Skip to content

Commit 10b5ba5

Browse files
iavclaude
iav
and
claude
committed
lib: partitioning: quote variables in destructive commands (#9400 P0)
Quote $SDCARD, $MOUNT, $rootdevice, ${LOOP}p${rootpart}, $bootscript_dst and other variables in rm, mount, umount, mkdir, sed -i, echo >>, mkfs, blkid, grep, and cat commands to prevent word splitting. Replace `[ -z ]` with `[[ -z ]]` on line guarding boot script output. Heredoc blocks inside call_extension_method are left unchanged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 130dfcf commit 10b5ba5

File tree

1 file changed

+45
-44
lines changed

1 file changed

+45
-44
lines changed

‎lib/functions/image/partitioning.sh‎

Lines changed: 45 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ function prepare_partitions() {
284284
check_loop_device "${LOOP}" # check again, now it has to have a size! otherwise wait.
285285

286286
# stage: create fs, mount partitions, create fstab
287-
rm -f $SDCARD/etc/fstab
287+
rm -f "${SDCARD}/etc/fstab"
288288

289289
declare root_part_uuid="uninitialized"
290290

@@ -316,38 +316,38 @@ function prepare_partitions() {
316316
wait_for_disk_sync "after mkfs" # force writes to be really flushed
317317

318318
# store in readonly global for usage in later hooks
319-
root_part_uuid="$(blkid -s UUID -o value ${LOOP}p${rootpart})"
319+
root_part_uuid="$(blkid -s UUID -o value "${LOOP}p${rootpart}")"
320320
declare -g -r ROOT_PART_UUID="${root_part_uuid}"
321321

322322
display_alert "Mounting rootfs" "$rootdevice (UUID=${ROOT_PART_UUID})"
323-
run_host_command_logged mount ${fscreateopt} $rootdevice $MOUNT/
323+
run_host_command_logged mount ${fscreateopt} "$rootdevice" "$MOUNT"/
324324

325325
# create fstab (and crypttab) entry
326326
if [[ $CRYPTROOT_ENABLE == yes ]]; then
327327
luks_key_file="none"
328328
if [[ $CRYPTROOT_AUTOUNLOCK == yes ]]; then
329329
luks_key_file="/etc/rootfs.key"
330330
display_alert "Saving rootfs.key and configuration for autounlock" "(location=${luks_key_file})"
331-
mv ${cryptroot_autounlock_key_file:?} ${SDCARD}${luks_key_file}
332-
mkdir -p $SDCARD/etc/initramfs-tools/conf.d/
333-
echo "UMASK=0077" > $SDCARD/etc/initramfs-tools/conf.d/key-umask.conf
334-
echo "" >> $SDCARD/etc/cryptsetup-initramfs/conf-hook
335-
echo "KEYFILE_PATTERN=${luks_key_file}" >> $SDCARD/etc/cryptsetup-initramfs/conf-hook
331+
mv "${cryptroot_autounlock_key_file:?}" "${SDCARD}${luks_key_file}"
332+
mkdir -p "${SDCARD}/etc/initramfs-tools/conf.d/"
333+
echo "UMASK=0077" > "${SDCARD}/etc/initramfs-tools/conf.d/key-umask.conf"
334+
echo "" >> "${SDCARD}/etc/cryptsetup-initramfs/conf-hook"
335+
echo "KEYFILE_PATTERN=${luks_key_file}" >> "${SDCARD}/etc/cryptsetup-initramfs/conf-hook"
336336
fi
337337
# map the LUKS container partition via its UUID to be the 'cryptroot' device
338-
physical_root_part_uuid="$(blkid -s UUID -o value $physical_rootdevice)"
339-
echo "$CRYPTROOT_MAPPER UUID=${physical_root_part_uuid} ${luks_key_file} luks" >> $SDCARD/etc/crypttab
340-
run_host_command_logged cat $SDCARD/etc/crypttab
338+
physical_root_part_uuid="$(blkid -s UUID -o value "$physical_rootdevice")"
339+
echo "$CRYPTROOT_MAPPER UUID=${physical_root_part_uuid} ${luks_key_file} luks" >> "${SDCARD}/etc/crypttab"
340+
run_host_command_logged cat "${SDCARD}/etc/crypttab"
341341
fi
342342

343343
if [[ $ROOTFS_TYPE == btrfs ]]; then
344344
btrfs_root_subvolume="${BTRFS_ROOT_SUBVOLUME:-@}"
345345
mountopts[$ROOTFS_TYPE]='commit=120'
346-
run_host_command_logged btrfs subvolume create $MOUNT/$btrfs_root_subvolume
346+
run_host_command_logged btrfs subvolume create "$MOUNT/$btrfs_root_subvolume"
347347
# getting the subvolume id of the newly created volume @ to install it
348348
# as the default volume for mounting without explicit reference
349349

350-
run_host_command_logged "btrfs subvolume set-default $MOUNT/$btrfs_root_subvolume"
350+
run_host_command_logged btrfs subvolume set-default "$MOUNT/$btrfs_root_subvolume"
351351

352352
call_extension_method "btrfs_root_add_subvolumes" <<- 'BTRFS_ROOT_ADD_SUBVOLUMES'
353353
# *custom post btrfs rootfs creation hook*
@@ -361,12 +361,12 @@ function prepare_partitions() {
361361
run_host_command_logged btrfs subvolume create $MOUNT/@srv
362362
BTRFS_ROOT_ADD_SUBVOLUMES
363363

364-
run_host_command_logged umount $rootdevice
364+
run_host_command_logged umount "$rootdevice"
365365
display_alert "Remounting rootfs" "$rootdevice (UUID=${ROOT_PART_UUID})"
366-
run_host_command_logged mount -odefaults,${mountopts[$ROOTFS_TYPE]} ${fscreateopt} $rootdevice $MOUNT/
366+
run_host_command_logged mount -odefaults,${mountopts[$ROOTFS_TYPE]} ${fscreateopt} "$rootdevice" "$MOUNT"/
367367
fi
368-
rootfs="UUID=$(blkid -s UUID -o value $rootdevice)"
369-
echo "$rootfs / ${mkfs[$ROOTFS_TYPE]} defaults,${mountopts[$ROOTFS_TYPE]} 0 1" >> $SDCARD/etc/fstab
368+
rootfs="UUID=$(blkid -s UUID -o value "$rootdevice")"
369+
echo "$rootfs / ${mkfs[$ROOTFS_TYPE]} defaults,${mountopts[$ROOTFS_TYPE]} 0 1" >> "${SDCARD}/etc/fstab"
370370
if [[ $ROOTFS_TYPE == btrfs ]]; then
371371
call_extension_method "btrfs_root_add_subvolumes_fstab" <<- 'BTRFS_ROOT_ADD_SUBVOLUMES_FSTAB'
372372
run_host_command_logged mkdir -p $MOUNT/home
@@ -387,12 +387,12 @@ function prepare_partitions() {
387387
BTRFS_ROOT_ADD_SUBVOLUMES_FSTAB
388388
fi
389389

390-
run_host_command_logged cat $SDCARD/etc/fstab
390+
run_host_command_logged cat "${SDCARD}/etc/fstab"
391391

392392
else
393393
# update_initramfs will fail if /lib/modules/ doesn't exist
394-
mount --bind --make-private $SDCARD $MOUNT/
395-
echo "/dev/nfs / nfs defaults 0 0" >> $SDCARD/etc/fstab
394+
mount --bind --make-private "$SDCARD" "$MOUNT"/
395+
echo "/dev/nfs / nfs defaults 0 0" >> "${SDCARD}/etc/fstab"
396396
fi
397397

398398
##
@@ -401,10 +401,11 @@ function prepare_partitions() {
401401
if [[ -n $bootpart ]]; then
402402
display_alert "Creating /boot" "$bootfs on ${LOOP}p${bootpart}"
403403
check_loop_device "${LOOP}p${bootpart}"
404-
run_host_command_logged mkfs.${mkfs[$bootfs]} ${mkopts[$bootfs]} ${mkopts_label[$bootfs]:+${mkopts_label[$bootfs]}"$BOOT_FS_LABEL"} ${LOOP}p${bootpart}
405-
mkdir -p $MOUNT/boot/
406-
run_host_command_logged mount ${LOOP}p${bootpart} $MOUNT/boot/
407-
echo "UUID=$(blkid -s UUID -o value ${LOOP}p${bootpart}) /boot ${mkfs[$bootfs]} defaults${mountopts[$bootfs]} 0 2" >> $SDCARD/etc/fstab
404+
# shellcheck disable=SC2086 # mkopts must word-split into separate arguments (e.g. "-q -m 2" → two args)
405+
run_host_command_logged "mkfs.${mkfs[$bootfs]}" ${mkopts[$bootfs]} ${mkopts_label[$bootfs]:+${mkopts_label[$bootfs]}"$BOOT_FS_LABEL"} "${LOOP}p${bootpart}"
406+
mkdir -p "$MOUNT/boot/"
407+
run_host_command_logged mount "${LOOP}p${bootpart}" "$MOUNT/boot/"
408+
echo "UUID=$(blkid -s UUID -o value "${LOOP}p${bootpart}") /boot ${mkfs[$bootfs]} defaults${mountopts[$bootfs]} 0 2" >> "${SDCARD}/etc/fstab"
408409
fi
409410

410411
##
@@ -413,25 +414,25 @@ function prepare_partitions() {
413414
if [[ -n $uefipart ]]; then
414415
display_alert "Creating EFI partition" "FAT32 ${UEFI_MOUNT_POINT} on ${LOOP}p${uefipart} label ${UEFI_FS_LABEL}"
415416
check_loop_device "${LOOP}p${uefipart}"
416-
run_host_command_logged mkfs.fat -F32 -n "${UEFI_FS_LABEL^^}" ${LOOP}p${uefipart} 2>&1 # "^^" makes variable UPPERCASE, required for FAT32.
417+
run_host_command_logged mkfs.fat -F32 -n "${UEFI_FS_LABEL^^}" "${LOOP}p${uefipart}" 2>&1 # "^^" makes variable UPPERCASE, required for FAT32.
417418
mkdir -p "${MOUNT}${UEFI_MOUNT_POINT}"
418-
run_host_command_logged mount ${LOOP}p${uefipart} "${MOUNT}${UEFI_MOUNT_POINT}"
419+
run_host_command_logged mount "${LOOP}p${uefipart}" "${MOUNT}${UEFI_MOUNT_POINT}"
419420

420421
# Allow skipping the fstab entry for the EFI partition if UEFI_MOUNT_POINT_SKIP_FSTAB=yes; add comments instead if so
421422
if [[ "${UEFI_MOUNT_POINT_SKIP_FSTAB:-"no"}" == "yes" ]]; then
422423
display_alert "Skipping EFI partition in fstab" "UEFI_MOUNT_POINT_SKIP_FSTAB=${UEFI_MOUNT_POINT_SKIP_FSTAB}" "debug"
423424
echo "# /boot/efi fstab commented out due to UEFI_MOUNT_POINT_SKIP_FSTAB=${UEFI_MOUNT_POINT_SKIP_FSTAB}"
424-
echo "# UUID=$(blkid -s UUID -o value ${LOOP}p${uefipart}) ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> $SDCARD/etc/fstab
425+
echo "# UUID=$(blkid -s UUID -o value "${LOOP}p${uefipart}") ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> "${SDCARD}/etc/fstab"
425426
else
426-
echo "UUID=$(blkid -s UUID -o value ${LOOP}p${uefipart}) ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> $SDCARD/etc/fstab
427+
echo "UUID=$(blkid -s UUID -o value "${LOOP}p${uefipart}") ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> "${SDCARD}/etc/fstab"
427428
fi
428429
fi
429430
##
430431
## END OF PARTITION CREATION
431432
##
432433

433434
display_alert "Writing /tmp as tmpfs in chroot fstab" "$SDCARD/etc/fstab" "debug"
434-
echo "tmpfs /tmp tmpfs defaults,nosuid 0 0" >> $SDCARD/etc/fstab
435+
echo "tmpfs /tmp tmpfs defaults,nosuid 0 0" >> "${SDCARD}/etc/fstab"
435436

436437
call_extension_method "format_partitions" <<- 'FORMAT_PARTITIONS'
437438
*if you created your own partitions, this would be a good time to format them*
@@ -446,43 +447,43 @@ function prepare_partitions() {
446447
else
447448
echo "rootdev=$rootfs" >> "${SDCARD}/boot/armbianEnv.txt"
448449
fi
449-
echo "rootfstype=$ROOTFS_TYPE" >> $SDCARD/boot/armbianEnv.txt
450+
echo "rootfstype=$ROOTFS_TYPE" >> "${SDCARD}/boot/armbianEnv.txt"
450451
elif [[ $rootpart != 1 ]] && [[ $SRC_EXTLINUX != yes ]]; then
451452
echo "rootfstype=$ROOTFS_TYPE" >> "${SDCARD}/boot/armbianEnv.txt"
452453
elif [[ $rootpart != 1 && $SRC_EXTLINUX != yes && -f "${SDCARD}/boot/${bootscript_dst}" ]]; then
453454
local bootscript_dst=${BOOTSCRIPT##*:}
454-
sed -i 's/mmcblk0p1/mmcblk0p2/' $SDCARD/boot/$bootscript_dst
455+
sed -i 's/mmcblk0p1/mmcblk0p2/' "${SDCARD}/boot/${bootscript_dst}"
455456
sed -i -e "s/rootfstype=ext4/rootfstype=$ROOTFS_TYPE/" \
456-
-e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" $SDCARD/boot/$bootscript_dst
457+
-e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" "${SDCARD}/boot/${bootscript_dst}"
457458
fi
458459

459460
# if we have boot.ini = remove armbianEnv.txt and add UUID there if enabled
460461
if [[ -f $SDCARD/boot/boot.ini ]]; then
461462
display_alert "Found boot.ini" "${SDCARD}/boot/boot.ini" "debug"
462-
sed -i -e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" $SDCARD/boot/boot.ini
463+
sed -i -e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" "${SDCARD}/boot/boot.ini"
463464
if [[ $CRYPTROOT_ENABLE == yes ]]; then
464465
rootpart="UUID=${physical_root_part_uuid}"
465-
sed -i 's/^setenv rootdev .*/setenv rootdev "\/dev\/mapper\/'$CRYPTROOT_MAPPER' cryptdevice='$rootpart':'$CRYPTROOT_MAPPER'"/' $SDCARD/boot/boot.ini
466+
sed -i 's#^setenv rootdev .*#setenv rootdev "/dev/mapper/'$CRYPTROOT_MAPPER' cryptdevice='$rootpart':'$CRYPTROOT_MAPPER'"#' "${SDCARD}/boot/boot.ini"
466467
else
467-
sed -i 's/^setenv rootdev .*/setenv rootdev "'$rootfs'"/' $SDCARD/boot/boot.ini
468+
sed -i 's/^setenv rootdev .*/setenv rootdev "'$rootfs'"/' "${SDCARD}/boot/boot.ini"
468469
fi
469470
if [[ $LINUXFAMILY != meson64 ]]; then # @TODO: why only for meson64?
470-
[[ -f $SDCARD/boot/armbianEnv.txt ]] && rm $SDCARD/boot/armbianEnv.txt
471+
[[ -f "${SDCARD}/boot/armbianEnv.txt" ]] && rm "${SDCARD}/boot/armbianEnv.txt"
471472
fi
472473
fi
473474

474475
# if we have a headless device, set console to DEFAULT_CONSOLE
475-
if [[ -n $DEFAULT_CONSOLE && -f $SDCARD/boot/armbianEnv.txt ]]; then
476-
if grep -lq "^console=" $SDCARD/boot/armbianEnv.txt; then
477-
sed -i "s/^console=.*/console=$DEFAULT_CONSOLE/" $SDCARD/boot/armbianEnv.txt
476+
if [[ -n $DEFAULT_CONSOLE && -f "${SDCARD}/boot/armbianEnv.txt" ]]; then
477+
if grep -lq "^console=" "${SDCARD}/boot/armbianEnv.txt"; then
478+
sed -i "s/^console=.*/console=$DEFAULT_CONSOLE/" "${SDCARD}/boot/armbianEnv.txt"
478479
else
479-
echo "console=$DEFAULT_CONSOLE" >> $SDCARD/boot/armbianEnv.txt
480+
echo "console=$DEFAULT_CONSOLE" >> "${SDCARD}/boot/armbianEnv.txt"
480481
fi
481482
fi
482483

483484
# recompile .cmd to .scr if boot.cmd exists
484485
if [[ -f "${SDCARD}/boot/boot.cmd" ]]; then
485-
if [ -z ${BOOTSCRIPT_OUTPUT} ]; then
486+
if [[ -z "${BOOTSCRIPT_OUTPUT}" ]]; then
486487
BOOTSCRIPT_OUTPUT=boot.scr
487488
fi
488489
case ${LINUXFAMILY} in
@@ -500,10 +501,10 @@ function prepare_partitions() {
500501
fi
501502

502503
# complement extlinux config if it exists; remove armbianEnv in this case.
503-
if [[ -f $SDCARD/boot/extlinux/extlinux.conf ]]; then
504-
echo " append root=$rootfs $SRC_CMDLINE $MAIN_CMDLINE" >> $SDCARD/boot/extlinux/extlinux.conf
504+
if [[ -f "${SDCARD}/boot/extlinux/extlinux.conf" ]]; then
505+
echo " append root=$rootfs $SRC_CMDLINE $MAIN_CMDLINE" >> "${SDCARD}/boot/extlinux/extlinux.conf"
505506
display_alert "extlinux.conf exists" "removing armbianEnv.txt" "info"
506-
[[ -f $SDCARD/boot/armbianEnv.txt ]] && run_host_command_logged rm -v $SDCARD/boot/armbianEnv.txt
507+
[[ -f "${SDCARD}/boot/armbianEnv.txt" ]] && run_host_command_logged rm -v "${SDCARD}/boot/armbianEnv.txt"
507508
fi
508509

509510
if [[ $SRC_EXTLINUX != yes && -f $SDCARD/boot/armbianEnv.txt ]]; then

0 commit comments

Comments
 (0)