Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package dracut for openSUSE:Factory checked in at 2026-09-01 15:46:43 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/dracut (Old) and /work/SRC/openSUSE:Factory/.dracut.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "dracut" Tue Sep 1 15:46:43 2026 rev:267 rq:1374855 version:112+suse.47.gec0b378 Changes: -------- --- /work/SRC/openSUSE:Factory/dracut/dracut.changes 2026-08-21 16:49:47.011396739 +0200 +++ /work/SRC/openSUSE:Factory/.dracut.new.1265/dracut.changes 2026-09-01 15:47:15.840469244 +0200 @@ -1,0 +2,23 @@ +Mon Aug 31 11:30:52 UTC 2026 - [email protected] + +- Update to version 112+suse.47.gec0b378: + * fix(base): check first argument in load_fstype() + * fix(url-lib): check error if curl fails in subshell + * fix(dracut-systemd): actually make rd.break=pre-trigger stop before pre-trigger + * fix(lvm): unset DM_VG_NAME and DM_LV_NAME in each iteration + * fix(lvm): drop stray leading and trailing spaces from generated cmdline + * fix(lvm): install the LVM system ID file again + * fix(lvm): deduplicate rd.lvm.lv= arguments in cmdline() + * fix(lvm): check all host devices in cmdline() + * fix(iscsi): sanitize netroot= value passed to initqueue scripts + +- CVE-2026-6893: root code execution via dhcp options command injection + (bsc#1268322, follow-up fixes recently merged) + * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override + * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw + * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname + * fix(network-legacy): strip DHCP-supplied domain to a safe charset + +- Maintain configuration in OBS + +------------------------------------------------------------------- @@ -961,0 +985,4 @@ + +- CVE-2026-16445: root code execution via dhcp options command injection in + networkmanager initrd module (bsc#1273580) + * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts Old: ---- dracut-112+suse.34.g35e16b7.tar.xz New: ---- 01-dist.conf 10-fips.conf 10-ima.conf dracut-112+suse.47.gec0b378.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ dracut.spec ++++++ --- /var/tmp/diff_new_pack.AAKJ3p/_old 2026-09-01 15:47:16.857504726 +0200 +++ /var/tmp/diff_new_pack.AAKJ3p/_new 2026-09-01 15:47:16.859504795 +0200 @@ -26,7 +26,7 @@ %endif Name: dracut -Version: 112+suse.34.g35e16b7 +Version: 112+suse.47.gec0b378 Release: 0 Summary: Event driven initramfs infrastructure License: GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later @@ -38,12 +38,18 @@ # Temporary files for locations outside of /usr and /etc (jsc#PED-14785 - comply # with immutable mode). Source3: dracut-rpm-tmpfiles.conf +# Distribution configuration. +Source4: 01-dist.conf # Example configuration to add the debug module. -Source4: 99-debug.conf +Source5: 99-debug.conf +# Configuration for FIPS. +Source6: 10-fips.conf +# Configuration for IMA. +Source7: 10-ima.conf # Default by-uuid persistent policy. -Source5: persistent_policy.conf +Source8: persistent_policy.conf # Specific by-path persistent policy for s390x (bsc#915218). -Source6: s390x_persistent_policy.conf +Source9: s390x_persistent_policy.conf BuildRequires: bash BuildRequires: cargo BuildRequires: docbook-xsl-stylesheets @@ -174,18 +180,18 @@ %endif rm -rf %{buildroot}%{dracutlibdir}/dracut.conf.d/* -install -D -m 0644 dracut.conf.d/opensuse/01-dist.conf %{buildroot}%{dracutlibdir}/dracut.conf.d/01-dist.conf -install -m 0644 %{SOURCE4} %{buildroot}%{_sysconfdir}/dracut.conf.d/99-debug.conf +install -D -m 0644 %{SOURCE4} %{buildroot}%{dracutlibdir}/dracut.conf.d/01-dist.conf +install -D -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/dracut.conf.d/99-debug.conf %ifnarch %ix86 -install -m 0644 dracut.conf.d/fips/10-fips.conf %{buildroot}%{_sysconfdir}/dracut.conf.d/10-fips.conf -install -m 0644 dracut.conf.d/ima/10-ima.conf %{buildroot}%{_sysconfdir}/dracut.conf.d/10-ima.conf +install -m 0644 %{SOURCE6} %{buildroot}%{_sysconfdir}/dracut.conf.d/10-fips.conf +install -m 0644 %{SOURCE7} %{buildroot}%{_sysconfdir}/dracut.conf.d/10-ima.conf %endif # Install persistent policy config. %ifarch s390 s390x -install -m 0644 %{SOURCE6} %{buildroot}%{_sysconfdir}/dracut.conf.d/10-persistent_policy.conf +install -m 0644 %{SOURCE9} %{buildroot}%{_sysconfdir}/dracut.conf.d/10-persistent_policy.conf %else -install -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/dracut.conf.d/10-persistent_policy.conf +install -m 0644 %{SOURCE8} %{buildroot}%{_sysconfdir}/dracut.conf.d/10-persistent_policy.conf %endif # Install tmpfiles config. ++++++ 01-dist.conf ++++++ # openSUSE specific dracut settings # # openSUSE by default always builds as small as possible initrd for performance # and resource reasons. # If you like to build a generic initrd which works on other platforms than # on the one dracut got called comment out below setting(s). hostonly="yes" hostonly_cmdline="yes" initrdname="initrd-$kernel" compress="zstd" compress_level_zstd="3" i18n_vars="/etc/sysconfig/language:RC_LANG-LANG,RC_LC_ALL-LC_ALL /etc/sysconfig/console:CONSOLE_UNICODEMAP-FONT_UNIMAP,CONSOLE_FONT-FONT,CONSOLE_SCREENMAP-FONT_MAP /etc/sysconfig/keyboard:KEYTABLE-KEYMAP" omit_drivers+=" i2o_scsi " stdloglvl=3 sysloglvl=4 ++++++ 10-fips.conf ++++++ # turn on fips module add_dracutmodules+=" fips " ++++++ 10-ima.conf ++++++ # turn on Linux Integrity Measurement Architecture (IMA) modules add_dracutmodules+=" integrity " ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.AAKJ3p/_old 2026-09-01 15:47:17.028510692 +0200 +++ /var/tmp/diff_new_pack.AAKJ3p/_new 2026-09-01 15:47:17.032510831 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/opensuse/dracut-ng.git</param> - <param name="changesrevision">35e16b71af65acc8ac49596cb6bc0f5442fdd7e1</param></service></servicedata> + <param name="changesrevision">ec0b378ca3bcb18f4e4596f8d7bd09c5e30e9bd7</param></service></servicedata> (No newline at EOF) ++++++ dracut-112+suse.34.g35e16b7.tar.xz -> dracut-112+suse.47.gec0b378.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dracut-112+suse.34.g35e16b7/modules.d/35network-legacy/dhclient-script.sh new/dracut-112+suse.47.gec0b378/modules.d/35network-legacy/dhclient-script.sh --- old/dracut-112+suse.34.g35e16b7/modules.d/35network-legacy/dhclient-script.sh 2026-08-19 11:11:36.000000000 +0200 +++ new/dracut-112+suse.47.gec0b378/modules.d/35network-legacy/dhclient-script.sh 2026-08-31 13:28:54.000000000 +0200 @@ -14,8 +14,9 @@ mask=$new_subnet_mask bcast=$new_broadcast_address gw=${new_routers%%,*} - # get rid of control chars - domain=$(printf -- "%s" "$new_domain_name" | tr -d '[:cntrl:]') + # get rid of control chars and anything else that is unsafe in + # generated shell snippets (/tmp/net.$netif.hostname is sourced later) + domain=$(printf -- "%s" "$new_domain_name" | tr -d -c 'a-zA-Z0-9.-') search=$(printf -- "%s" "$new_domain_search" | tr -d '[:cntrl:]') namesrv=$new_domain_name_servers hostname=$(printf '%s' "$new_host_name" | tr -d -c 'a-zA-Z0-9.-') @@ -88,8 +89,9 @@ } setup_interface6() { - # get rid of control chars - domain=$(printf -- "%s" "$new_domain_name" | tr -d '[:cntrl:]') + # get rid of control chars and anything else that is unsafe in + # generated shell snippets (/tmp/net.$netif.hostname is sourced later) + domain=$(printf -- "%s" "$new_domain_name" | tr -d -c 'a-zA-Z0-9.-') search=$(printf -- "%s" "$new_dhcp6_domain_search" | tr -d '[:cntrl:]') namesrv=$new_dhcp6_name_servers hostname=$(printf '%s' "$new_host_name" | tr -d -c 'a-zA-Z0-9.-') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dracut-112+suse.34.g35e16b7/modules.d/35network-legacy/ifup.sh new/dracut-112+suse.47.gec0b378/modules.d/35network-legacy/ifup.sh --- old/dracut-112+suse.34.g35e16b7/modules.d/35network-legacy/ifup.sh 2026-08-19 11:11:36.000000000 +0200 +++ new/dracut-112+suse.47.gec0b378/modules.d/35network-legacy/ifup.sh 2026-08-31 13:28:54.000000000 +0200 @@ -307,7 +307,7 @@ wait_for_ipv6_auto "$netif" ret=$? - [ -n "$hostname" ] && echo "echo $hostname > /proc/sys/kernel/hostname" > "/tmp/net.${netif}.hostname" + [ -n "$hostname" ] && printf "echo '%s' > /proc/sys/kernel/hostname\n" "$(escape "$hostname")" > "/tmp/net.${netif}.hostname" return "$ret" } @@ -320,7 +320,7 @@ echo 0 > /proc/sys/net/ipv6/conf/"${netif}"/accept_redirects linkup "$netif" - [ -n "$hostname" ] && echo "echo $hostname > /proc/sys/kernel/hostname" > "/tmp/net.${netif}.hostname" + [ -n "$hostname" ] && printf "echo '%s' > /proc/sys/kernel/hostname\n" "$(escape "$hostname")" > "/tmp/net.${netif}.hostname" return "$ret" } @@ -379,8 +379,8 @@ ip addr add "$ip/$mask" ${srv:+peer "$srv"} brd + dev "$netif" fi - [ -n "$gw" ] && echo "ip route replace default via '$gw' dev '$netif'" > "/tmp/net.$netif.gw" - [ -n "$hostname" ] && echo "echo '$hostname' > /proc/sys/kernel/hostname" > "/tmp/net.$netif.hostname" + [ -n "$gw" ] && printf "ip route replace default via '%s' dev '%s'\n" "$(escape "$gw")" "$(escape "$netif")" > "/tmp/net.$netif.gw" + [ -n "$hostname" ] && printf "echo '%s' > /proc/sys/kernel/hostname\n" "$(escape "$hostname")" > "/tmp/net.$netif.hostname" for ifroute in /etc/sysconfig/network/ifroute-${netif} /etc/sysconfig/network/routes ; do [ -e ${ifroute} ] || continue @@ -661,7 +661,8 @@ # Store config for later use for i in ip srv gw mask hostname macaddr mtu dns1 dns2; do - eval '[ "$'$i'" ] && echo '$i'="$'$i'"' + eval "_v=\$$i" + [ -n "$_v" ] && printf "$i='%s'\n" "$(escape "$_v")" done > "/tmp/net.$netif.override" for autoopt in $(str_replace "$autoconf" "," " "); do diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dracut-112+suse.34.g35e16b7/modules.d/45url-lib/url-lib.sh new/dracut-112+suse.47.gec0b378/modules.d/45url-lib/url-lib.sh --- old/dracut-112+suse.34.g35e16b7/modules.d/45url-lib/url-lib.sh 2026-08-19 11:11:36.000000000 +0200 +++ new/dracut-112+suse.47.gec0b378/modules.d/45url-lib/url-lib.sh 2026-08-31 13:28:54.000000000 +0200 @@ -63,7 +63,7 @@ [ -n "$proxy" ] && curl_args="$curl_args --proxy $proxy" curl_fetch_url() { - local url="$1" outloc="$2" + local url="$1" outloc="$2" ret echo "$url" > /proc/self/fd/0 if [ -n "$outloc" ]; then # shellcheck disable=SC2086 @@ -72,10 +72,15 @@ local outdir outdir="$(mkuniqdir /tmp curl_fetch_url)" ( - cd "$outdir" || exit + cd "$outdir" || exit $? # shellcheck disable=SC2086 - curl $curl_args --remote-name "$url" || return $? + curl $curl_args --remote-name "$url" ) + ret=$? + if [ "$ret" -ne 0 ]; then + rm -rf -- "$outdir" + return $ret + fi outloc="$outdir/$(ls -A "$outdir")" fi if ! [ -f "$outloc" ]; then @@ -95,7 +100,7 @@ ctorrent_args="-E 0 -e 0" ctorrent_fetch_url() { - local url="$1" outloc="$2" + local url="$1" outloc="$2" ret url=${url#*//} torrent_outloc="$outloc.torrent" echo "$url" > /proc/self/fd/0 @@ -106,10 +111,15 @@ local outdir outdir="$(mkuniqdir /tmp torrent_fetch_url)" ( - cd "$outdir" || exit + cd "$outdir" || exit $? # shellcheck disable=SC2086 - curl $curl_args --remote-name "$url" || return $? + curl $curl_args --remote-name "$url" ) + ret=$? + if [ "$ret" -ne 0 ]; then + rm -rf -- "$outdir" + return $ret + fi torrent_outloc="$outdir/$(ls -A "$outdir")" outloc=${torrent_outloc%.*} fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dracut-112+suse.34.g35e16b7/modules.d/70lvm/module-setup.sh new/dracut-112+suse.47.gec0b378/modules.d/70lvm/module-setup.sh --- old/dracut-112+suse.34.g35e16b7/modules.d/70lvm/module-setup.sh 2026-08-19 11:11:36.000000000 +0200 +++ new/dracut-112+suse.47.gec0b378/modules.d/70lvm/module-setup.sh 2026-08-31 13:28:54.000000000 +0200 @@ -33,10 +33,12 @@ uuid=$(< "/sys/block/${dev#/dev/}/dm/uuid") [[ ${uuid#LVM-} == "$uuid" ]] && continue dev=$(< "/sys/block/${dev#/dev/}/dm/name") + unset DM_VG_NAME DM_LV_NAME eval "$(dmsetup splitname --nameprefixes --noheadings --rows "$dev" 2> /dev/null)" - [[ ${DM_VG_NAME} ]] && [[ ${DM_LV_NAME} ]] || return 1 - if ! [[ ${_activated[DM_VG_NAME / DM_LV_NAME]} ]]; then - printf " rd.lvm.lv=%s " "${DM_VG_NAME}/${DM_LV_NAME} " + # shellcheck disable=SC2015 + [[ ${DM_VG_NAME} ]] && [[ ${DM_LV_NAME} ]] || continue + if ! [[ ${_activated["${DM_VG_NAME}/${DM_LV_NAME}"]} ]]; then + printf "rd.lvm.lv=%s " "${DM_VG_NAME}/${DM_LV_NAME}" _activated["${DM_VG_NAME}/${DM_LV_NAME}"]=1 fi done @@ -114,7 +116,7 @@ if [[ -f "${dracutsysrootdir-}/etc/lvm/lvmlocal.conf" ]]; then inst_simple -H /etc/lvm/lvmlocal.conf fi - eval "$(lvm dumpconfig global/system_id_source &> /dev/null)" + eval "$(lvm dumpconfig global/system_id_source 2> /dev/null)" if [ "$system_id_source" == "file" ]; then eval "$(lvm dumpconfig global/system_id_file)" if [ -f "$system_id_file" ]; then @@ -136,6 +138,7 @@ for dev in "${!host_fs_types[@]}"; do [[ -e /sys/block/${dev#/dev/}/dm/name ]] || continue dev=$(< "/sys/block/${dev#/dev/}/dm/name") + unset DM_VG_NAME DM_LV_NAME eval "$(dmsetup splitname --nameprefixes --noheadings --rows "$dev" 2> /dev/null)" # shellcheck disable=SC2015 [[ ${DM_VG_NAME} ]] && [[ ${DM_LV_NAME} ]] || continue diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dracut-112+suse.34.g35e16b7/modules.d/74iscsi/parse-iscsiroot.sh new/dracut-112+suse.47.gec0b378/modules.d/74iscsi/parse-iscsiroot.sh --- old/dracut-112+suse.34.g35e16b7/modules.d/74iscsi/parse-iscsiroot.sh 2026-08-19 11:11:36.000000000 +0200 +++ new/dracut-112+suse.47.gec0b378/modules.d/74iscsi/parse-iscsiroot.sh 2026-08-31 13:28:54.000000000 +0200 @@ -106,7 +106,7 @@ if [ -n "$netroot" ] && [ "$root" != "/dev/root" ] && [ "$root" != "dhcp" ]; then if ! getargbool 1 rd.neednet > /dev/null || ! getarg "ip="; then - /sbin/initqueue --unique --onetime --settled /sbin/iscsiroot dummy "'$netroot'" "'$NEWROOT'" + /sbin/initqueue --unique --onetime --settled /sbin/iscsiroot dummy "'$(escape "$netroot")'" "'$NEWROOT'" fi fi @@ -146,7 +146,7 @@ return 1 fi -/sbin/initqueue --unique --onetime --timeout /sbin/iscsiroot timeout "$netroot" "$NEWROOT" +/sbin/initqueue --unique --onetime --timeout /sbin/iscsiroot timeout "'$(escape "$netroot")'" "$NEWROOT" for nroot in $(getargs netroot); do [ "${nroot%%:*}" = "iscsi" ] || continue diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dracut-112+suse.34.g35e16b7/modules.d/77dracut-systemd/dracut-pre-trigger.sh new/dracut-112+suse.47.gec0b378/modules.d/77dracut-systemd/dracut-pre-trigger.sh --- old/dracut-112+suse.34.g35e16b7/modules.d/77dracut-systemd/dracut-pre-trigger.sh 2026-08-19 11:11:36.000000000 +0200 +++ new/dracut-112+suse.47.gec0b378/modules.d/77dracut-systemd/dracut-pre-trigger.sh 2026-08-31 13:28:54.000000000 +0200 @@ -10,9 +10,8 @@ make_trace_mem "hook pre-trigger" '1:shortmem' '2+:mem' '3+:slab' -source_hook pre-trigger - getargs 'rd.break=pre-trigger' && emergency_shell -n pre-trigger "Break before pre-trigger" +source_hook pre-trigger udevadm control --reload > /dev/null 2>&1 || : diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dracut-112+suse.34.g35e16b7/modules.d/80base/dracut-lib.sh new/dracut-112+suse.47.gec0b378/modules.d/80base/dracut-lib.sh --- old/dracut-112+suse.34.g35e16b7/modules.d/80base/dracut-lib.sh 2026-08-19 11:11:36.000000000 +0200 +++ new/dracut-112+suse.47.gec0b378/modules.d/80base/dracut-lib.sh 2026-08-31 13:28:54.000000000 +0200 @@ -1100,8 +1100,9 @@ # returns OK if kernel_module is loaded # modprobe fails if /lib/modules is not available (--no-kernel use case) load_fstype() { - local - fs _fs="${2:-$1}" + local - d fs _fs="${2:-$1}" set +x + [ -n "$1" ] || return 1 while read -r d fs || [ "$d" ]; do [ "${fs:-$d}" = "$_fs" ] && return 0 done < /proc/filesystems
