diff --git a/backport-fix-dracut-install-protect-against-broken-links-poin.patch b/backport-fix-dracut-install-protect-against-broken-links-poin.patch new file mode 100644 index 0000000000000000000000000000000000000000..c966fc514e520677071c7611468e96c6bcd6e430 --- /dev/null +++ b/backport-fix-dracut-install-protect-against-broken-links-poin.patch @@ -0,0 +1,80 @@ +From 32f6f364ddeb706bf8741f2895d60022aee264e7 Mon Sep 17 00:00:00 2001 +From: Antonio Alvarez Feijoo +Date: Thu, 10 Aug 2023 09:22:28 +0200 +Subject: [PATCH] fix(dracut-install): protect against broken links pointing to + themselves + +`readlink` does not return an error if a symbolic link points to itself, which +can cause a stack overflow due to infinite recursion in the `get_real_file` +function. + +Although this type of recursive links should not exist, we discovered this +issue on a real system. It can be reproduced as follows: + +``` +> ls -l /lib64/libblkid.so +-rwxr-xr-x 1 root root 224368 Aug 9 15:13 /lib64/libblkid.so +> rm -f /lib64/libblkid.so +> ln -s /lib64/libblkid.so /lib64/libblkid.so +> ls -l /lib64/libblkid.so +lrwxrwxrwx 1 root root 18 Aug 9 15:06 /lib64/libblkid.so -> /lib64/libblkid.so +> dracut -f -I "/lib64/libblkid.so" test.img +... +dracut-install: Handle '/lib64/libblkid.so' +dracut-install: dracut_install('/lib64/libblkid.so', '/lib64/libblkid.so', 0, 0, 1) +dracut-install: get_real_file('/lib64/libblkid.so') +dracut-install: get_real_file: readlink('/lib64/libblkid.so') returns '/lib64/libblkid.so' +dracut-install: get_real_file('/lib64/libblkid.so') => '/lib64/libblkid.so' +... +[infinite recursion] +... +dracut-install: dracut_install('/lib64/libblkid.so', '/lib64/libblkid.so', 0, 0, 1) +dracut-install: get_real_file('/lib64/libblkid.so') +dracut-install: get_real_file: readlink('/lib64/libblkid.so') returns '/lib64/libblkid.so' +dracut-install: get_real_file('/lib64/libblkid.so') => '/lib64/libblkid.so' +dracut-install: dracut_install('/lib64/libblkid.so', '/lib64/libblkid.so', 0, 0, 1) +/usr/lib/dracut/dracut-init.sh: line 298: 20949 Segmentation fault (core dumped) $DRACUT_INSTALL ${dracutsysrootdir:+-r "$dracutsysrootdir"} ${initdir:+-D "$initdir"} -a ${loginstall:+-L "$loginstall"} ${DRACUT_RESOLVE_DEPS:+-l} ${DRACUT_FIPS_MODE:+-f} ${_hostonly_install:+-H} "$@" +dracut: FAILED: /usr/lib/dracut/dracut-install --debug -D /var/tmp/dracut.dqLmOS/initramfs -a /lib64/libblkid.so +... +``` + +After applying this patch: + +``` +> dracut -f -I "/lib64/libblkid.so" test.img +... +dracut-install: Handle '/lib64/libblkid.so' +dracut-install: dracut_install('/lib64/libblkid.so', '/lib64/libblkid.so', 0, 0, 1) +dracut-install: get_real_file('/lib64/libblkid.so') +dracut-install: get_real_file: readlink('/lib64/libblkid.so') returns '/lib64/libblkid.so' +dracut-install: ERROR: '/lib64/libblkid.so' is pointing to itself. +dracut-install: ERROR: installing '/lib64/libblkid.so' +dracut: FAILED: /usr/lib/dracut/dracut-install --debug -D /var/tmp/dracut.4w8FVL/initramfs -a /lib64/libblkid.so +... +``` + +Conflict:code context adaption +Reference:https://github.com/dracutdevs/dracut/commit/32f6f364ddeb706bf8741f2895d60022aee264e7 +--- + src/install/dracut-install.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/install/dracut-install.c b/src/install/dracut-install.c +index 5cfcf517..485143a5 100644 +--- a/src/install/dracut-install.c ++++ b/src/install/dracut-install.c +@@ -480,6 +480,11 @@ static char *get_real_file(const char *src, bool fullyresolve) + + log_debug("get_real_file: readlink('%s') returns '%s'", fullsrcpath, linktarget); + ++ if (streq(fullsrcpath, linktarget)) { ++ log_error("ERROR: '%s' is pointing to itself", fullsrcpath); ++ return NULL; ++ } ++ + if (linktarget[0] == '/') { + if (asprintf(&abspath, "%s%s", (sysrootdirlen ? sysrootdir : ""), linktarget) < 0) + return NULL; +-- +2.33.0 + diff --git a/backport-fix-dracut.sh-exit-if-resolving-executable-dependenc.patch b/backport-fix-dracut.sh-exit-if-resolving-executable-dependenc.patch new file mode 100644 index 0000000000000000000000000000000000000000..d5416d8fbb8b661e30b3354938bed2f7d04117a9 --- /dev/null +++ b/backport-fix-dracut.sh-exit-if-resolving-executable-dependenc.patch @@ -0,0 +1,46 @@ +From b2c6b584e2227e68f54c8843925dcb73aefe87ac Mon Sep 17 00:00:00 2001 +From: Antonio Alvarez Feijoo +Date: Wed, 9 Aug 2023 11:28:15 +0200 +Subject: [PATCH] fix(dracut.sh): exit if resolving executable dependencies + fails + +We came across an issue where, when resolving executable dependencies, a call to +a buggy glib function in `dracut-install` was causing a termination with +SIGSEGV, but dracut didn't stop the build process, which resulted in an +unbootable initrd, due to missing required libraries. + +``` +dracut: *** Resolving executable dependencies *** +xargs: /usr/lib/dracut/dracut-install: terminated by signal 11 +dracut: *** Resolving executable dependencies done *** +``` + +Therefore, stop the initrd creation in this case. + +Conflict:code context adaption; delete 'exit 1' because we only want to see alarms and do not want the process to exit +Reference:https://github.com/dracutdevs/dracut/commit/b2c6b584e2227e68f54c8843925dcb73aefe87ac +--- + dracut.sh | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/dracut.sh b/dracut.sh +index fe2954a0..d7bf4b07 100755 +--- a/dracut.sh ++++ b/dracut.sh +@@ -2045,7 +2045,12 @@ if [[ $kernel_only != yes ]]; then + dinfo "*** Resolving executable dependencies ***" + find "$initdir" -type f -perm /0111 -not -path '*.ko' -print0 \ + | xargs -r -0 "$DRACUT_INSTALL" ${initdir:+-D "$initdir"} ${dracutsysrootdir:+-r "$dracutsysrootdir"} -R ${DRACUT_FIPS_MODE:+-f} -- +- dinfo "*** Resolving executable dependencies done ***" ++ # shellcheck disable=SC2181 ++ if (($? == 0)); then ++ dinfo "*** Resolving executable dependencies done ***" ++ else ++ dfatal "Resolving executable dependencies failed" ++ fi + fi + + # Now we are done with lazy resolving, always install dependencies +-- +2.33.0 + diff --git a/backport-fix-fs-lib-remove-quoting-form-the-first-argument-of.patch b/backport-fix-fs-lib-remove-quoting-form-the-first-argument-of.patch new file mode 100644 index 0000000000000000000000000000000000000000..b64d9b4aa5652e7398d502b264ca5b5c36eb0d2e --- /dev/null +++ b/backport-fix-fs-lib-remove-quoting-form-the-first-argument-of.patch @@ -0,0 +1,31 @@ +From 9aa332cad7196b6e05b9e2f1810dc54bb38ed2ac Mon Sep 17 00:00:00 2001 +From: Laszlo Gombos +Date: Sat, 4 Mar 2023 23:28:17 +0000 +Subject: [PATCH] fix(fs-lib): remove quoting form the first argument of the + e2fsck call + +Fix regression. + +Conflict:NA +Reference:https://github.com/dracutdevs/dracut/commit/9aa332cad7196b6e05b9e2f1810dc54bb38ed2ac +--- + modules.d/99fs-lib/fs-lib.sh | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/modules.d/99fs-lib/fs-lib.sh b/modules.d/99fs-lib/fs-lib.sh +index dd20731f..c4640fa8 100755 +--- a/modules.d/99fs-lib/fs-lib.sh ++++ b/modules.d/99fs-lib/fs-lib.sh +@@ -107,7 +107,8 @@ fsck_drv_com() { + + info "issuing $_drv $_fop $_dev" + # we enforce non-interactive run, so $() is fine +- _out=$($_drv "$_fop" "$_dev") ++ # shellcheck disable=SC2086 ++ _out=$($_drv $_fop "$_dev") + _ret=$? + fsck_tail + +-- +2.33.0 + diff --git a/dracut.spec b/dracut.spec index 6fc109f4d582499615c66f0eeedb63adcdc237c3..002ebfff6486c12dd14d87c1612407409da752c5 100644 --- a/dracut.spec +++ b/dracut.spec @@ -9,7 +9,7 @@ Name: dracut Version: 055 -Release: 8 +Release: 9 Summary: Initramfs generator using udev @@ -41,6 +41,9 @@ Patch14: backport-fix-lvm-restore-setting-LVM_MD_PV_ACTIVATED.patch Patch15: backport-Bring-back-51-dracut-rescue-postinst.sh.patch Patch16: backport-fix-dracut-shutdown-add-cleanup-handler-on-failure.patch Patch17: backport-fix-dracut-functions.sh-get-block-device-driver-if-i.patch +Patch18: backport-fix-fs-lib-remove-quoting-form-the-first-argument-of.patch +Patch19: backport-fix-dracut.sh-exit-if-resolving-executable-dependenc.patch +Patch20: backport-fix-dracut-install-protect-against-broken-links-poin.patch Patch9000: remove-iscsi-related-code-since-it-is-no-longer-main.patch @@ -517,6 +520,14 @@ install -m 0755 51-dracut-rescue-postinst.sh $RPM_BUILD_ROOT%{_sysconfdir}/kerne %endif %changelog +* Mon Dec 4 2023 huyubiao - 055-9 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:add backport-fix-fs-lib-remove-quoting-form-the-first-argument-of.patch + backport-fix-dracut.sh-exit-if-resolving-executable-dependenc.patch + backport-fix-dracut-install-protect-against-broken-links-poin.patch + * Thu Nov 16 2023 wangyuhang - 055-8 - get block device driver if in a virtual subsystem