dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-12 12:16:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

firstboot: harden credential handling a bit

Browse Source 
Credentials are highly privileged things, but still, let's do some
validation, because we can.

(cherry picked from commit 4460a4ba21)
This commit is contained in:
Lennart Poettering
2026-03-11 11:15:27 +01:00
committed by Zbigniew Jędrzejewski-Szmek
parent 097a8fc541
commit aefa550c4e
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/firstboot/firstboot.c
View File

@@ -412,11 +412,15 @@ static int prompt_keymap(int rfd, sd_varlink **mute_console_link) {
if (arg_keymap)
return 0;
r = read_credential("firstboot.keymap", (void**) &arg_keymap, NULL);
_cleanup_free_ char *km = NULL;
r = read_credential("firstboot.keymap", (void**) &km, NULL);
if (r < 0)
log_debug_errno(r, "Failed to read credential firstboot.keymap, ignoring: %m");
else if (!keymap_is_valid(km))
log_warning_errno(SYNTHETIC_ERRNO(EINVAL), "Keymap '%s' supplied via credential is not valid, ignoring.", km);
else {
log_debug("Acquired keymap from credential.");
arg_keymap = TAKE_PTR(km);
return 0;
}
@@ -540,11 +544,15 @@ static int prompt_timezone(int rfd, sd_varlink **mute_console_link) {
if (arg_timezone)
return 0;
r = read_credential("firstboot.timezone", (void**) &arg_timezone, NULL);
_cleanup_free_ char *tz = NULL;
r = read_credential("firstboot.timezone", (void**) &tz, NULL);
if (r < 0)
log_debug_errno(r, "Failed to read credential firstboot.timezone, ignoring: %m");
else if (!timezone_is_valid(tz, LOG_DEBUG))
log_warning_errno(SYNTHETIC_ERRNO(EINVAL), "Timezone '%s' supplied via credential is not valid, ignoring.", tz);
else {
log_debug("Acquired timezone from credential.");
arg_timezone = TAKE_PTR(tz);
return 0;
}