Valena +Patch39: 0039-fix-base-replace-eval-with-safe-variable-indirection.patch # Please use source-git to work with this spec file: # HowTo: https://packit.dev/source-git/work-with-source-git @@ -555,6 +561,10 @@ echo 'dracut_rescue_image="yes"' > $RPM_BUILD_ROOT%{dracutlibdir}/dracut.conf.d/ %{_prefix}/lib/kernel/install.d/51-dracut-rescue.install %changelog +* Tue Jul 28 2026 Pavel Valena - 107-9 +- fix(base): escape die() message in emergency hook script +- fix(base): replace eval with safe variable indirection in splitsep and export_n + * Thu Jun 25 2026 Pavel Valena - 107-8 - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless excluded"