Re: Command injection in /etc/rc.d/netif

Hi DES,

Nobody would run that exact command on purpose. It is only a minimal PoC
for the mechanism.
The realistic case is limited sudo/doas for netif. That is commonly given
for routine network restarts. Users have no reason to expect that this also
allows arbitrary root commands.
On the config side, an `ifconfig_*=` value with metacharacters is not only
a one-shot mistake. netif runs at boot, so something like `;reboot;` can
loop until rc.conf is fixed from single-user.
On the `eval` itself: it does not look like a supported feature for shell
syntax in `ifconfig_*`. Normal values are plain words; word-splitting is
enough. I would change:

eval ${IFCONFIG_CMD} $1 ${ifconfig_args}

to:

${IFCONFIG_CMD} "$1" ${ifconfig_args}

That keeps normal argument splitting, quotes the interface name, and
removes the extra parse. Anything that depended on command substitution or
similar inside `ifconfig_*` would break; that usage is unsafe and, as far
as I can tell, undocumented. If there is a real supported case that needs
`eval` here, I will adjust.
This seems worth doing as a robustness fix.

Best regards,
Nami Arjmandi
On Mon, Aug 10, 2026 at 2:21 PM Dag-Erling Smørgrav <[email protected]> wrote:

> Nami Arjmandi <[email protected]> writes:
> > 2. Command-line interface name, including a glob touch '/tmp/;id;'
> > service netif start '/tmp/*'
>
> Why would someone run that?
>
> DES
> --
> Dag-Erling Smørgrav - [email protected]
>