Code review comment for lp:~roadmr/ubuntu/oneiric/casper/809885

Revision history for this message
Colin Watson (cjwatson) wrote :

To be honest, I think this just highlights the bad way casper was handling this file before you touched it (which is my fault, since apparently I introduced this code). Rather than patching around the problem, could you just make casper read ipconfig's output as shell input using '. /tmp/net-"${DEVICE}".conf', and then we can just use the resulting shell variables? That would be more reliable long-term than trying to keep up with which way ipconfig currently quotes shell variables.

You mention arbitrary code execution in your bug report; but I don't think that's a concern here. All this code is running as root, and if ipconfig wanted to cause casper to run some evil code then it could just do so itself. Furthermore, it's all running in the initramfs, where there is no possibility that a malicious user might have injected data into /tmp. The current code in casper tries to parse ipconfig's output like this because it's wrong, not because it's clever.

review: Needs Fixing

« Back to merge proposal