Skip to content

Commit 53b9be2

Browse files
committed
Fix argv injection in _create_user and gpasswd loop
Use argv list with run() instead of f-string interpolation into SysCommand, add debug logging on failure.
1 parent de43019 commit 53b9be2

1 file changed

Lines changed: 11 additions & 6 deletions

File tree

archinstall/lib/installer.py

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1922,16 +1922,17 @@ def _create_user(self, user: User) -> None:
19221922
if not handled_by_plugin:
19231923
info(f'Creating user {user.username}')
19241924

1925-
cmd = 'useradd -m'
1925+
cmd = ['arch-chroot', '-S', str(self.target), 'useradd', '-m']
19261926

19271927
if user.sudo:
1928-
cmd += ' -G wheel'
1928+
cmd += ['-G', 'wheel']
19291929

1930-
cmd += f' {user.username}'
1930+
cmd.append(user.username)
19311931

19321932
try:
1933-
self.arch_chroot(cmd)
1934-
except SysCallError as err:
1933+
run(cmd)
1934+
except CalledProcessError as err:
1935+
debug(f'Error creating user {user.username}: {err}')
19351936
raise SystemError(f'Could not create user inside installation: {err}')
19361937

19371938
for plugin in plugins.values():
@@ -1942,7 +1943,11 @@ def _create_user(self, user: User) -> None:
19421943
self.set_user_password(user)
19431944

19441945
for group in user.groups:
1945-
self.arch_chroot(f'gpasswd -a {user.username} {group}')
1946+
cmd = ['arch-chroot', '-S', str(self.target), 'gpasswd', '-a', user.username, group]
1947+
try:
1948+
run(cmd)
1949+
except CalledProcessError as err:
1950+
debug(f'Error adding {user.username} to group {group}: {err}')
19461951

19471952
if user.sudo:
19481953
self.enable_sudo(user)

0 commit comments

Comments
 (0)