9afa387eea
(Includes partial revert of 8107ee642f9929e7e656fc52759816b51fbaef90.) - feat(resume): add device used for resume - fix(dracut): remove trailing null characters from SBATs when building UKIs - fix(network-legacy): replace `echo` writes with `printf` to prevent injection via DHCP - fix(iscsi): replace `echo` writes with `printf` to prevent variable injection - fix(network): warn on suspicious shell metacharacters in hostname file - fix(base): escape arguments in initqueue hook script generation - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless excluded" Resolves: RHEL-119785,RHEL-140458,RHEL-170858,RHEL-178488
72 lines
3.0 KiB
Diff
72 lines
3.0 KiB
Diff
From 9d48f561951fbcec26387e4ca626562bc9ee9b22 Mon Sep 17 00:00:00 2001
|
|
From: Pavel Valena <pvalena@redhat.com>
|
|
Date: Tue, 12 May 2026 03:27:22 +0200
|
|
Subject: [PATCH] fix(base): escape arguments in initqueue hook script
|
|
generation
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
initqueue.sh writes arguments directly into generated hook scripts
|
|
via `echo "$exe" "$@"`. These scripts are later sourced by
|
|
dracut-initqueue.sh, so shell metacharacters in arguments (e.g.
|
|
DHCP-derived $netroot passed from parse-iscsiroot.sh) execute as
|
|
root in initramfs.
|
|
|
|
Replace `echo` with `printf '%q'` to shell-escape all arguments
|
|
before writing them into the hook script, preventing command
|
|
injection via DHCP-controlled netroot values.
|
|
|
|
Remove the fragile embedded single-quote wrapping ("'$var'") from
|
|
parse-iscsiroot.sh call sites (lines 90, 102) — those relied on
|
|
echo writing quotes verbatim for the shell to strip when sourcing.
|
|
With printf '%q', initqueue now handles escaping centrally, so the
|
|
manual wrapping is no longer needed and would cause literal quote
|
|
characters to leak into iscsiroot arguments.
|
|
|
|
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
|
|
Related: RHEL-170858
|
|
---
|
|
modules.d/95iscsi/parse-iscsiroot.sh | 4 ++--
|
|
modules.d/99base/initqueue.sh | 3 ++-
|
|
2 files changed, 4 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/modules.d/95iscsi/parse-iscsiroot.sh b/modules.d/95iscsi/parse-iscsiroot.sh
|
|
index 1a102b12..80aae95f 100755
|
|
--- a/modules.d/95iscsi/parse-iscsiroot.sh
|
|
+++ b/modules.d/95iscsi/parse-iscsiroot.sh
|
|
@@ -87,7 +87,7 @@ if [ -n "$iscsi_firmware" ]; then
|
|
echo "${DRACUT_SYSTEMD+systemctl is-active initrd-root-device.target || }[ -f '/tmp/iscsistarted-firmware' ]" > "$hookdir"/initqueue/finished/iscsi_started.sh
|
|
initqueue --unique --online /sbin/iscsiroot online "iscsi:" "$NEWROOT"
|
|
initqueue --unique --onetime --timeout /sbin/iscsiroot timeout "iscsi:" "$NEWROOT"
|
|
- initqueue --unique --onetime --settled /sbin/iscsiroot online "iscsi:" "'$NEWROOT'"
|
|
+ initqueue --unique --onetime --settled /sbin/iscsiroot online "iscsi:" "$NEWROOT"
|
|
fi
|
|
|
|
# ISCSI actually supported?
|
|
@@ -99,7 +99,7 @@ modprobe --all -b -q qla4xxx cxgb3i cxgb4i bnx2i be2iscsi
|
|
|
|
if [ -n "$netroot" ] && [ "$root" != "/dev/root" ] && [ "$root" != "dhcp" ]; then
|
|
if ! getargbool 1 rd.neednet > /dev/null || ! getarg "ip="; then
|
|
- initqueue --unique --onetime --settled /sbin/iscsiroot dummy "'$netroot'" "'$NEWROOT'"
|
|
+ initqueue --unique --onetime --settled /sbin/iscsiroot dummy "$netroot" "$NEWROOT"
|
|
fi
|
|
fi
|
|
|
|
diff --git a/modules.d/99base/initqueue.sh b/modules.d/99base/initqueue.sh
|
|
index 2c490793..672effd6 100755
|
|
--- a/modules.d/99base/initqueue.sh
|
|
+++ b/modules.d/99base/initqueue.sh
|
|
@@ -64,7 +64,8 @@ fi
|
|
# shellcheck disable=SC2016
|
|
[ -n "$onetime" ] && echo '[ -e "$job" ] && rm -f -- "$job"'
|
|
[ -n "$env" ] && echo "$env"
|
|
- echo "$exe" "$@"
|
|
+ printf '%q ' "$exe" "$@"
|
|
+ printf '\n'
|
|
} > "/tmp/$$-${job}.sh"
|
|
|
|
mv -f "/tmp/$$-${job}.sh" "$hookdir/initqueue${qname}/${job}.sh"
|
|
|