[PATCH] Disable dracut debug shell when password protected (#752966)

Jesse Keating jkeating at redhat.com
Fri Jul 20 19:52:33 UTC 2012


Dracut debug shell gives users root like access, without a password.
This is not a good thing if the admin has decided that the system should
have a password protected boot loader.  So for boot loaders that support
password protection, we should also add the rd.shell=0 flag to the boot
arguments to prevent the user from gaining root level access.
---
 pyanaconda/bootloader.py |    6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pyanaconda/bootloader.py b/pyanaconda/bootloader.py
index f375f5b..b10c25b 100644
--- a/pyanaconda/bootloader.py
+++ b/pyanaconda/bootloader.py
@@ -1682,6 +1682,10 @@ class GRUB2(GRUB):
 
     def write_config(self):
         self.write_config_console(None)
+        # See if we have a password and if so update the boot args before we
+        # write out the defaults file.
+        if self.password or self.encrypted_password:
+            self.boot_args.add("rd.shell=0")
         self.write_defaults()
 
         # if we fail to setup password auth we should complete the
@@ -1865,6 +1869,8 @@ class YabootSILOBase(BootLoader):
                 continue
 
             args = Arguments()
+            if self.password or self.encrypted_password:
+                args.add("rd.shell=0")
             if image.initrd:
                 initrd_line = "\tinitrd=%s/%s\n" % (self.boot_prefix,
                                                     image.initrd)
-- 
1.7.10.4



More information about the anaconda-patches mailing list