fix: Properly escape LUKS password

Vanilla-OS · Apr 13, 2024 · 3342137 · 3342137
1 parent f3cfe62
commit 3342137
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 5 deletions.
diff --git a/core/disk/luks/luks.go b/core/disk/luks/luks.go
@@ -45,14 +45,14 @@ func IsLuks(part Partition) (bool, error) {
 func LuksOpen(part Partition, mapping, password string) error {
 	var luksOpenCmd string
 	if password != "" {
-		luksOpenCmd = fmt.Sprintf("echo '%s' | ", password)
+		luksOpenCmd = "printf \"%%s\" \"$LUKSPASS\" | "
 	} else {
 		luksOpenCmd = ""
 	}
 
 	luksOpenCmd += "cryptsetup open %s %s"
 
-	err := util.RunCommand(fmt.Sprintf(luksOpenCmd, part.GetPath(), mapping))
+	err := util.RunCommand(fmt.Sprintf(luksOpenCmd, part.GetPath(), mapping), "LUKSPASS="+password)
 	if err != nil {
 		return fmt.Errorf("failed to open LUKS-encrypted partition: %s", err)
 	}
@@ -91,9 +91,9 @@ func LuksClose(mapping string) error {
 }
 
 func LuksFormat(part Partition, password string) error {
-	luksFormatCmd := "echo '%s' | cryptsetup -q luksFormat %s"
+	luksFormatCmd := "printf \"%%s\" \"$LUKSPASS\" | cryptsetup -q luksFormat %s"
 
-	err := util.RunCommand(fmt.Sprintf(luksFormatCmd, password, part.GetPath()))
+	err := util.RunCommand(fmt.Sprintf(luksFormatCmd, part.GetPath()), "LUKSPASS="+password)
 	if err != nil {
 		return fmt.Errorf("failed to create LUKS-encrypted partition: %s", err)
 	}

diff --git a/core/util/util.go b/core/util/util.go
@@ -10,10 +10,13 @@ import (
 )
 
 // RunCommand executes a command in a subshell
-func RunCommand(command string) error {
+//
+// envVars are environement variables in the form MYVAR=myvalue that will be passed to the command
+func RunCommand(command string, envVars ...string) error {
 	stderr := new(bytes.Buffer)
 
 	cmd := exec.Command("sh", "-c", command)
+	cmd.Env = append(os.Environ(), envVars...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = stderr