diff options
| author | Daniel Golle <daniel@makrotopia.org> | 2018-02-12 23:36:54 +0100 |
|---|---|---|
| committer | Daniel Golle <daniel@makrotopia.org> | 2018-02-13 00:01:44 +0100 |
| commit | 267873ac9b9e5565f1f1550c931c413f5b5dda9d (patch) | |
| tree | c0106de9dcadc57b5386b1e732d14866057343ab /package/kernel/linux | |
| parent | 49d3c5f057768cfc6e0545267256c64baf19a4e2 (diff) | |
| download | upstream-267873ac9b9e5565f1f1550c931c413f5b5dda9d.tar.gz upstream-267873ac9b9e5565f1f1550c931c413f5b5dda9d.tar.bz2 upstream-267873ac9b9e5565f1f1550c931c413f5b5dda9d.zip | |
base-files: don't evaluate block-device uevent
Current code and also before commit da52dd0c83 was vulnerable to shell
injection using volume lables in the GPT partition table of block
devices. Given that partition names can be freely defined in GPT tables
we really shouldn't evaluate a string which is potentially crafted with
evil intentions. Hence rather use `export -n` to absorb the uevent's
variables into the environment.
Fixes commit da52dd0c83 (base-files: quote values when evaluating uevent)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
[mschiffer@universe-factory.net: suggested export -n usage]
Diffstat (limited to 'package/kernel/linux')
0 files changed, 0 insertions, 0 deletions