From 6b290cf10b9bddd441b07fd5bfe19e19e88fcd76 Mon Sep 17 00:00:00 2001 From: Antonio Alvarez Feijoo Date: Mon, 10 Aug 2026 15:30:11 +0200 Subject: [PATCH] fix(iscsi): sanitize netroot= value passed to initqueue scripts The value of the `netroot=` kernel command line option is passed unsanitized to initqueue scripts, which end up being sourced as shell scripts. --- modules.d/74iscsi/parse-iscsiroot.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules.d/74iscsi/parse-iscsiroot.sh b/modules.d/74iscsi/parse-iscsiroot.sh index 7ff9bda37..3dc37f55e 100755 --- a/modules.d/74iscsi/parse-iscsiroot.sh +++ b/modules.d/74iscsi/parse-iscsiroot.sh @@ -106,7 +106,7 @@ modprobe -b -q be2iscsi if [ -n "$netroot" ] && [ "$root" != "/dev/root" ] && [ "$root" != "dhcp" ]; then if ! getargbool 1 rd.neednet > /dev/null || ! getarg "ip="; then - /sbin/initqueue --unique --onetime --settled /sbin/iscsiroot dummy "'$netroot'" "'$NEWROOT'" + /sbin/initqueue --unique --onetime --settled /sbin/iscsiroot dummy "'$(escape "$netroot")'" "'$NEWROOT'" fi fi @@ -146,7 +146,7 @@ if [ -z "$netroot" ] || ! [ "${netroot%%:*}" = "iscsi" ]; then return 1 fi -/sbin/initqueue --unique --onetime --timeout /sbin/iscsiroot timeout "$netroot" "$NEWROOT" +/sbin/initqueue --unique --onetime --timeout /sbin/iscsiroot timeout "'$(escape "$netroot")'" "$NEWROOT" for nroot in $(getargs netroot); do [ "${nroot%%:*}" = "iscsi" ] || continue -- 2.47.3