diff options
| author |   Mike Gilbert <floppym@gentoo.org> | 2021-07-23 15:13:04 -0400 |
|---|---|---|
| committer | Mike Gilbert <floppym@gentoo.org> | 2021-07-23 15:13:04 -0400 |
| commit | b11a0316d954d186df8c61aee62402ff6026c7dc (patch) | |
| tree | 8e665141d747f08b33a4b9af2d3c9501d4c9e7d6 /sys-kernel/dracut | |
| parent | mail-client/thunderbird: security cleanup (diff) | |
| download | gentoo-b11a0316d954d186df8c61aee62402ff6026c7dc.tar.gz gentoo-b11a0316d954d186df8c61aee62402ff6026c7dc.tar.bz2 gentoo-b11a0316d954d186df8c61aee62402ff6026c7dc.zip | |
sys-kernel/dracut: fix quoting issues
Closes: https://bugs.gentoo.org/803548
Signed-off-by: Mike Gilbert <floppym@gentoo.org>
Diffstat (limited to 'sys-kernel/dracut')
| -rw-r--r-- | sys-kernel/dracut/dracut-055-r1.ebuild (renamed from sys-kernel/dracut/dracut-055.ebuild) | 2 | ||||
| -rw-r--r-- | sys-kernel/dracut/files/055-fix-base-do-not-quote-initargs-for-switch_root.patch | 32 | ||||
| -rw-r--r-- | sys-kernel/dracut/files/055-fix-crypt-remove-quotes-from-cryptsetupopts.patch | 39 |
3 files changed, 73 insertions, 0 deletions
diff --git a/sys-kernel/dracut/dracut-055.ebuild b/sys-kernel/dracut/dracut-055-r1.ebuild index 3b042f3de741..e45745cf50f6 100644 --- a/sys-kernel/dracut/dracut-055.ebuild +++ b/sys-kernel/dracut/dracut-055-r1.ebuild @@ -60,6 +60,8 @@ BDEPEND=" QA_MULTILIB_PATHS="usr/lib/dracut/.*" PATCHES=( + "${FILESDIR}"/055-fix-crypt-remove-quotes-from-cryptsetupopts.patch + "${FILESDIR}"/055-fix-base-do-not-quote-initargs-for-switch_root.patch "${FILESDIR}"/gentoo-ldconfig-paths-r1.patch ) diff --git a/sys-kernel/dracut/files/055-fix-base-do-not-quote-initargs-for-switch_root.patch b/sys-kernel/dracut/files/055-fix-base-do-not-quote-initargs-for-switch_root.patch new file mode 100644 index 000000000000..5568c22aede6 --- /dev/null +++ b/sys-kernel/dracut/files/055-fix-base-do-not-quote-initargs-for-switch_root.patch @@ -0,0 +1,32 @@ +From 285e2ad01035743ff51005a74e486e09fcbb0a0d Mon Sep 17 00:00:00 2001 +From: Mike Gilbert <floppym@gentoo.org> +Date: Fri, 23 Jul 2021 14:35:07 -0400 +Subject: [PATCH] fix(base): do not quote $initargs for switch_root + +We want word splitting to occur so that the arguments are passed +separately, and we don't end up passing an empty string if no arguments +are specified. + +Bug: https://bugs.gentoo.org/803548 +Fixes: 2fabaaa62dcfd31e593ca45e1374e55adae29d6b +--- + modules.d/99base/init.sh | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/modules.d/99base/init.sh b/modules.d/99base/init.sh +index 978adb6f..ab62bb44 100755 +--- a/modules.d/99base/init.sh ++++ b/modules.d/99base/init.sh +@@ -387,7 +387,8 @@ if [ -f /etc/capsdrop ]; then + } + else + unset RD_DEBUG +- exec "$SWITCH_ROOT" "$NEWROOT" "$INIT" "$initargs" || { ++ # shellcheck disable=SC2086 ++ exec "$SWITCH_ROOT" "$NEWROOT" "$INIT" $initargs || { + warn "Something went very badly wrong in the initramfs. Please " + warn "file a bug against dracut." + emergency_shell +-- +2.32.0 + diff --git a/sys-kernel/dracut/files/055-fix-crypt-remove-quotes-from-cryptsetupopts.patch b/sys-kernel/dracut/files/055-fix-crypt-remove-quotes-from-cryptsetupopts.patch new file mode 100644 index 000000000000..355cdc461abc --- /dev/null +++ b/sys-kernel/dracut/files/055-fix-crypt-remove-quotes-from-cryptsetupopts.patch @@ -0,0 +1,39 @@ +From e0abf88a15d23fbf793cf872397016ad86aeaaa8 Mon Sep 17 00:00:00 2001 +From: lapseofreason <lapseofreason0@gmail.com> +Date: Tue, 8 Jun 2021 16:01:58 +0200 +Subject: [PATCH] fix(crypt): remove quotes from cryptsetupopts + +Fixes #1528. +--- + modules.d/90crypt/cryptroot-ask.sh | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/modules.d/90crypt/cryptroot-ask.sh b/modules.d/90crypt/cryptroot-ask.sh +index 37a4deea..b1f8df81 100755 +--- a/modules.d/90crypt/cryptroot-ask.sh ++++ b/modules.d/90crypt/cryptroot-ask.sh +@@ -138,8 +138,9 @@ unset allowdiscards + ask_passphrase=1 + + if [ -n "$luksfile" -a "$luksfile" != "none" -a -e "$luksfile" ]; then ++ # shellcheck disable=SC2086 + if readkey "$luksfile" / "$device" \ +- | cryptsetup -d - "$cryptsetupopts" luksOpen "$device" "$luksname"; then ++ | cryptsetup -d - $cryptsetupopts luksOpen "$device" "$luksname"; then + ask_passphrase=0 + fi + elif [ "$is_keysource" -ne 0 ]; then +@@ -164,8 +165,9 @@ else + unset tmp + + info "Using '$keypath' on '$keydev'" ++ # shellcheck disable=SC2086 + readkey "$keypath" "$keydev" "$device" \ +- | cryptsetup -d - "$cryptsetupopts" luksOpen "$device" "$luksname" \ ++ | cryptsetup -d - $cryptsetupopts luksOpen "$device" "$luksname" \ + && ask_passphrase=0 + unset keypath keydev + break +-- +2.32.0 + |