[PATCH] Disable dracut debug shell when password protected (#752966)
Jesse Keating
jkeating at redhat.com
Fri Jul 20 19:52:33 UTC 2012
Dracut debug shell gives users root like access, without a password.
This is not a good thing if the admin has decided that the system should
have a password protected boot loader. So for boot loaders that support
password protection, we should also add the rd.shell=0 flag to the boot
arguments to prevent the user from gaining root level access.
---
pyanaconda/bootloader.py | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/pyanaconda/bootloader.py b/pyanaconda/bootloader.py
index f375f5b..b10c25b 100644
--- a/pyanaconda/bootloader.py
+++ b/pyanaconda/bootloader.py
@@ -1682,6 +1682,10 @@ class GRUB2(GRUB):
def write_config(self):
self.write_config_console(None)
+ # See if we have a password and if so update the boot args before we
+ # write out the defaults file.
+ if self.password or self.encrypted_password:
+ self.boot_args.add("rd.shell=0")
self.write_defaults()
# if we fail to setup password auth we should complete the
@@ -1865,6 +1869,8 @@ class YabootSILOBase(BootLoader):
continue
args = Arguments()
+ if self.password or self.encrypted_password:
+ args.add("rd.shell=0")
if image.initrd:
initrd_line = "\tinitrd=%s/%s\n" % (self.boot_prefix,
image.initrd)
--
1.7.10.4
More information about the anaconda-patches
mailing list