dracut can execute commands from malformed /etc/os-release

[0n0w1c]

Describe the bug
A malformed /etc/os-release can execute commands during the creation of the initramfs.

Distribution used
Manjaro

Dracut version
051-1

Init system
systemd

To Reproduce
Create /usr/lib/os-release with the following:

NAME="Manjaro-ARM"
ID=manjaro-arm
ID_LIKE=manjaro arch
PRETTY_NAME="Manjaro ARM"
ANSI_COLOR="1;32"
HOME_URL="https://www.manjaro.org/"
SUPPORT_URL="https://forum.manjaro.org/c/arm/"

Create the the following symbolic link:
/etc/os-release -> /usr/lib/os-release

Create an initramfs and you will see the following in the output:

dracut: *** Including module: base ***
/etc/os-release: line 3: arch: command not found

If you create /usr/bin/arch and then recreate the initramfs, it will execute the file.

Expected behavior
An error or warning message of the syntax error, no execution of files.

Additional context

[johannbg]

Dracut is not a configuration file syntax checker, expecting that is somewhat out of the scope for the project.
You could file an RFE in the systemd repo asking that systemd-analyze could be extended to verify the syntax for the file in question, if implemented we could then use that.

That dracut tries to execute the second field of "ID_LIKE=" in operating system identification file is quite the bug and probably one that is happening elsewhere as well.

[haraldh]

OS-RELEASE(5)                                                           os-release                                                           OS-RELEASE(5)

NAME
       os-release - Operating system identification

SYNOPSIS
       /etc/os-release

       /usr/lib/os-release

DESCRIPTION
       The /etc/os-release and /usr/lib/os-release files contain operating system identification data.

       The basic file format of os-release is a newline-separated list of environment-like shell-compatible variable assignments.
       It is possible to source the configuration from shell scripts, ...

It is possible to source the configuration from shell scripts, ...

👆