Skip to content

Commit 39f7f37

Browse files
iavclaude
iav
and
claude
committed
lib: partitioning: quote variables in destructive commands (#9400 P0)
Quote $SDCARD, $MOUNT, $rootdevice, ${LOOP}p${rootpart}, $bootscript_dst and other variables in rm, mount, umount, mkdir, sed -i, echo >>, mkfs, blkid, grep, and cat commands to prevent word splitting. Replace `[ -z ]` with `[[ -z ]]` on line guarding boot script output. Heredoc blocks inside call_extension_method are left unchanged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 158683b commit 39f7f37

File tree

1 file changed

+47
-44
lines changed

1 file changed

+47
-44
lines changed

‎lib/functions/image/partitioning.sh‎

Lines changed: 47 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ function prepare_partitions() {
284284
check_loop_device "${LOOP}" # check again, now it has to have a size! otherwise wait.
285285

286286
# stage: create fs, mount partitions, create fstab
287-
rm -f $SDCARD/etc/fstab
287+
rm -f "${SDCARD}/etc/fstab"
288288

289289
declare root_part_uuid="uninitialized"
290290

@@ -316,38 +316,39 @@ function prepare_partitions() {
316316
wait_for_disk_sync "after mkfs" # force writes to be really flushed
317317

318318
# store in readonly global for usage in later hooks
319-
root_part_uuid="$(blkid -s UUID -o value ${LOOP}p${rootpart})"
319+
root_part_uuid="$(blkid -s UUID -o value "${LOOP}p${rootpart}")"
320320
declare -g -r ROOT_PART_UUID="${root_part_uuid}"
321321

322322
display_alert "Mounting rootfs" "$rootdevice (UUID=${ROOT_PART_UUID})"
323-
run_host_command_logged mount ${fscreateopt} $rootdevice $MOUNT/
323+
# shellcheck disable=SC2086 # fscreateopt must word-split ("-o" and "compress-force=..." as two args) or be empty
324+
run_host_command_logged mount ${fscreateopt} "$rootdevice" "$MOUNT"/
324325

325326
# create fstab (and crypttab) entry
326327
if [[ $CRYPTROOT_ENABLE == yes ]]; then
327328
luks_key_file="none"
328329
if [[ $CRYPTROOT_AUTOUNLOCK == yes ]]; then
329330
luks_key_file="/etc/rootfs.key"
330331
display_alert "Saving rootfs.key and configuration for autounlock" "(location=${luks_key_file})"
331-
mv ${cryptroot_autounlock_key_file:?} ${SDCARD}${luks_key_file}
332-
mkdir -p $SDCARD/etc/initramfs-tools/conf.d/
333-
echo "UMASK=0077" > $SDCARD/etc/initramfs-tools/conf.d/key-umask.conf
334-
echo "" >> $SDCARD/etc/cryptsetup-initramfs/conf-hook
335-
echo "KEYFILE_PATTERN=${luks_key_file}" >> $SDCARD/etc/cryptsetup-initramfs/conf-hook
332+
mv "${cryptroot_autounlock_key_file:?}" "${SDCARD}${luks_key_file}"
333+
mkdir -p "${SDCARD}/etc/initramfs-tools/conf.d/"
334+
echo "UMASK=0077" > "${SDCARD}/etc/initramfs-tools/conf.d/key-umask.conf"
335+
echo "" >> "${SDCARD}/etc/cryptsetup-initramfs/conf-hook"
336+
echo "KEYFILE_PATTERN=${luks_key_file}" >> "${SDCARD}/etc/cryptsetup-initramfs/conf-hook"
336337
fi
337338
# map the LUKS container partition via its UUID to be the 'cryptroot' device
338-
physical_root_part_uuid="$(blkid -s UUID -o value $physical_rootdevice)"
339-
echo "$CRYPTROOT_MAPPER UUID=${physical_root_part_uuid} ${luks_key_file} luks" >> $SDCARD/etc/crypttab
340-
run_host_command_logged cat $SDCARD/etc/crypttab
339+
physical_root_part_uuid="$(blkid -s UUID -o value "$physical_rootdevice")"
340+
echo "$CRYPTROOT_MAPPER UUID=${physical_root_part_uuid} ${luks_key_file} luks" >> "${SDCARD}/etc/crypttab"
341+
run_host_command_logged cat "${SDCARD}/etc/crypttab"
341342
fi
342343

343344
if [[ $ROOTFS_TYPE == btrfs ]]; then
344345
btrfs_root_subvolume="${BTRFS_ROOT_SUBVOLUME:-@}"
345346
mountopts[$ROOTFS_TYPE]='commit=120'
346-
run_host_command_logged btrfs subvolume create $MOUNT/$btrfs_root_subvolume
347+
run_host_command_logged btrfs subvolume create "$MOUNT/$btrfs_root_subvolume"
347348
# getting the subvolume id of the newly created volume @ to install it
348349
# as the default volume for mounting without explicit reference
349350

350-
run_host_command_logged "btrfs subvolume set-default $MOUNT/$btrfs_root_subvolume"
351+
run_host_command_logged btrfs subvolume set-default "$MOUNT/$btrfs_root_subvolume"
351352

352353
call_extension_method "btrfs_root_add_subvolumes" <<- 'BTRFS_ROOT_ADD_SUBVOLUMES'
353354
# *custom post btrfs rootfs creation hook*
@@ -361,12 +362,13 @@ function prepare_partitions() {
361362
run_host_command_logged btrfs subvolume create $MOUNT/@srv
362363
BTRFS_ROOT_ADD_SUBVOLUMES
363364

364-
run_host_command_logged umount $rootdevice
365+
run_host_command_logged umount "$rootdevice"
365366
display_alert "Remounting rootfs" "$rootdevice (UUID=${ROOT_PART_UUID})"
366-
run_host_command_logged mount -odefaults,${mountopts[$ROOTFS_TYPE]} ${fscreateopt} $rootdevice $MOUNT/
367+
# shellcheck disable=SC2086 # fscreateopt must word-split ("-o" and "compress-force=..." as two args) or be empty
368+
run_host_command_logged mount -odefaults,${mountopts[$ROOTFS_TYPE]} ${fscreateopt} "$rootdevice" "$MOUNT"/
367369
fi
368-
rootfs="UUID=$(blkid -s UUID -o value $rootdevice)"
369-
echo "$rootfs / ${mkfs[$ROOTFS_TYPE]} defaults,${mountopts[$ROOTFS_TYPE]} 0 1" >> $SDCARD/etc/fstab
370+
rootfs="UUID=$(blkid -s UUID -o value "$rootdevice")"
371+
echo "$rootfs / ${mkfs[$ROOTFS_TYPE]} defaults,${mountopts[$ROOTFS_TYPE]} 0 1" >> "${SDCARD}/etc/fstab"
370372
if [[ $ROOTFS_TYPE == btrfs ]]; then
371373
call_extension_method "btrfs_root_add_subvolumes_fstab" <<- 'BTRFS_ROOT_ADD_SUBVOLUMES_FSTAB'
372374
run_host_command_logged mkdir -p $MOUNT/home
@@ -387,12 +389,12 @@ function prepare_partitions() {
387389
BTRFS_ROOT_ADD_SUBVOLUMES_FSTAB
388390
fi
389391

390-
run_host_command_logged cat $SDCARD/etc/fstab
392+
run_host_command_logged cat "${SDCARD}/etc/fstab"
391393

392394
else
393395
# update_initramfs will fail if /lib/modules/ doesn't exist
394-
mount --bind --make-private $SDCARD $MOUNT/
395-
echo "/dev/nfs / nfs defaults 0 0" >> $SDCARD/etc/fstab
396+
mount --bind --make-private "$SDCARD" "$MOUNT"/
397+
echo "/dev/nfs / nfs defaults 0 0" >> "${SDCARD}/etc/fstab"
396398
fi
397399

398400
##
@@ -401,10 +403,11 @@ function prepare_partitions() {
401403
if [[ -n $bootpart ]]; then
402404
display_alert "Creating /boot" "$bootfs on ${LOOP}p${bootpart}"
403405
check_loop_device "${LOOP}p${bootpart}"
404-
run_host_command_logged mkfs.${mkfs[$bootfs]} ${mkopts[$bootfs]} ${mkopts_label[$bootfs]:+${mkopts_label[$bootfs]}"$BOOT_FS_LABEL"} ${LOOP}p${bootpart}
405-
mkdir -p $MOUNT/boot/
406-
run_host_command_logged mount ${LOOP}p${bootpart} $MOUNT/boot/
407-
echo "UUID=$(blkid -s UUID -o value ${LOOP}p${bootpart}) /boot ${mkfs[$bootfs]} defaults${mountopts[$bootfs]} 0 2" >> $SDCARD/etc/fstab
406+
# shellcheck disable=SC2086 # mkopts must word-split into separate arguments (e.g. "-q -m 2" → two args)
407+
run_host_command_logged "mkfs.${mkfs[$bootfs]}" ${mkopts[$bootfs]} ${mkopts_label[$bootfs]:+${mkopts_label[$bootfs]}"$BOOT_FS_LABEL"} "${LOOP}p${bootpart}"
408+
mkdir -p "$MOUNT/boot/"
409+
run_host_command_logged mount "${LOOP}p${bootpart}" "$MOUNT/boot/"
410+
echo "UUID=$(blkid -s UUID -o value "${LOOP}p${bootpart}") /boot ${mkfs[$bootfs]} defaults${mountopts[$bootfs]} 0 2" >> "${SDCARD}/etc/fstab"
408411
fi
409412

410413
##
@@ -413,25 +416,25 @@ function prepare_partitions() {
413416
if [[ -n $uefipart ]]; then
414417
display_alert "Creating EFI partition" "FAT32 ${UEFI_MOUNT_POINT} on ${LOOP}p${uefipart} label ${UEFI_FS_LABEL}"
415418
check_loop_device "${LOOP}p${uefipart}"
416-
run_host_command_logged mkfs.fat -F32 -n "${UEFI_FS_LABEL^^}" ${LOOP}p${uefipart} 2>&1 # "^^" makes variable UPPERCASE, required for FAT32.
419+
run_host_command_logged mkfs.fat -F32 -n "${UEFI_FS_LABEL^^}" "${LOOP}p${uefipart}" 2>&1 # "^^" makes variable UPPERCASE, required for FAT32.
417420
mkdir -p "${MOUNT}${UEFI_MOUNT_POINT}"
418-
run_host_command_logged mount ${LOOP}p${uefipart} "${MOUNT}${UEFI_MOUNT_POINT}"
421+
run_host_command_logged mount "${LOOP}p${uefipart}" "${MOUNT}${UEFI_MOUNT_POINT}"
419422

420423
# Allow skipping the fstab entry for the EFI partition if UEFI_MOUNT_POINT_SKIP_FSTAB=yes; add comments instead if so
421424
if [[ "${UEFI_MOUNT_POINT_SKIP_FSTAB:-"no"}" == "yes" ]]; then
422425
display_alert "Skipping EFI partition in fstab" "UEFI_MOUNT_POINT_SKIP_FSTAB=${UEFI_MOUNT_POINT_SKIP_FSTAB}" "debug"
423426
echo "# /boot/efi fstab commented out due to UEFI_MOUNT_POINT_SKIP_FSTAB=${UEFI_MOUNT_POINT_SKIP_FSTAB}"
424-
echo "# UUID=$(blkid -s UUID -o value ${LOOP}p${uefipart}) ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> $SDCARD/etc/fstab
427+
echo "# UUID=$(blkid -s UUID -o value "${LOOP}p${uefipart}") ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> "${SDCARD}/etc/fstab"
425428
else
426-
echo "UUID=$(blkid -s UUID -o value ${LOOP}p${uefipart}) ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> $SDCARD/etc/fstab
429+
echo "UUID=$(blkid -s UUID -o value "${LOOP}p${uefipart}") ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> "${SDCARD}/etc/fstab"
427430
fi
428431
fi
429432
##
430433
## END OF PARTITION CREATION
431434
##
432435

433436
display_alert "Writing /tmp as tmpfs in chroot fstab" "$SDCARD/etc/fstab" "debug"
434-
echo "tmpfs /tmp tmpfs defaults,nosuid 0 0" >> $SDCARD/etc/fstab
437+
echo "tmpfs /tmp tmpfs defaults,nosuid 0 0" >> "${SDCARD}/etc/fstab"
435438

436439
call_extension_method "format_partitions" <<- 'FORMAT_PARTITIONS'
437440
*if you created your own partitions, this would be a good time to format them*
@@ -446,43 +449,43 @@ function prepare_partitions() {
446449
else
447450
echo "rootdev=$rootfs" >> "${SDCARD}/boot/armbianEnv.txt"
448451
fi
449-
echo "rootfstype=$ROOTFS_TYPE" >> $SDCARD/boot/armbianEnv.txt
452+
echo "rootfstype=$ROOTFS_TYPE" >> "${SDCARD}/boot/armbianEnv.txt"
450453
elif [[ $rootpart != 1 ]] && [[ $SRC_EXTLINUX != yes ]]; then
451454
echo "rootfstype=$ROOTFS_TYPE" >> "${SDCARD}/boot/armbianEnv.txt"
452455
elif [[ $rootpart != 1 && $SRC_EXTLINUX != yes && -f "${SDCARD}/boot/${bootscript_dst}" ]]; then
453456
local bootscript_dst=${BOOTSCRIPT##*:}
454-
sed -i 's/mmcblk0p1/mmcblk0p2/' $SDCARD/boot/$bootscript_dst
457+
sed -i 's/mmcblk0p1/mmcblk0p2/' "${SDCARD}/boot/${bootscript_dst}"
455458
sed -i -e "s/rootfstype=ext4/rootfstype=$ROOTFS_TYPE/" \
456-
-e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" $SDCARD/boot/$bootscript_dst
459+
-e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" "${SDCARD}/boot/${bootscript_dst}"
457460
fi
458461

459462
# if we have boot.ini = remove armbianEnv.txt and add UUID there if enabled
460463
if [[ -f $SDCARD/boot/boot.ini ]]; then
461464
display_alert "Found boot.ini" "${SDCARD}/boot/boot.ini" "debug"
462-
sed -i -e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" $SDCARD/boot/boot.ini
465+
sed -i -e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" "${SDCARD}/boot/boot.ini"
463466
if [[ $CRYPTROOT_ENABLE == yes ]]; then
464467
rootpart="UUID=${physical_root_part_uuid}"
465-
sed -i 's/^setenv rootdev .*/setenv rootdev "\/dev\/mapper\/'$CRYPTROOT_MAPPER' cryptdevice='$rootpart':'$CRYPTROOT_MAPPER'"/' $SDCARD/boot/boot.ini
468+
sed -i 's#^setenv rootdev .*#setenv rootdev "/dev/mapper/'$CRYPTROOT_MAPPER' cryptdevice='$rootpart':'$CRYPTROOT_MAPPER'"#' "${SDCARD}/boot/boot.ini"
466469
else
467-
sed -i 's/^setenv rootdev .*/setenv rootdev "'$rootfs'"/' $SDCARD/boot/boot.ini
470+
sed -i 's/^setenv rootdev .*/setenv rootdev "'$rootfs'"/' "${SDCARD}/boot/boot.ini"
468471
fi
469472
if [[ $LINUXFAMILY != meson64 ]]; then # @TODO: why only for meson64?
470-
[[ -f $SDCARD/boot/armbianEnv.txt ]] && rm $SDCARD/boot/armbianEnv.txt
473+
[[ -f "${SDCARD}/boot/armbianEnv.txt" ]] && rm "${SDCARD}/boot/armbianEnv.txt"
471474
fi
472475
fi
473476

474477
# if we have a headless device, set console to DEFAULT_CONSOLE
475-
if [[ -n $DEFAULT_CONSOLE && -f $SDCARD/boot/armbianEnv.txt ]]; then
476-
if grep -lq "^console=" $SDCARD/boot/armbianEnv.txt; then
477-
sed -i "s/^console=.*/console=$DEFAULT_CONSOLE/" $SDCARD/boot/armbianEnv.txt
478+
if [[ -n $DEFAULT_CONSOLE && -f "${SDCARD}/boot/armbianEnv.txt" ]]; then
479+
if grep -lq "^console=" "${SDCARD}/boot/armbianEnv.txt"; then
480+
sed -i "s/^console=.*/console=$DEFAULT_CONSOLE/" "${SDCARD}/boot/armbianEnv.txt"
478481
else
479-
echo "console=$DEFAULT_CONSOLE" >> $SDCARD/boot/armbianEnv.txt
482+
echo "console=$DEFAULT_CONSOLE" >> "${SDCARD}/boot/armbianEnv.txt"
480483
fi
481484
fi
482485

483486
# recompile .cmd to .scr if boot.cmd exists
484487
if [[ -f "${SDCARD}/boot/boot.cmd" ]]; then
485-
if [ -z ${BOOTSCRIPT_OUTPUT} ]; then
488+
if [[ -z "${BOOTSCRIPT_OUTPUT}" ]]; then
486489
BOOTSCRIPT_OUTPUT=boot.scr
487490
fi
488491
case ${LINUXFAMILY} in
@@ -500,10 +503,10 @@ function prepare_partitions() {
500503
fi
501504

502505
# complement extlinux config if it exists; remove armbianEnv in this case.
503-
if [[ -f $SDCARD/boot/extlinux/extlinux.conf ]]; then
504-
echo " append root=$rootfs $SRC_CMDLINE $MAIN_CMDLINE" >> $SDCARD/boot/extlinux/extlinux.conf
506+
if [[ -f "${SDCARD}/boot/extlinux/extlinux.conf" ]]; then
507+
echo " append root=$rootfs $SRC_CMDLINE $MAIN_CMDLINE" >> "${SDCARD}/boot/extlinux/extlinux.conf"
505508
display_alert "extlinux.conf exists" "removing armbianEnv.txt" "info"
506-
[[ -f $SDCARD/boot/armbianEnv.txt ]] && run_host_command_logged rm -v $SDCARD/boot/armbianEnv.txt
509+
[[ -f "${SDCARD}/boot/armbianEnv.txt" ]] && run_host_command_logged rm -v "${SDCARD}/boot/armbianEnv.txt"
507510
fi
508511

509512
if [[ $SRC_EXTLINUX != yes && -f $SDCARD/boot/armbianEnv.txt ]]; then

0 commit comments

Comments
 (0)