From 804569a4bb90a440d777c045c5f4cc4aa844b193 Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Tue, 28 Jul 2026 05:10:09 +0200 Subject: [PATCH] fix(base): escape die() message in emergency hook script MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit die() appends its error message to $hookdir/emergency/01-die.sh using echo "warn dracut: FATAL: \"$*\"", which is later sourced by emergency_shell(). When die() is called with DHCP-controlled data — specifically $netroot derived from the DHCP ROOT_PATH option via netroot.sh's handler-resolution failure path — a command-substitution sequence such as $(cmd) embedded in that data executes as root when dracut sources the emergency hook directory. Replace `echo` with `printf '%q'` to shell-escape the message before writing it into the hook script, preventing command injection via DHCP-controlled values that reach die() through error paths. Co-Authored-By: Claude Opus 4.6 (cherry picked from commit 626ec6752ec5eb6902c2a2424f58b8873b34c7a0) Resolves: RHEL-210940 --- modules.d/99base/dracut-lib.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh index 43b023e14..b1ea95255 100755 --- a/modules.d/99base/dracut-lib.sh +++ b/modules.d/99base/dracut-lib.sh @@ -451,7 +451,7 @@ die() { } > /dev/kmsg { - echo "warn dracut: FATAL: \"$*\"" + printf 'warn dracut: FATAL: %q\n' "$*" echo "warn dracut: Refusing to continue" } >> $hookdir/emergency/01-die.sh [ -d /run/initramfs ] || mkdir -p -- /run/initramfs