[sec-check] Avoid shell injection when resolving partition devices

[frostyard-hive]

Security Finding

Severity: medium
Type: unsafe-pattern

Diskutils.separate_device_and_partn concatenates a device path into an lsblk shell command and invokes it with shell=True (bootc_installer/core/disks.py:22-25). The current caller accepts any dictionary key beginning with /dev/, so a crafted key containing shell metacharacters reaches the shell unchanged.

Impact

An attacker who can influence installer step state or a device identifier can execute arbitrary commands in the installer GUI context. Even where current UI-generated values are trusted, the helper is a reusable command-injection sink.

Recommendation

Invoke subprocess.check_output with an argv list and no shell, validate that the path is an expected /dev/... device, and add a regression test proving shell metacharacters remain a single argument.

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode)

[frostyard-hive]

A signed fix commit has been pushed to sec/fix-device-shell-injection (862ed141). The branch removes the shell invocation and adds a focused regression test.

A hold-gated PR could not be opened safely: this repository has no hold label, and the sec-check token receives HTTP 403 when creating it. No unlabeled PR was left open. A maintainer must create the hold label before the security PR can be opened.