rpms/rear
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Mark ISO filesystem labels as write protected

Browse Source 
Resolves: RHEL-160930
This commit is contained in:
Lukáš Zaoral 2026-08-11 16:15:28 +02:00
parent 400b499917
commit ebf37ee670
No known key found for this signature in database
GPG Key ID: 39157506DD67752D
2 changed files with 71 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
rear-mark-ISO-labels-write-protected-RHEL-143987.patch Normal file
View File

@ -0,0 +1,67 @@
From cc5fdf86845923414ff44e6636ee261b6a495897 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zaoral?= <lzaoral@redhat.com>
Date: Fri, 27 Mar 2026 20:23:34 +0100
Subject: [PATCH] ISO: mark ISO filesystem labels as write protected
The majority of these changes have been made using Claude.
Assisted-by: Cursor with Claude Opus 4.6
(cherry picked from commit cc5fdf86845923414ff44e6636ee261b6a495897)
---
usr/share/rear/conf/default.conf | 5 ++++-
.../480_initialize_write_protect_settings.sh | 19 +++++++++++++++++++
2 files changed, 23 insertions(+), 1 deletion(-)
create mode 100644 usr/share/rear/prep/ISO/default/480_initialize_write_protect_settings.sh
diff --git a/usr/share/rear/conf/default.conf b/usr/share/rear/conf/default.conf
index e170b21ea..a8e6990a6 100644
--- a/usr/share/rear/conf/default.conf
+++ b/usr/share/rear/conf/default.conf
@@ -717,7 +717,7 @@ AUTOINCREASE_DISK_SIZE_THRESHOLD_PERCENTAGE=10
##
# Write-protection during "rear recover"
-# for OUTPUT=USB and OUTPUT=RAWDISK
+# for OUTPUT=USB, OUTPUT=ISO and OUTPUT=RAWDISK
#
# Designate disks via disk specific IDs or file system labels as write-protected
# to avoid that those disks could get used as target disk during "rear recover"
@@ -755,6 +755,9 @@ WRITE_PROTECTED_IDS=()
# Example: WRITE_PROTECTED_FS_LABEL_PATTERNS+=( "Backup *" )
# For OUTPUT=USB the file system label of the ReaR data partition on the ReaR recovery system disk
# is automatically added to WRITE_PROTECTED_FS_LABEL_PATTERNS during "rear mkrescue/mkbackup".
+# For OUTPUT=ISO the ISO filesystem label (ISO_VOLID, default 'REAR-ISO') and patterns
+# for split ISOs (${ISO_VOLID}_*) are automatically added during "rear mkrescue/mkbackup"
+# so that a device from which the ISO was booted is protected from being overwritten.
WRITE_PROTECTED_FS_LABEL_PATTERNS=()
##
diff --git a/usr/share/rear/prep/ISO/default/480_initialize_write_protect_settings.sh b/usr/share/rear/prep/ISO/default/480_initialize_write_protect_settings.sh
new file mode 100644
index 000000000..7bd1bc600
--- /dev/null
+++ b/usr/share/rear/prep/ISO/default/480_initialize_write_protect_settings.sh
@@ -0,0 +1,19 @@
+# Generated by Cursor with Claude Opus 4.6
+#
+# ISO output may be written to a writable medium (e.g. USB stick) which
+# should be protected against overwriting by "rear recover"
+# cf. https://github.com/rear/rear/issues/1271
+# This code registers the ISO filesystem label as write-protected.
+# CD/DVD media (sr0, sr1, ...) are inherently protected by the removable device
+# check in layout/prepare/default/250_compare_disks.sh and 300_map_disks.sh
+# but ISOs booted from writable media (e.g. USB sticks or hard disks) need
+# explicit write protection, analogous to what OUTPUT=USB does.
+
+# The ISO_VOLID label (default 'REAR-ISO', see default.conf) is added
+# to WRITE_PROTECTED_FS_LABEL_PATTERNS.
+# When the backup is split on multiple ISOs (cf. ISO_MAX_SIZE)
+# the first ISO has the label $ISO_VOLID and subsequent ISOs get
+# the labels ${ISO_VOLID}_01 ${ISO_VOLID}_02 ... respectively
+# so the glob pattern '${ISO_VOLID}_*' is used to match all of them.
+WRITE_PROTECTED_FS_LABEL_PATTERNS+=( "${ISO_VOLID}" "${ISO_VOLID}_*" )
+DebugPrint "ISO filesystem label patterns '${ISO_VOLID}' and '${ISO_VOLID}_*' added to WRITE_PROTECTED_FS_LABEL_PATTERNS"
--
2.55.0

4
rear.spec
View File

@ -153,6 +153,10 @@ Patch136: rear-do-not-use-backup-disk-for-recovery-RHEL-111612.patch
# https://github.com/rear/rear/commit/626701843a32070080856c960b9e4202102b81d1
Patch137: rear-respect-EXCLUDE_COMPONENTS-in-extract_partitions-RHEL-235767.patch
# mark ISO filesystem labels as write protected
# https://github.com/rear/rear/commit/014a7653b56f9ab8471af591ddf3698d08f0f290
Patch138: rear-mark-ISO-labels-write-protected-RHEL-143987.patch
######################
# downstream patches #
######################