42 lines
1.6 KiB
Diff
42 lines
1.6 KiB
Diff
From 626ec6752ec5eb6902c2a2424f58b8873b34c7a0 Mon Sep 17 00:00:00 2001
|
|
From: Pavel Valena <pvalena@redhat.com>
|
|
Date: Tue, 28 Jul 2026 05:10:09 +0200
|
|
Subject: [PATCH] fix(base): escape die() message in emergency hook script
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
die() appends its error message to $hookdir/emergency/01-die.sh using
|
|
echo "warn dracut: FATAL: \"$*\"", which is later sourced by
|
|
emergency_shell(). When die() is called with DHCP-controlled data —
|
|
specifically $netroot derived from the DHCP ROOT_PATH option via
|
|
netroot.sh's handler-resolution failure path — a command-substitution
|
|
sequence such as $(cmd) embedded in that data executes as root when
|
|
dracut sources the emergency hook directory.
|
|
|
|
Replace `echo` with `printf '%q'` to shell-escape the message before
|
|
writing it into the hook script, preventing command injection via
|
|
DHCP-controlled values that reach die() through error paths.
|
|
|
|
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
|
|
Resolves: RHEL-210939
|
|
---
|
|
modules.d/99base/dracut-lib.sh | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
|
|
index 43b023e14..b1ea95255 100755
|
|
--- a/modules.d/99base/dracut-lib.sh
|
|
+++ b/modules.d/99base/dracut-lib.sh
|
|
@@ -451,7 +451,7 @@ die() {
|
|
} > /dev/kmsg
|
|
|
|
{
|
|
- echo "warn dracut: FATAL: \"$*\""
|
|
+ printf 'warn dracut: FATAL: %q\n' "$*"
|
|
echo "warn dracut: Refusing to continue"
|
|
} >> $hookdir/emergency/01-die.sh
|
|
[ -d /run/initramfs ] || mkdir -p -- /run/initramfs
|
|
|