73 lines
3.1 KiB
Diff
73 lines
3.1 KiB
Diff
From eaf700abda3eb7a1f7eecd6b8f374adc4bfe6349 Mon Sep 17 00:00:00 2001
|
|
From: Pavel Valena <pvalena@redhat.com>
|
|
Date: Tue, 12 May 2026 03:27:22 +0200
|
|
Subject: [PATCH] fix(base): escape arguments in initqueue hook script
|
|
generation
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
initqueue.sh writes arguments directly into generated hook scripts
|
|
via `echo "$exe" "$@"`. These scripts are later sourced by
|
|
dracut-initqueue.sh, so shell metacharacters in arguments (e.g.
|
|
DHCP-derived $netroot passed from parse-iscsiroot.sh) execute as
|
|
root in initramfs.
|
|
|
|
Replace `echo` with `printf '%q'` to shell-escape all arguments
|
|
before writing them into the hook script, preventing command
|
|
injection via DHCP-controlled netroot values.
|
|
|
|
Remove the fragile embedded single-quote wrapping ("'$var'") from
|
|
parse-iscsiroot.sh call sites (lines 90, 102) — those relied on
|
|
echo writing quotes verbatim for the shell to strip when sourcing.
|
|
With printf '%q', initqueue now handles escaping centrally, so the
|
|
manual wrapping is no longer needed and would cause literal quote
|
|
characters to leak into iscsiroot arguments.
|
|
|
|
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
|
|
Related: RHEL-170847
|
|
---
|
|
modules.d/95iscsi/parse-iscsiroot.sh | 6 +++---
|
|
modules.d/99base/initqueue.sh | 3 ++-
|
|
2 files changed, 5 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/modules.d/95iscsi/parse-iscsiroot.sh b/modules.d/95iscsi/parse-iscsiroot.sh
|
|
index 1a26041d..241f1bdd 100755
|
|
--- a/modules.d/95iscsi/parse-iscsiroot.sh
|
|
+++ b/modules.d/95iscsi/parse-iscsiroot.sh
|
|
@@ -87,7 +87,7 @@ if [ -n "$iscsi_firmware" ]; then
|
|
echo "${DRACUT_SYSTEMD+systemctl is-active initrd-root-device.target || }[ -f '/tmp/iscsistarted-firmware' ]" > $hookdir/initqueue/finished/iscsi_started.sh
|
|
initqueue --unique --online /sbin/iscsiroot online "iscsi:" "$NEWROOT"
|
|
initqueue --unique --onetime --timeout /sbin/iscsiroot timeout "iscsi:" "$NEWROOT"
|
|
- initqueue --unique --onetime --settled /sbin/iscsiroot online "iscsi:" "'$NEWROOT'"
|
|
+ initqueue --unique --onetime --settled /sbin/iscsiroot online "iscsi:" "$NEWROOT"
|
|
fi
|
|
|
|
# ISCSI actually supported?
|
|
@@ -98,8 +98,8 @@ fi
|
|
modprobe --all -b -q qla4xxx cxgb3i cxgb4i bnx2i be2iscsi
|
|
|
|
if [ -n "$netroot" ] && [ "$root" != "/dev/root" ] && [ "$root" != "dhcp" ]; then
|
|
- if ! getargbool 1 rd.neednet >/dev/null || ! getarg "ip="; then
|
|
- initqueue --unique --onetime --settled /sbin/iscsiroot dummy "'$netroot'" "'$NEWROOT'"
|
|
+ if ! getargbool 1 rd.neednet > /dev/null || ! getarg "ip="; then
|
|
+ initqueue --unique --onetime --settled /sbin/iscsiroot dummy "$netroot" "$NEWROOT"
|
|
fi
|
|
fi
|
|
|
|
diff --git a/modules.d/99base/initqueue.sh b/modules.d/99base/initqueue.sh
|
|
index c3016383..184414ab 100755
|
|
--- a/modules.d/99base/initqueue.sh
|
|
+++ b/modules.d/99base/initqueue.sh
|
|
@@ -52,7 +52,8 @@ fi
|
|
{
|
|
[ -n "$onetime" ] && echo '[ -e "$job" ] && rm -f -- "$job"'
|
|
[ -n "$env" ] && echo "$env"
|
|
- echo "$exe" "$@"
|
|
+ printf '%q ' "$exe" "$@"
|
|
+ printf '\n'
|
|
} > "/tmp/$$-${job}.sh"
|
|
|
|
mv -f "/tmp/$$-${job}.sh" "$hookdir/initqueue${qname}/${job}.sh"
|