From d3d55e027b7628c7738d091fe301d8cb639cab24 Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Tue, 28 Jul 2026 05:10:09 +0200 Subject: [PATCH] fix(base): escape die() message in emergency hook script MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit die() appends its error message to $hookdir/emergency/01-die.sh using echo "warn dracut: FATAL: \"$*\"", which is later sourced by emergency_shell(). When die() is called with DHCP-controlled data — specifically $netroot derived from the DHCP ROOT_PATH option via netroot.sh's handler-resolution failure path — a command-substitution sequence such as $(cmd) embedded in that data executes as root when dracut sources the emergency hook directory. Replace `echo` with `printf '%q'` to shell-escape the message before writing it into the hook script, preventing command injection via DHCP-controlled values that reach die() through error paths. Co-Authored-By: Claude Opus 4.6 Resolves: RHEL-210935 --- modules.d/99base/dracut-lib.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh index 89a1d69ad..832435d21 100755 --- a/modules.d/99base/dracut-lib.sh +++ b/modules.d/99base/dracut-lib.sh @@ -462,8 +462,8 @@ die() { } > /dev/kmsg { - echo "warn dracut: FATAL: \"$*\""; - echo "warn dracut: Refusing to continue"; + printf 'warn dracut: FATAL: %q\n' "$*" + echo "warn dracut: Refusing to continue" } >> $hookdir/emergency/01-die.sh [ -d /run/initramfs ] || mkdir -p -- /run/initramfs