46 lines
1.6 KiB
Diff
46 lines
1.6 KiB
Diff
From 508599e7864c8902bbc5480a0f4d20804d9dd41a Mon Sep 17 00:00:00 2001
|
|
From: Pavel Valena <pvalena@redhat.com>
|
|
Date: Tue, 28 Jul 2026 04:03:13 +0200
|
|
Subject: [PATCH 38/38] fix(base): escape die() message in emergency hook
|
|
script
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
die() appends its error message to $hookdir/emergency/01-die.sh using
|
|
echo "warn dracut: FATAL: \"$*\"", which is later sourced by
|
|
emergency_shell(). When die() is called with DHCP-controlled data —
|
|
specifically $netroot derived from the DHCP ROOT_PATH option via
|
|
netroot.sh's handler-resolution failure path — a command-substitution
|
|
sequence such as $(cmd) embedded in that data executes as root when
|
|
dracut sources the emergency hook directory.
|
|
|
|
Replace `echo` with `printf '%q'` to shell-escape the message before
|
|
writing it into the hook script, preventing command injection via
|
|
DHCP-controlled values that reach die() through error paths.
|
|
|
|
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
|
|
Resolves: RHEL-210942
|
|
---
|
|
modules.d/99base/dracut-lib.sh | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
|
|
index 05c361c6..855305b3 100755
|
|
--- a/modules.d/99base/dracut-lib.sh
|
|
+++ b/modules.d/99base/dracut-lib.sh
|
|
@@ -410,7 +410,8 @@ die() {
|
|
} > /dev/kmsg
|
|
|
|
{
|
|
- echo "warn dracut: FATAL: \"$*\""
|
|
+ printf 'warn dracut: FATAL: %q\n' "$*"
|
|
+
|
|
echo "warn dracut: Refusing to continue"
|
|
} >> $hookdir/emergency/01-die.sh
|
|
[ -d /run/initramfs ] || mkdir -p -- /run/initramfs
|
|
--
|
|
2.55.0
|
|
|