From 50eaa51ce126ac618b096bb324f431d8b0be7286 Mon Sep 17 00:00:00 2001
From: dongshengyuan <545258830@qq.com>
Date: Thu, 16 Jul 2026 14:23:35 +0800
Subject: [PATCH] firstboot: validate root shell credentials

Validate passwd.shell.root after reading the credential so it uses
the same target-root shell checks as --root-shell= and prompted input.

Reproducer: CREDENTIALS_DIRECTORY=... systemd-firstboot --root=...
with passwd.shell.root=/bin/nonexistentshell

Before: /etc/passwd was written with the nonexistent root shell and
the command exited successfully.

Follow-up: 416f7b3a11e00d1a43da950fb4a00bc6c2707013
---
 src/firstboot/firstboot.c                 | 4 ++++
 test/units/TEST-74-AUX-UTILS.firstboot.sh | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
index f3ea57ec92..5ebaf89764 100644
--- a/src/firstboot/firstboot.c
+++ b/src/firstboot/firstboot.c
@@ -998,6 +998,10 @@ static int prompt_root_shell(int rfd, sd_varlink **mute_console_link) {
         if (r < 0)
                 log_debug_errno(r, "Failed to read credential passwd.shell.root, ignoring: %m");
         else {
+                r = find_shell(rfd, arg_root_shell);
+                if (r < 0)
+                        return r;
+
                 log_debug("Acquired root shell from credential.");
                 return 0;
         }
diff --git a/test/units/TEST-74-AUX-UTILS.firstboot.sh b/test/units/TEST-74-AUX-UTILS.firstboot.sh
index 8c3c222c88..4fbbb18efa 100755
--- a/test/units/TEST-74-AUX-UTILS.firstboot.sh
+++ b/test/units/TEST-74-AUX-UTILS.firstboot.sh
@@ -352,6 +352,11 @@ grep -q "^root::" "$ROOT/etc/shadow"
 rm -fv "$ROOT/etc/passwd" "$ROOT/etc/shadow"
 
 (! systemd-firstboot --root="$ROOT" --root-shell=/bin/nonexistentshell)
+WCREDS="$(mktemp -d)"
+printf '/bin/nonexistentshell' >"$WCREDS/passwd.shell.root"
+(! CREDENTIALS_DIRECTORY="$WCREDS" systemd-firstboot --root="$ROOT")
+[[ ! -e "$ROOT/etc/passwd" ]]
+rm -rf "$WCREDS"
 (! systemd-firstboot --root="$ROOT" --machine-id=invalidmachineid)
 (! systemd-firstboot --root="$ROOT" --timezone=Foo/Bar)