From ebf37ee6705041e978718c699c7cbe1def995b4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zaoral?= <lzaoral@redhat.com>
Date: Tue, 11 Aug 2026 16:15:28 +0200
Subject: [PATCH] Mark ISO filesystem labels as write protected

Resolves: RHEL-160930
---
 ...O-labels-write-protected-RHEL-143987.patch | 67 +++++++++++++++++++
 rear.spec                                     |  4 ++
 2 files changed, 71 insertions(+)
 create mode 100644 rear-mark-ISO-labels-write-protected-RHEL-143987.patch

diff --git a/rear-mark-ISO-labels-write-protected-RHEL-143987.patch b/rear-mark-ISO-labels-write-protected-RHEL-143987.patch
new file mode 100644
index 0000000..65dba5d
--- /dev/null
+++ b/rear-mark-ISO-labels-write-protected-RHEL-143987.patch
@@ -0,0 +1,67 @@
+From cc5fdf86845923414ff44e6636ee261b6a495897 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zaoral?= <lzaoral@redhat.com>
+Date: Fri, 27 Mar 2026 20:23:34 +0100
+Subject: [PATCH] ISO: mark ISO filesystem labels as write protected
+
+The majority of these changes have been made using Claude.
+
+Assisted-by: Cursor with Claude Opus 4.6
+
+(cherry picked from commit cc5fdf86845923414ff44e6636ee261b6a495897)
+---
+ usr/share/rear/conf/default.conf              |  5 ++++-
+ .../480_initialize_write_protect_settings.sh  | 19 +++++++++++++++++++
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+ create mode 100644 usr/share/rear/prep/ISO/default/480_initialize_write_protect_settings.sh
+
+diff --git a/usr/share/rear/conf/default.conf b/usr/share/rear/conf/default.conf
+index e170b21ea..a8e6990a6 100644
+--- a/usr/share/rear/conf/default.conf
++++ b/usr/share/rear/conf/default.conf
+@@ -717,7 +717,7 @@ AUTOINCREASE_DISK_SIZE_THRESHOLD_PERCENTAGE=10
+ 
+ ##
+ # Write-protection during "rear recover"
+-# for OUTPUT=USB and OUTPUT=RAWDISK
++# for OUTPUT=USB, OUTPUT=ISO and OUTPUT=RAWDISK
+ #
+ # Designate disks via disk specific IDs or file system labels as write-protected
+ # to avoid that those disks could get used as target disk during "rear recover"
+@@ -755,6 +755,9 @@ WRITE_PROTECTED_IDS=()
+ # Example: WRITE_PROTECTED_FS_LABEL_PATTERNS+=( "Backup *" )
+ # For OUTPUT=USB the file system label of the ReaR data partition on the ReaR recovery system disk
+ # is automatically added to WRITE_PROTECTED_FS_LABEL_PATTERNS during "rear mkrescue/mkbackup".
++# For OUTPUT=ISO the ISO filesystem label (ISO_VOLID, default 'REAR-ISO') and patterns
++# for split ISOs (${ISO_VOLID}_*) are automatically added during "rear mkrescue/mkbackup"
++# so that a device from which the ISO was booted is protected from being overwritten.
+ WRITE_PROTECTED_FS_LABEL_PATTERNS=()
+ 
+ ##
+diff --git a/usr/share/rear/prep/ISO/default/480_initialize_write_protect_settings.sh b/usr/share/rear/prep/ISO/default/480_initialize_write_protect_settings.sh
+new file mode 100644
+index 000000000..7bd1bc600
+--- /dev/null
++++ b/usr/share/rear/prep/ISO/default/480_initialize_write_protect_settings.sh
+@@ -0,0 +1,19 @@
++# Generated by Cursor with Claude Opus 4.6
++#
++# ISO output may be written to a writable medium (e.g. USB stick) which
++# should be protected against overwriting by "rear recover"
++# cf. https://github.com/rear/rear/issues/1271
++# This code registers the ISO filesystem label as write-protected.
++# CD/DVD media (sr0, sr1, ...) are inherently protected by the removable device
++# check in layout/prepare/default/250_compare_disks.sh and 300_map_disks.sh
++# but ISOs booted from writable media (e.g. USB sticks or hard disks) need
++# explicit write protection, analogous to what OUTPUT=USB does.
++
++# The ISO_VOLID label (default 'REAR-ISO', see default.conf) is added
++# to WRITE_PROTECTED_FS_LABEL_PATTERNS.
++# When the backup is split on multiple ISOs (cf. ISO_MAX_SIZE)
++# the first ISO has the label $ISO_VOLID and subsequent ISOs get
++# the labels ${ISO_VOLID}_01 ${ISO_VOLID}_02 ... respectively
++# so the glob pattern '${ISO_VOLID}_*' is used to match all of them.
++WRITE_PROTECTED_FS_LABEL_PATTERNS+=( "${ISO_VOLID}" "${ISO_VOLID}_*" )
++DebugPrint "ISO filesystem label patterns '${ISO_VOLID}' and '${ISO_VOLID}_*' added to WRITE_PROTECTED_FS_LABEL_PATTERNS"
+-- 
+2.55.0
+
diff --git a/rear.spec b/rear.spec
index 7434d41..3845550 100644
--- a/rear.spec
+++ b/rear.spec
@@ -153,6 +153,10 @@ Patch136: rear-do-not-use-backup-disk-for-recovery-RHEL-111612.patch
 # https://github.com/rear/rear/commit/626701843a32070080856c960b9e4202102b81d1
 Patch137: rear-respect-EXCLUDE_COMPONENTS-in-extract_partitions-RHEL-235767.patch
 
+# mark ISO filesystem labels as write protected
+# https://github.com/rear/rear/commit/014a7653b56f9ab8471af591ddf3698d08f0f290
+Patch138: rear-mark-ISO-labels-write-protected-RHEL-143987.patch
+
 ######################
 # downstream patches #
 ######################