From aefa550c4ed3ddf0fedae4fd5c3b1472d2cc1b49 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 11 Mar 2026 11:15:27 +0100 Subject: [PATCH] firstboot: harden credential handling a bit Credentials are highly privileged things, but still, let's do some validation, because we can. (cherry picked from commit 4460a4ba2155619a2f1abb1c8de577292b260162) --- src/firstboot/firstboot.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c index 38e3adaed6e..ae1899593cd 100644 --- a/src/firstboot/firstboot.c +++ b/src/firstboot/firstboot.c @@ -412,11 +412,15 @@ static int prompt_keymap(int rfd, sd_varlink **mute_console_link) { if (arg_keymap) return 0; - r = read_credential("firstboot.keymap", (void**) &arg_keymap, NULL); + _cleanup_free_ char *km = NULL; + r = read_credential("firstboot.keymap", (void**) &km, NULL); if (r < 0) log_debug_errno(r, "Failed to read credential firstboot.keymap, ignoring: %m"); + else if (!keymap_is_valid(km)) + log_warning_errno(SYNTHETIC_ERRNO(EINVAL), "Keymap '%s' supplied via credential is not valid, ignoring.", km); else { log_debug("Acquired keymap from credential."); + arg_keymap = TAKE_PTR(km); return 0; } @@ -540,11 +544,15 @@ static int prompt_timezone(int rfd, sd_varlink **mute_console_link) { if (arg_timezone) return 0; - r = read_credential("firstboot.timezone", (void**) &arg_timezone, NULL); + _cleanup_free_ char *tz = NULL; + r = read_credential("firstboot.timezone", (void**) &tz, NULL); if (r < 0) log_debug_errno(r, "Failed to read credential firstboot.timezone, ignoring: %m"); + else if (!timezone_is_valid(tz, LOG_DEBUG)) + log_warning_errno(SYNTHETIC_ERRNO(EINVAL), "Timezone '%s' supplied via credential is not valid, ignoring.", tz); else { log_debug("Acquired timezone from credential."); + arg_timezone = TAKE_PTR(tz); return 0; }