Skip to content

Commit 8a29a20

Browse files
iavclaude
iav
and
claude
committed
lib: partitioning: quote variables in destructive commands (#9400 P0)
Quote $SDCARD, $MOUNT, $rootdevice, ${LOOP}p${rootpart}, $bootscript_dst and other variables in rm, mount, umount, mkdir, sed -i, echo >>, mkfs, blkid, grep, and cat commands to prevent word splitting. Replace `[ -z ]` with `[[ -z ]]` on line guarding boot script output. Heredoc blocks inside call_extension_method are left unchanged. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 7546596 commit 8a29a20

1 file changed

Lines changed: 46 additions & 43 deletions

File tree

‎lib/functions/image/partitioning.sh‎

Lines changed: 46 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ function prepare_partitions() {
284284
check_loop_device "${LOOP}" # check again, now it has to have a size! otherwise wait.
285285

286286
# stage: create fs, mount partitions, create fstab
287-
rm -f $SDCARD/etc/fstab
287+
rm -f "${SDCARD}/etc/fstab"
288288

289289
declare root_part_uuid="uninitialized"
290290

@@ -316,37 +316,38 @@ function prepare_partitions() {
316316
wait_for_disk_sync "after mkfs" # force writes to be really flushed
317317

318318
# store in readonly global for usage in later hooks
319-
root_part_uuid="$(blkid -s UUID -o value ${LOOP}p${rootpart})"
319+
root_part_uuid="$(blkid -s UUID -o value "${LOOP}p${rootpart}")"
320320
declare -g -r ROOT_PART_UUID="${root_part_uuid}"
321321

322322
display_alert "Mounting rootfs" "$rootdevice (UUID=${ROOT_PART_UUID})"
323-
run_host_command_logged mount ${fscreateopt} $rootdevice $MOUNT/
323+
# shellcheck disable=SC2086 # fscreateopt must word-split ("-o" and "compress-force=..." as two args) or be empty
324+
run_host_command_logged mount ${fscreateopt} "$rootdevice" "$MOUNT"/
324325

325326
# create fstab (and crypttab) entry
326327
if [[ $CRYPTROOT_ENABLE == yes ]]; then
327328
luks_key_file="none"
328329
if [[ $CRYPTROOT_AUTOUNLOCK == yes ]]; then
329330
luks_key_file="/etc/rootfs.key"
330331
display_alert "Saving rootfs.key and configuration for autounlock" "(location=${luks_key_file})"
331-
mv ${cryptroot_autounlock_key_file:?} ${SDCARD}${luks_key_file}
332-
mkdir -p $SDCARD/etc/initramfs-tools/conf.d/
333-
echo "UMASK=0077" > $SDCARD/etc/initramfs-tools/conf.d/key-umask.conf
334-
echo "" >> $SDCARD/etc/cryptsetup-initramfs/conf-hook
335-
echo "KEYFILE_PATTERN=${luks_key_file}" >> $SDCARD/etc/cryptsetup-initramfs/conf-hook
332+
mv "${cryptroot_autounlock_key_file:?}" "${SDCARD}${luks_key_file}"
333+
mkdir -p "${SDCARD}/etc/initramfs-tools/conf.d/"
334+
echo "UMASK=0077" > "${SDCARD}/etc/initramfs-tools/conf.d/key-umask.conf"
335+
echo "" >> "${SDCARD}/etc/cryptsetup-initramfs/conf-hook"
336+
echo "KEYFILE_PATTERN=${luks_key_file}" >> "${SDCARD}/etc/cryptsetup-initramfs/conf-hook"
336337
fi
337338
# map the LUKS container partition via its UUID to be the 'cryptroot' device
338-
physical_root_part_uuid="$(blkid -s UUID -o value $physical_rootdevice)"
339-
echo "$CRYPTROOT_MAPPER UUID=${physical_root_part_uuid} ${luks_key_file} luks" >> $SDCARD/etc/crypttab
340-
run_host_command_logged cat $SDCARD/etc/crypttab
339+
physical_root_part_uuid="$(blkid -s UUID -o value "$physical_rootdevice")"
340+
echo "$CRYPTROOT_MAPPER UUID=${physical_root_part_uuid} ${luks_key_file} luks" >> "${SDCARD}/etc/crypttab"
341+
run_host_command_logged cat "${SDCARD}/etc/crypttab"
341342
fi
342343

343344
if [[ $ROOTFS_TYPE == btrfs ]]; then
344345
btrfs_root_subvolume="${BTRFS_ROOT_SUBVOLUME:-@}"
345-
run_host_command_logged btrfs subvolume create $MOUNT/$btrfs_root_subvolume
346+
run_host_command_logged btrfs subvolume create "$MOUNT/$btrfs_root_subvolume"
346347
# getting the subvolume id of the newly created volume @ to install it
347348
# as the default volume for mounting without explicit reference
348349

349-
run_host_command_logged "btrfs subvolume set-default $MOUNT/$btrfs_root_subvolume"
350+
run_host_command_logged btrfs subvolume set-default "$MOUNT/$btrfs_root_subvolume"
350351

351352
call_extension_method "btrfs_root_add_subvolumes" <<- 'BTRFS_ROOT_ADD_SUBVOLUMES'
352353
# *custom post btrfs rootfs creation hook*
@@ -360,12 +361,13 @@ function prepare_partitions() {
360361
run_host_command_logged btrfs subvolume create $MOUNT/@srv
361362
BTRFS_ROOT_ADD_SUBVOLUMES
362363

363-
run_host_command_logged umount $rootdevice
364+
run_host_command_logged umount "$rootdevice"
364365
display_alert "Remounting rootfs" "$rootdevice (UUID=${ROOT_PART_UUID})"
365-
run_host_command_logged mount -odefaults${mountopts[$ROOTFS_TYPE]} ${fscreateopt} $rootdevice $MOUNT/
366+
# shellcheck disable=SC2086 # fscreateopt must word-split ("-o" and "compress-force=..." as two args) or be empty
367+
run_host_command_logged mount -odefaults${mountopts[$ROOTFS_TYPE]} ${fscreateopt} "$rootdevice" "$MOUNT"/
366368
fi
367-
rootfs="UUID=$(blkid -s UUID -o value $rootdevice)"
368-
echo "$rootfs / ${mkfs[$ROOTFS_TYPE]} defaults${mountopts[$ROOTFS_TYPE]} 0 1" >> $SDCARD/etc/fstab
369+
rootfs="UUID=$(blkid -s UUID -o value "$rootdevice")"
370+
echo "$rootfs / ${mkfs[$ROOTFS_TYPE]} defaults${mountopts[$ROOTFS_TYPE]} 0 1" >> "${SDCARD}/etc/fstab"
369371
if [[ $ROOTFS_TYPE == btrfs ]]; then
370372
call_extension_method "btrfs_root_add_subvolumes_fstab" <<- 'BTRFS_ROOT_ADD_SUBVOLUMES_FSTAB'
371373
run_host_command_logged mkdir -p $MOUNT/home
@@ -386,12 +388,12 @@ function prepare_partitions() {
386388
BTRFS_ROOT_ADD_SUBVOLUMES_FSTAB
387389
fi
388390

389-
run_host_command_logged cat $SDCARD/etc/fstab
391+
run_host_command_logged cat "${SDCARD}/etc/fstab"
390392

391393
else
392394
# update_initramfs will fail if /lib/modules/ doesn't exist
393-
mount --bind --make-private $SDCARD $MOUNT/
394-
echo "/dev/nfs / nfs defaults 0 0" >> $SDCARD/etc/fstab
395+
mount --bind --make-private "$SDCARD" "$MOUNT"/
396+
echo "/dev/nfs / nfs defaults 0 0" >> "${SDCARD}/etc/fstab"
395397
fi
396398

397399
##
@@ -400,10 +402,11 @@ function prepare_partitions() {
400402
if [[ -n $bootpart ]]; then
401403
display_alert "Creating /boot" "$bootfs on ${LOOP}p${bootpart}"
402404
check_loop_device "${LOOP}p${bootpart}"
403-
run_host_command_logged mkfs.${mkfs[$bootfs]} ${mkopts[$bootfs]} ${mkopts_label[$bootfs]:+${mkopts_label[$bootfs]}"$BOOT_FS_LABEL"} ${LOOP}p${bootpart}
404-
mkdir -p $MOUNT/boot/
405-
run_host_command_logged mount ${LOOP}p${bootpart} $MOUNT/boot/
406-
echo "UUID=$(blkid -s UUID -o value ${LOOP}p${bootpart}) /boot ${mkfs[$bootfs]} defaults${mountopts[$bootfs]} 0 2" >> $SDCARD/etc/fstab
405+
# shellcheck disable=SC2086 # mkopts must word-split into separate arguments (e.g. "-q -m 2" → two args)
406+
run_host_command_logged "mkfs.${mkfs[$bootfs]}" ${mkopts[$bootfs]} ${mkopts_label[$bootfs]:+${mkopts_label[$bootfs]}"$BOOT_FS_LABEL"} "${LOOP}p${bootpart}"
407+
mkdir -p "$MOUNT/boot/"
408+
run_host_command_logged mount "${LOOP}p${bootpart}" "$MOUNT/boot/"
409+
echo "UUID=$(blkid -s UUID -o value "${LOOP}p${bootpart}") /boot ${mkfs[$bootfs]} defaults${mountopts[$bootfs]} 0 2" >> "${SDCARD}/etc/fstab"
407410
fi
408411

409412
##
@@ -412,25 +415,25 @@ function prepare_partitions() {
412415
if [[ -n $uefipart ]]; then
413416
display_alert "Creating EFI partition" "FAT32 ${UEFI_MOUNT_POINT} on ${LOOP}p${uefipart} label ${UEFI_FS_LABEL}"
414417
check_loop_device "${LOOP}p${uefipart}"
415-
run_host_command_logged mkfs.fat -F32 -n "${UEFI_FS_LABEL^^}" ${LOOP}p${uefipart} 2>&1 # "^^" makes variable UPPERCASE, required for FAT32.
418+
run_host_command_logged mkfs.fat -F32 -n "${UEFI_FS_LABEL^^}" "${LOOP}p${uefipart}" 2>&1 # "^^" makes variable UPPERCASE, required for FAT32.
416419
mkdir -p "${MOUNT}${UEFI_MOUNT_POINT}"
417-
run_host_command_logged mount ${LOOP}p${uefipart} "${MOUNT}${UEFI_MOUNT_POINT}"
420+
run_host_command_logged mount "${LOOP}p${uefipart}" "${MOUNT}${UEFI_MOUNT_POINT}"
418421

419422
# Allow skipping the fstab entry for the EFI partition if UEFI_MOUNT_POINT_SKIP_FSTAB=yes; add comments instead if so
420423
if [[ "${UEFI_MOUNT_POINT_SKIP_FSTAB:-"no"}" == "yes" ]]; then
421424
display_alert "Skipping EFI partition in fstab" "UEFI_MOUNT_POINT_SKIP_FSTAB=${UEFI_MOUNT_POINT_SKIP_FSTAB}" "debug"
422425
echo "# /boot/efi fstab commented out due to UEFI_MOUNT_POINT_SKIP_FSTAB=${UEFI_MOUNT_POINT_SKIP_FSTAB}"
423-
echo "# UUID=$(blkid -s UUID -o value ${LOOP}p${uefipart}) ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> $SDCARD/etc/fstab
426+
echo "# UUID=$(blkid -s UUID -o value "${LOOP}p${uefipart}") ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> "${SDCARD}/etc/fstab"
424427
else
425-
echo "UUID=$(blkid -s UUID -o value ${LOOP}p${uefipart}) ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> $SDCARD/etc/fstab
428+
echo "UUID=$(blkid -s UUID -o value "${LOOP}p${uefipart}") ${UEFI_MOUNT_POINT} vfat defaults 0 2" >> "${SDCARD}/etc/fstab"
426429
fi
427430
fi
428431
##
429432
## END OF PARTITION CREATION
430433
##
431434

432435
display_alert "Writing /tmp as tmpfs in chroot fstab" "$SDCARD/etc/fstab" "debug"
433-
echo "tmpfs /tmp tmpfs defaults,nosuid 0 0" >> $SDCARD/etc/fstab
436+
echo "tmpfs /tmp tmpfs defaults,nosuid 0 0" >> "${SDCARD}/etc/fstab"
434437

435438
call_extension_method "format_partitions" <<- 'FORMAT_PARTITIONS'
436439
*if you created your own partitions, this would be a good time to format them*
@@ -445,37 +448,37 @@ function prepare_partitions() {
445448
else
446449
echo "rootdev=$rootfs" >> "${SDCARD}/boot/armbianEnv.txt"
447450
fi
448-
echo "rootfstype=$ROOTFS_TYPE" >> $SDCARD/boot/armbianEnv.txt
451+
echo "rootfstype=$ROOTFS_TYPE" >> "${SDCARD}/boot/armbianEnv.txt"
449452
elif [[ $rootpart != 1 ]] && [[ $SRC_EXTLINUX != yes ]]; then
450453
echo "rootfstype=$ROOTFS_TYPE" >> "${SDCARD}/boot/armbianEnv.txt"
451454
elif [[ $rootpart != 1 && $SRC_EXTLINUX != yes && -f "${SDCARD}/boot/${bootscript_dst}" ]]; then
452455
local bootscript_dst=${BOOTSCRIPT##*:}
453-
sed -i 's/mmcblk0p1/mmcblk0p2/' $SDCARD/boot/$bootscript_dst
456+
sed -i 's/mmcblk0p1/mmcblk0p2/' "${SDCARD}/boot/${bootscript_dst}"
454457
sed -i -e "s/rootfstype=ext4/rootfstype=$ROOTFS_TYPE/" \
455-
-e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" $SDCARD/boot/$bootscript_dst
458+
-e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" "${SDCARD}/boot/${bootscript_dst}"
456459
fi
457460

458461
# if we have boot.ini = remove armbianEnv.txt and add UUID there if enabled
459462
if [[ -f $SDCARD/boot/boot.ini ]]; then
460463
display_alert "Found boot.ini" "${SDCARD}/boot/boot.ini" "debug"
461-
sed -i -e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" $SDCARD/boot/boot.ini
464+
sed -i -e "s/rootfstype \"ext4\"/rootfstype \"$ROOTFS_TYPE\"/" "${SDCARD}/boot/boot.ini"
462465
if [[ $CRYPTROOT_ENABLE == yes ]]; then
463466
rootpart="UUID=${physical_root_part_uuid}"
464-
sed -i 's/^setenv rootdev .*/setenv rootdev "\/dev\/mapper\/'$CRYPTROOT_MAPPER' cryptdevice='$rootpart':'$CRYPTROOT_MAPPER'"/' $SDCARD/boot/boot.ini
467+
sed -i 's#^setenv rootdev .*#setenv rootdev "/dev/mapper/'$CRYPTROOT_MAPPER' cryptdevice='$rootpart':'$CRYPTROOT_MAPPER'"#' "${SDCARD}/boot/boot.ini"
465468
else
466-
sed -i 's/^setenv rootdev .*/setenv rootdev "'$rootfs'"/' $SDCARD/boot/boot.ini
469+
sed -i 's/^setenv rootdev .*/setenv rootdev "'$rootfs'"/' "${SDCARD}/boot/boot.ini"
467470
fi
468471
if [[ $LINUXFAMILY != meson64 ]]; then # @TODO: why only for meson64?
469-
[[ -f $SDCARD/boot/armbianEnv.txt ]] && rm $SDCARD/boot/armbianEnv.txt
472+
[[ -f "${SDCARD}/boot/armbianEnv.txt" ]] && rm "${SDCARD}/boot/armbianEnv.txt"
470473
fi
471474
fi
472475

473476
# if we have a headless device, set console to DEFAULT_CONSOLE
474-
if [[ -n $DEFAULT_CONSOLE && -f $SDCARD/boot/armbianEnv.txt ]]; then
475-
if grep -lq "^console=" $SDCARD/boot/armbianEnv.txt; then
476-
sed -i "s/^console=.*/console=$DEFAULT_CONSOLE/" $SDCARD/boot/armbianEnv.txt
477+
if [[ -n $DEFAULT_CONSOLE && -f "${SDCARD}/boot/armbianEnv.txt" ]]; then
478+
if grep -lq "^console=" "${SDCARD}/boot/armbianEnv.txt"; then
479+
sed -i "s/^console=.*/console=$DEFAULT_CONSOLE/" "${SDCARD}/boot/armbianEnv.txt"
477480
else
478-
echo "console=$DEFAULT_CONSOLE" >> $SDCARD/boot/armbianEnv.txt
481+
echo "console=$DEFAULT_CONSOLE" >> "${SDCARD}/boot/armbianEnv.txt"
479482
fi
480483
fi
481484

@@ -499,10 +502,10 @@ function prepare_partitions() {
499502
fi
500503

501504
# complement extlinux config if it exists; remove armbianEnv in this case.
502-
if [[ -f $SDCARD/boot/extlinux/extlinux.conf ]]; then
503-
echo " append root=$rootfs $SRC_CMDLINE $MAIN_CMDLINE" >> $SDCARD/boot/extlinux/extlinux.conf
505+
if [[ -f "${SDCARD}/boot/extlinux/extlinux.conf" ]]; then
506+
echo " append root=$rootfs $SRC_CMDLINE $MAIN_CMDLINE" >> "${SDCARD}/boot/extlinux/extlinux.conf"
504507
display_alert "extlinux.conf exists" "removing armbianEnv.txt" "info"
505-
[[ -f $SDCARD/boot/armbianEnv.txt ]] && run_host_command_logged rm -v $SDCARD/boot/armbianEnv.txt
508+
[[ -f "${SDCARD}/boot/armbianEnv.txt" ]] && run_host_command_logged rm -v "${SDCARD}/boot/armbianEnv.txt"
506509
fi
507510

508511
if [[ $SRC_EXTLINUX != yes && -f $SDCARD/boot/armbianEnv.txt ]]; then

0 commit comments

Comments
 (0)