base-files: don't evaluate block-device uevent
authorDaniel Golle <daniel@makrotopia.org>
Fri, 2 Feb 2018 00:57:46 +0000 (01:57 +0100)
committerDaniel Golle <daniel@makrotopia.org>
Thu, 15 Feb 2018 13:39:47 +0000 (14:39 +0100)
Backport commits fixing the detection of GPT partition names during
preinit and sysupgrade, closing a shell-injection vulnerability.

da52dd0c83 ("base-files: quote values when evaluating uevent")
267873ac9b ("base-files: don't evaluate block-device uevent")

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
package/base-files/files/lib/upgrade/common.sh

index 3ddd1e7..8c1b3b1 100644 (file)
@@ -208,7 +208,7 @@ get_magic_long() {
 }
 
 export_bootdevice() {
-       local cmdline uuid disk uevent
+       local cmdline uuid disk uevent line
        local MAJOR MINOR DEVNAME DEVTYPE
 
        if read cmdline < /proc/cmdline; then
@@ -241,8 +241,9 @@ export_bootdevice() {
                esac
 
                if [ -e "$uevent" ]; then
-                       . "$uevent"
-
+                       while read line; do
+                               export -n "$line"
+                       done < "$uevent"
                        export BOOTDEV_MAJOR=$MAJOR
                        export BOOTDEV_MINOR=$MINOR
                        return 0
@@ -254,10 +255,12 @@ export_bootdevice() {
 
 export_partdevice() {
        local var="$1" offset="$2"
-       local uevent MAJOR MINOR DEVNAME DEVTYPE
+       local uevent line MAJOR MINOR DEVNAME DEVTYPE
 
        for uevent in /sys/class/block/*/uevent; do
-               . "$uevent"
+               while read line; do
+                       export -n "$line"
+               done < "$uevent"
                if [ $BOOTDEV_MAJOR = $MAJOR -a $(($BOOTDEV_MINOR + $offset)) = $MINOR -a -b "/dev/$DEVNAME" ]; then
                        export "$var=$DEVNAME"
                        return 0