use "rm --" to guard against filenames beginning with "-"

50-dracut.install

@@ -26,7 +26,7 @@ case "$1" in
         ret=$?
 	;;
     remove)
-        rm -f "$3"/initrd
+        rm -f -- "$3"/initrd
         ret=$?
 	;;
 esac

Makefile

@@ -82,7 +82,7 @@ dracut.html: dracut.asc $(manpages)
 		--stringparam html.stylesheet \
 		http://docs.fedoraproject.org/en-US/Common_Content/css/default.css \
 		http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl dracut.xml
-	rm dracut.xml
+	rm -f -- dracut.xml
 
 install: dracut-version.sh
 	mkdir -p $(DESTDIR)$(pkglibdir)
@@ -164,9 +164,9 @@ dracut-$(VERSION).tar.bz2: doc
 	mkdir -p dracut-$(VERSION)
 	for i in $(manpages) dracut.html dracut-version.sh; do [ "$${i%/*}" != "$$i" ] && mkdir -p "dracut-$(VERSION)/$${i%/*}"; cp "$$i" "dracut-$(VERSION)/$$i"; done
 	tar --owner=root --group=root -rf dracut-$(VERSION).tar $$(find dracut-$(VERSION) -type f)
-	rm -fr dracut-$(VERSION).tar.bz2 dracut-$(VERSION)
+	rm -fr -- dracut-$(VERSION).tar.bz2 dracut-$(VERSION)
 	bzip2 -9 dracut-$(VERSION).tar
-	rm -f dracut-$(VERSION).tar
+	rm -f -- dracut-$(VERSION).tar
 
 rpm: dracut-$(VERSION).tar.bz2
 	rpmbuild=$$(mktemp -d -t rpmbuild-dracut.XXXXXX); src=$$(pwd); \
@@ -175,7 +175,7 @@ rpm: dracut-$(VERSION).tar.bz2
 	(cd "$$rpmbuild"; rpmbuild --define "_topdir $$PWD" --define "_sourcedir $$PWD" \
 	        --define "_specdir $$PWD" --define "_srcrpmdir $$PWD" \
 		--define "_rpmdir $$PWD" -ba dracut.spec; ) && \
-	( mv "$$rpmbuild"/$$(arch)/*.rpm .; mv "$$rpmbuild"/*.src.rpm .;rm -fr "$$rpmbuild"; ls *.rpm )
+	( mv "$$rpmbuild"/$$(arch)/*.rpm .; mv "$$rpmbuild"/*.src.rpm .;rm -fr -- "$$rpmbuild"; ls *.rpm )
 
 syncheck:
 	@ret=0;for i in dracut-initramfs-restore.sh modules.d/*/*.sh; do \

dracut-functions.sh

@@ -1508,7 +1508,7 @@ dracut_kernel_post() {
         exit 1
     fi
 
-    [[ $DRACUT_KERNEL_LAZY_HASHDIR ]] && rm -fr "$DRACUT_KERNEL_LAZY_HASHDIR"
+    [[ $DRACUT_KERNEL_LAZY_HASHDIR ]] && rm -fr -- "$DRACUT_KERNEL_LAZY_HASHDIR"
 }
 
 module_is_host_only() (

dracut-initramfs-restore.sh

@@ -17,13 +17,13 @@ cd /run/initramfs
 
 [ -f .need_shutdown -a -f "$IMG" ] || exit 1
 if zcat "$IMG"  | cpio -id --quiet >/dev/null; then
-    rm .need_shutdown
+    rm -f -- .need_shutdown
 elif xzcat "$IMG"  | cpio -id --quiet >/dev/null; then
-    rm .need_shutdown
+    rm -f -- .need_shutdown
 else
     # something failed, so we clean up
     echo "Unpacking of $IMG to /run/initramfs failed" >&2
-    rm -f /run/initramfs/shutdown
+    rm -f -- /run/initramfs/shutdown
     exit 1
 fi
 

dracut.sh

@@ -661,7 +661,7 @@ readonly initdir=$(mktemp --tmpdir="$TMPDIR/" -d -t initramfs.XXXXXX)
 }
 
 # clean up after ourselves no matter how we die.
-trap 'ret=$?;[[ $outfile ]] && [[ -f $outfile.$$ ]] && rm -f "$outfile.$$";[[ $keep ]] && echo "Not removing $initdir." >&2 || { [[ $initdir ]] && rm -rf "$initdir";exit $ret; };' EXIT
+trap 'ret=$?;[[ $outfile ]] && [[ -f $outfile.$$ ]] && rm -f -- "$outfile.$$";[[ $keep ]] && echo "Not removing $initdir." >&2 || { [[ $initdir ]] && rm -rf -- "$initdir";exit $ret; };' EXIT
 # clean up after ourselves no matter how we die.
 trap 'exit 1;' SIGINT
 
@@ -682,7 +682,7 @@ if ! $DRACUT_INSTALL ${initdir+-D "$initdir"} -R "$initdir/bin/sh" &>/dev/null;
     unset DRACUT_RESOLVE_LAZY
     export DRACUT_RESOLVE_DEPS=1
 fi
-rm -fr ${initdir}/*
+rm -fr -- ${initdir}/*
 
 if [[ -f $dracutbasedir/dracut-version.sh ]]; then
     . $dracutbasedir/dracut-version.sh
@@ -1153,8 +1153,8 @@ if [[ $UID = 0 ]] && [[ $PRELINK_BIN ]]; then
         dinfo "*** Pre-linking files ***"
         dracut_install -o prelink /etc/prelink.conf /etc/prelink.conf.d/*.conf
         chroot "$initdir" $PRELINK_BIN -a
-        rm -f "$initdir"/$PRELINK_BIN
-        rm -fr "$initdir"/etc/prelink.*
+        rm -f -- "$initdir"/$PRELINK_BIN
+        rm -fr -- "$initdir"/etc/prelink.*
         dinfo "*** Pre-linking files done ***"
     fi
 fi
@@ -1205,7 +1205,7 @@ if [[ $do_strip = yes ]] ; then
     dinfo "*** Stripping files done ***"
 fi
 
-rm -f "$outfile"
+rm -f -- "$outfile"
 dinfo "*** Creating image file ***"
 if ! ( umask 077; cd "$initdir"; find . |cpio -R 0:0 -H newc -o --quiet| \
     $compress > "$outfile.$$"; ); then

dracut.spec

@@ -202,7 +202,7 @@ make %{?_smp_mflags}
 
 %install
 %if 0%{?fedora} || 0%{?rhel}
-rm -rf $RPM_BUILD_ROOT
+rm -rf -- $RPM_BUILD_ROOT
 %endif
 make %{?_smp_mflags} install \
      DESTDIR=$RPM_BUILD_ROOT \
@@ -211,26 +211,26 @@ make %{?_smp_mflags} install \
 echo "DRACUT_VERSION=%{version}-%{release}" > $RPM_BUILD_ROOT/%{dracutlibdir}/dracut-version.sh
 
 %if 0%{?fedora} == 0 && 0%{?rhel} == 0 && 0%{?suse_version} == 0
-rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/01fips
-rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/02fips-aesni
+rm -fr -- $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/01fips
+rm -fr -- $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/02fips-aesni
 %endif
 
 %if %{defined _unitdir}
 # for systemd, better use systemd-bootchart
-rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/00bootchart
+rm -fr -- $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/00bootchart
 %endif
 
 # we do not support dash in the initramfs
-rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/00dash
+rm -fr -- $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/00dash
 
 # remove gentoo specific modules
-rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/50gensplash
+rm -fr -- $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/50gensplash
 
 %if %{defined _unitdir}
 # with systemd IMA and selinux modules do not make sense
-rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
-rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
-rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
+rm -fr -- $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
+rm -fr -- $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
+rm -fr -- $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
 %endif
 
 mkdir -p $RPM_BUILD_ROOT/boot/dracut
@@ -249,8 +249,8 @@ install -m 0644 dracut.conf.d/suse.conf.example   $RPM_BUILD_ROOT%{dracutlibdir}
 %endif
 
 %if 0%{?fedora} <= 12 && 0%{?rhel} < 6 && 0%{?suse_version} <= 9999
-rm $RPM_BUILD_ROOT%{_bindir}/mkinitrd
-rm $RPM_BUILD_ROOT%{_bindir}/lsinitrd
+rm -f -- $RPM_BUILD_ROOT%{_bindir}/mkinitrd
+rm -f -- $RPM_BUILD_ROOT%{_bindir}/lsinitrd
 %endif
 
 %if 0%{?fedora} || 0%{?rhel} > 6
@@ -270,7 +270,7 @@ mkdir -p $RPM_BUILD_ROOT/sbin
 ln -s /usr/bin/dracut $RPM_BUILD_ROOT/sbin/dracut
 
 %clean
-rm -rf $RPM_BUILD_ROOT
+rm -rf -- $RPM_BUILD_ROOT
 
 %files
 %defattr(-,root,root,0755)

modules.d/01fips/fips-boot.sh

@@ -3,7 +3,7 @@
 # ex: ts=8 sw=4 sts=4 et filetype=sh
 
 if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then
-    rm -f /etc/modprobe.d/fips.conf >/dev/null 2>&1
+    rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1
 elif getarg boot= >/dev/null; then
     . /sbin/fips.sh
     if mount_boot; then

modules.d/01fips/fips-noboot.sh

@@ -3,7 +3,7 @@
 # ex: ts=8 sw=4 sts=4 et filetype=sh
 
 if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then
-    rm -f /etc/modprobe.d/fips.conf >/dev/null 2>&1
+    rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1
 elif ! [ -f /tmp/fipsdone ]; then
     . /sbin/fips.sh
     mount_boot

modules.d/01fips/fips.sh

@@ -44,7 +44,7 @@ mount_boot()
         info "Mounting $boot as /boot"
         mount -oro "$boot" /boot || return 1
     elif [ -d "$NEWROOT/boot" ]; then
-        rm -fr /boot
+        rm -fr -- /boot
         ln -sf "$NEWROOT/boot" /boot
     fi
 }

modules.d/10i18n/module-setup.sh

@@ -102,7 +102,7 @@ install() {
         done
 
         # remove unnecessary files
-        rm -f "${initdir}${kbddir}/consoletrans/utflist"
+        rm -f -- "${initdir}${kbddir}/consoletrans/utflist"
         find "${initdir}${kbddir}/" -name README\* -delete
         find "${initdir}${kbddir}/" -name '*.gz' -print -quit \
             | while read line; do

modules.d/10i18n/parse-i18n.sh

@@ -36,7 +36,7 @@ if [ -f /etc/locale.conf ]; then
 fi
 
 if [ -n "$DRACUT_SYSTEMD" ]; then
-    rm -f /etc/udev/rules.d/10-console.rules
-    rm -f /lib/udev/rules.d/10-console.rules
-    rm -f /lib/udev/console_init
+    rm -f -- /etc/udev/rules.d/10-console.rules
+    rm -f -- /lib/udev/rules.d/10-console.rules
+    rm -f -- /lib/udev/console_init
 fi

modules.d/30convertfs/convertfs.sh

@@ -56,22 +56,22 @@ if ! needconvert; then
 fi
 
 testfile="$ROOT/.usrmovecheck$$"
-rm -f "$testfile"
+rm -f -- "$testfile"
 > "$testfile"
 if [[ ! -e "$testfile" ]]; then
     echo "Cannot write to $ROOT/"
     exit 1
 fi
-rm -f "$testfile"
+rm -f -- "$testfile"
 
 testfile="$ROOT/usr/.usrmovecheck$$"
-rm -f "$testfile"
+rm -f -- "$testfile"
 > "$testfile"
 if [[ ! -e "$testfile" ]]; then
     echo "Cannot write to $ROOT/usr/"
     exit 1
 fi
-rm -f "$testfile"
+rm -f -- "$testfile"
 
 find_mount() {
     local dev mnt etc wanted_dev
@@ -108,11 +108,11 @@ cleanup() {
     for dir in "$ROOT/bin" "$ROOT/sbin" "$ROOT/lib" "$ROOT/lib64" \
 	"$ROOT/usr/bin" "$ROOT/usr/sbin" "$ROOT/usr/lib" \
         "$ROOT/usr/lib64"; do
-        [[ -d "${dir}.usrmove-new" ]] && rm -fr "${dir}.usrmove-new"
+        [[ -d "${dir}.usrmove-new" ]] && rm -fr -- "${dir}.usrmove-new"
         if [[ -d "${dir}.usrmove-old" ]]; then
             mv "$dir" "${dir}.del~"
             mv "${dir}.usrmove-old" "$dir"
-            rm -fr "${dir}.del~"
+            rm -fr -- "${dir}.del~"
         fi
     done
 }
@@ -126,7 +126,7 @@ set -e
 
 # merge / and /usr in new dir in /usr
 for dir in bin sbin lib lib64; do
-    rm -rf "$ROOT/usr/${dir}.usrmove-new"
+    rm -rf -- "$ROOT/usr/${dir}.usrmove-new"
     [[ -L "$ROOT/$dir" ]] && continue
     [[ -d "$ROOT/$dir" ]] || continue
     echo "Make a copy of \`$ROOT/usr/$dir'."
@@ -150,7 +150,7 @@ done
 for dir in bin sbin lib lib64; do
     [[ -d "$ROOT/usr/${dir}.usrmove-new" ]] || continue
     echo "Switch to new \`$ROOT/usr/$dir'."
-    rm -fr "$ROOT/usr/${dir}.usrmove-old"
+    rm -fr -- "$ROOT/usr/${dir}.usrmove-old"
     mv "$ROOT/usr/$dir" "$ROOT/usr/${dir}.usrmove-old"
     mv "$ROOT/usr/${dir}.usrmove-new" "$ROOT/usr/$dir"
 done
@@ -160,7 +160,7 @@ for dir in bin sbin lib lib64; do
     [[ -L "$ROOT/$dir" ]] && continue
     [[ -d "$ROOT/$dir" ]] || continue
     echo "Create \`$ROOT/$dir' symlink."
-    rm -rf "$ROOT/${dir}.usrmove-old" || :
+    rm -fr -- "$ROOT/${dir}.usrmove-old" || :
     mv "$ROOT/$dir" "$ROOT/${dir}.usrmove-old"
     ln -sfn usr/$dir "$ROOT/$dir"
 done
@@ -178,9 +178,9 @@ done
 
 for dir in bin sbin lib lib64; do
     [[ -d "$ROOT/usr/${dir}.usrmove-old~" ]] \
-        && rm -rf "$ROOT/usr/${dir}.usrmove-old~" || :
+        && rm -rf -- "$ROOT/usr/${dir}.usrmove-old~" || :
     [[ -d "$ROOT/${dir}.usrmove-old~" ]] \
-        && rm -rf "$ROOT/${dir}.usrmove-old~" || :
+        && rm -rf -- "$ROOT/${dir}.usrmove-old~" || :
 done
 
 for dir in lib lib64; do

modules.d/40network/dhclient-script.sh

@@ -89,7 +89,7 @@ case $reason in
             [ -e /tmp/net.$netif.manualup ] || echo "/sbin/netroot $netif"
             echo "> /tmp/setup_net_$netif.ok"
             echo "> /tmp/setup_net_\$(cat /sys/class/net/$netif/address).ok"
-            echo "rm -f $hookdir/initqueue/setup_net_$netif.sh"
+            echo "rm -f -- $hookdir/initqueue/setup_net_$netif.sh"
         } > $hookdir/initqueue/setup_net_$netif.sh
 
         echo "[ -f /tmp/setup_net_$netif.ok ]" > $hookdir/initqueue/finished/dhclient-$netif.sh

modules.d/40network/net-lib.sh

@@ -105,7 +105,7 @@ ifdown() {
     ip link set $netif down
     ip addr flush dev $netif
     echo "#empty" > /etc/resolv.conf
-    rm -f /tmp/net.$netif.did-setup
+    rm -f -- /tmp/net.$netif.did-setup
     # TODO: send "offline" uevent?
 }
 

modules.d/40network/netroot.sh

@@ -76,7 +76,7 @@ source_hook netroot $netif
 # Run the handler; don't store the root, it may change from device to device
 # XXX other variables to export?
 if $handler $netif $netroot $NEWROOT; then
-    rm -f $hookdir/initqueue/finished/dhcp.sh
+    rm -f -- $hookdir/initqueue/finished/dhcp.sh
     # Network rootfs mount successful - save interface info for ifcfg etc.
     save_netinfo $netif
 fi

modules.d/80cms/cmssetup.sh

@@ -167,7 +167,7 @@ function dasd_settle_all() {
 
 	    printf 'SUBSYSTEM=="net", ACTION=="add", DRIVERS=="%s", KERNELS=="%s", ENV{INTERFACE}=="?*", RUN+="/sbin/initqueue --onetime --unique --name cmsifup-$env{INTERFACE} /sbin/cmsifup $env{INTERFACE}"\n' "$driver" "$devbusid" > /etc/udev/rules.d/99-cms.rules
         # remove the default net rules
-            rm -f /etc/udev/rules.d/91-default-net.rules
+            rm -f -- /etc/udev/rules.d/91-default-net.rules
 	    [[ -f /etc/udev/rules.d/90-net.rules ]] \
 	        || printf 'SUBSYSTEM=="net", ACTION=="online", RUN+="/sbin/initqueue --onetime --env netif=$env{INTERFACE} source_hook initqueue/online"\n' >> /etc/udev/rules.d/99-cms.rules
             udevadm control --reload

modules.d/90crypt/crypt-cleanup.sh

@@ -2,7 +2,7 @@
 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
 # ex: ts=8 sw=4 sts=4 et filetype=sh
 # close everything which is not busy
-rm -f /etc/udev/rules.d/70-luks.rules >/dev/null 2>&1
+rm -f -- /etc/udev/rules.d/70-luks.rules >/dev/null 2>&1
 
 if ! getarg rd.luks.uuid -d rd_LUKS_UUID >/dev/null 2>&1 && getargbool 1 rd.luks -d -n rd_NO_LUKS >/dev/null 2>&1; then
     while true; do

modules.d/90crypt/parse-crypt.sh

@@ -4,7 +4,7 @@
 
 if ! getargbool 1 rd.luks -d -n rd_NO_LUKS; then
     info "rd.luks=0: removing cryptoluks activation"
-    rm -f /etc/udev/rules.d/70-luks.rules
+    rm -f -- /etc/udev/rules.d/70-luks.rules
 else
     {
         echo 'SUBSYSTEM!="block", GOTO="luks_end"'

modules.d/90dmsquash-live/iso-scan.sh

@@ -24,7 +24,7 @@ do_iso_scan() {
         mount -t auto -o ro "$dev" "/run/initramfs/isoscan" || continue
         if [ -f "/run/initramfs/isoscan/$isofile" ]; then
             losetup -f "/run/initramfs/isoscan/$isofile"
-            rm -f "$job"
+            rm -f -- "$job"
             exit 0
         else
             umount "/run/initramfs/isoscan"

modules.d/90lvm/lvm_scan.sh

@@ -125,7 +125,7 @@ if [ -z "$LVS" -o -n "$VGS" ]; then
 fi
 
 if [ "$lvmwritten" ]; then
-    rm -f /etc/lvm/lvm.conf
+    rm -f -- /etc/lvm/lvm.conf
 fi
 unset lvmwritten
 

modules.d/90lvm/parse-lvm.sh

@@ -2,7 +2,7 @@
 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
 # ex: ts=8 sw=4 sts=4 et filetype=sh
 if [ -e /etc/lvm/lvm.conf ] && ! getargbool 1 rd.lvm.conf -d -n rd_NO_LVMCONF; then
-    rm -f /etc/lvm/lvm.conf
+    rm -f -- /etc/lvm/lvm.conf
 fi
 
 LV_DEVS="$(getargs rd.lvm.vg -d rd_LVM_VG=) $(getargs rd.lvm.lv -d rd_LVM_LV=)"
@@ -10,7 +10,7 @@ LV_DEVS="$(getargs rd.lvm.vg -d rd_LVM_VG=) $(getargs rd.lvm.lv -d rd_LVM_LV=)"
 if ! getargbool 1 rd.lvm -d -n rd_NO_LVM \
     || ( [ -z "$LV_DEVS" ] && ! getargbool 0 rd.auto ); then
     info "rd.lvm=0: removing LVM activation"
-    rm -f /etc/udev/rules.d/64-lvm*.rules
+    rm -f -- /etc/udev/rules.d/64-lvm*.rules
 else
     for dev in $LV_DEVS; do
         wait_for_dev "/dev/$dev"

modules.d/90mdraid/parse-md.sh

@@ -32,11 +32,11 @@ fi
 
 if [ -e /etc/mdadm.conf ] && getargbool 1 rd.md.conf -d -n rd_NO_MDADMCONF; then
     udevproperty rd_MDADMCONF=1
-    rm -f $hookdir/pre-pivot/*mdraid-cleanup.sh
+    rm -f -- $hookdir/pre-pivot/*mdraid-cleanup.sh
 fi
 
 if ! getargbool 1 rd.md.conf -d -n rd_NO_MDADMCONF; then
-    rm -f /etc/mdadm/mdadm.conf /etc/mdadm.conf
+    rm -f -- /etc/mdadm/mdadm.conf /etc/mdadm.conf
     ln -s $(command -v mdraid-cleanup) $hookdir/pre-pivot/31-mdraid-cleanup.sh 2>/dev/null
 fi
 

modules.d/90multipath/multipathd.sh

@@ -7,6 +7,6 @@ if [ -e /etc/multipath.conf ]; then
     multipathd -B || multipathd
     need_shutdown
 else
-    rm /etc/udev/rules.d/??-multipath.rules 2>/dev/null
+    rm -- /etc/udev/rules.d/??-multipath.rules 2>/dev/null
 fi
 

modules.d/95cifs/cifsroot.sh

@@ -21,6 +21,6 @@ echo options: $options
 mount.cifs //$server/$path $NEWROOT -o $options && { [ -e /dev/root ] || ln -s null /dev/root ; }
 
 # inject new exit_if_exists
-echo 'settle_exit_if_exists="--exit-if-exists=/dev/root"; rm "$job"' > $hookdir/initqueue/cifs.sh
+echo 'settle_exit_if_exists="--exit-if-exists=/dev/root"; rm -f -- "$job"' > $hookdir/initqueue/cifs.sh
 # force udevsettle to break
 > $hookdir/initqueue/work

modules.d/95nfs/nfsroot.sh

@@ -21,7 +21,7 @@ mount_nfs $root $NEWROOT $netif && { [ -e /dev/root ] || ln -s null /dev/root ;
 [ -f $NEWROOT/etc/fstab ] && cat $NEWROOT/etc/fstab > /dev/null
 
 # inject new exit_if_exists
-echo 'settle_exit_if_exists="--exit-if-exists=/dev/root"; rm "$job"' > $hookdir/initqueue/nfs.sh
+echo 'settle_exit_if_exists="--exit-if-exists=/dev/root"; rm -- "$job"' > $hookdir/initqueue/nfs.sh
 # force udevsettle to break
 > $hookdir/initqueue/work
 

modules.d/95resume/parse-resume.sh

@@ -55,10 +55,10 @@ if [ -n "$resume" ]; then
             ${resume#/dev/};
     } >> /etc/udev/rules.d/99-resume.rules
 
-    printf '[ -e "%s" ] && { ln -s "%s" /dev/resume; rm "$job" "%s/initqueue/timeout/resume.sh"; }\n' \
+    printf '[ -e "%s" ] && { ln -s "%s" /dev/resume; rm -f -- "$job" "%s/initqueue/timeout/resume.sh"; }\n' \
         "$resume" "$resume" "$hookdir" >> $hookdir/initqueue/settled/resume.sh
 
-    printf 'warn "Cancelling resume operation. Device not found."; cancel_wait_for_dev /dev/resume; rm "$job" "%s/initqueue/settled/resume.sh";' \
+    printf 'warn "Cancelling resume operation. Device not found."; cancel_wait_for_dev /dev/resume; rm -f -- "$job" "%s/initqueue/settled/resume.sh";' \
         "$hookdir" >> $hookdir/initqueue/timeout/resume.sh
 
     wait_for_dev "/dev/resume"

modules.d/95rootfs-block/mount-root.sh

@@ -130,8 +130,8 @@ mount_root() {
     fi
 
     if ! getargbool 0 rd.skipfsck; then
-        [ -f "$NEWROOT"/forcefsck ] && rm -f "$NEWROOT"/forcefsck 2>/dev/null
-        [ -f "$NEWROOT"/.autofsck ] && rm -f "$NEWROOT"/.autofsck 2>/dev/null
+        [ -f "$NEWROOT"/forcefsck ] && rm -f -- "$NEWROOT"/forcefsck 2>/dev/null
+        [ -f "$NEWROOT"/.autofsck ] && rm -f -- "$NEWROOT"/.autofsck 2>/dev/null
     fi
 }
 

modules.d/95virtfs/mount-virtfs.sh

@@ -66,8 +66,8 @@ mount_root() {
     info "Remounting ${root#virtfs:} with -o ${rflags}"
     mount -t ${rootfs} -o "$rflags" "${root#virtfs:}" "$NEWROOT" 2>&1 | vinfo
 
-    [ -f "$NEWROOT"/forcefsck ] && rm -f "$NEWROOT"/forcefsck 2>/dev/null
-    [ -f "$NEWROOT"/.autofsck ] && rm -f "$NEWROOT"/.autofsck 2>/dev/null
+    [ -f "$NEWROOT"/forcefsck ] && rm -f -- "$NEWROOT"/forcefsck 2>/dev/null
+    [ -f "$NEWROOT"/.autofsck ] && rm -f -- "$NEWROOT"/.autofsck 2>/dev/null
 }
 
 if [ -n "$root" -a -z "${root%%virtfs:*}" ]; then

modules.d/97biosdevname/parse-biosdevname.sh

@@ -4,7 +4,7 @@
 if ! getargbool 1 biosdevname; then
     info "biosdevname=0: removing biosdevname network renaming"
     udevproperty UDEV_BIOSDEVNAME=
-    rm -f /etc/udev/rules.d/71-biosdevname.rules
+    rm -f -- /etc/udev/rules.d/71-biosdevname.rules
 else
     info "biosdevname=1: activating biosdevname network renaming"
     udevproperty UDEV_BIOSDEVNAME=1

modules.d/98systemd/dracut-emergency.service

@@ -21,7 +21,7 @@ Environment=DRACUT_SYSTEMD=1
 Environment=NEWROOT=/sysroot
 WorkingDirectory=/
 ExecStart=/bin/dracut-emergency
-ExecStopPost=-/bin/rm -f /.console_lock
+ExecStopPost=-/bin/rm -f -- /.console_lock
 Type=oneshot
 StandardInput=tty-force
 StandardOutput=inherit

modules.d/98systemd/dracut-emergency.sh

@@ -36,6 +36,6 @@ else
     exit 1
 fi
 
-/bin/rm -f /.console_lock
+/bin/rm -f -- /.console_lock
 
 exit 0

modules.d/98systemd/dracut-initqueue.sh

@@ -30,7 +30,7 @@ while :; do
     check_finished && break
 
     if [ -f $hookdir/initqueue/work ]; then
-        rm $hookdir/initqueue/work
+        rm -f -- "$hookdir/initqueue/work"
     fi
 
     for job in $hookdir/initqueue/*.sh; do

modules.d/98systemd/dracut-mount.sh

@@ -26,7 +26,7 @@ while :; do
             usable_root "$NEWROOT" && break;
             warn "$NEWROOT has no proper rootfs layout, ignoring and removing offending mount hook"
             umount "$NEWROOT"
-            rm -f "$f"
+            rm -f -- "$f"
         fi
     done
 

modules.d/98systemd/dracut-pre-pivot.sh

@@ -23,6 +23,6 @@ source_hook cleanup
 getarg rd.break -d rdbreak && emergency_shell -n switch_root "Break before switch_root"
 
 # remove helper symlink
-[ -h /dev/root ] && rm -f /dev/root
+[ -h /dev/root ] && rm -f -- /dev/root
 
 exit 0

modules.d/98systemd/rescue.service

@@ -18,7 +18,7 @@ Environment=NEWROOT=/sysroot
 WorkingDirectory=/
 ExecStartPre=-/bin/plymouth quit
 ExecStart=-/bin/sh -i -l
-ExecStopPost=-/bin/rm -f /.console_lock
+ExecStopPost=-/bin/rm -f -- /.console_lock
 ExecStopPost=-/usr/bin/systemctl --fail --no-block default
 Type=idle
 StandardInput=tty-force

modules.d/99base/dracut-lib.sh

@@ -754,7 +754,7 @@ inst_hook() {
 
     if [ -n "$onetime" ]; then
         {
-            echo '[ -e "$_job" ] && rm "$_job"'
+            echo '[ -e "$_job" ] && rm -f -- "$_job"'
             echo "$_exe $@"
         } > "/tmp/$$-${_job}.sh"
     else
@@ -867,12 +867,12 @@ cancel_wait_for_dev()
 {
     local _name
     _name="$(str_replace "$1" '/' '\\x2f')"
-    rm -f "$hookdir/initqueue/finished/devexists-${_name}.sh"
-    rm -f "$hookdir/emergency/80-${_name}.sh"
+    rm -f -- "$hookdir/initqueue/finished/devexists-${_name}.sh"
+    rm -f -- "$hookdir/emergency/80-${_name}.sh"
     if [ -n "$DRACUT_SYSTEMD" ]; then
         _name=$(dev_unit_name "$1")
-        rm -f ${PREFIX}/etc/systemd/system/initrd.target.requires/${_name}.device
-        rm -f ${PREFIX}/etc/systemd/system/${_name}.device.d/timeout.conf
+        rm -f -- ${PREFIX}/etc/systemd/system/initrd.target.requires/${_name}.device
+        rm -f -- ${PREFIX}/etc/systemd/system/${_name}.device.d/timeout.conf
         /sbin/initqueue --onetime --unique --name daemon-reload systemctl daemon-reload
     fi
 }
@@ -921,7 +921,7 @@ wait_for_loginit()
     fi
 
     setdebug
-    rm -f /run/initramfs/loginit.pipe /run/initramfs/loginit.pid
+    rm -f -- /run/initramfs/loginit.pipe /run/initramfs/loginit.pid
 }
 
 _emergency_shell()
@@ -931,8 +931,8 @@ _emergency_shell()
         > /.console_lock
         echo "PS1=\"$_name:\\\${PWD}# \"" >/etc/profile
         systemctl start dracut-emergency.service
-        rm -f /etc/profile
-        rm -f /.console_lock
+        rm -f -- /etc/profile
+        rm -f -- /.console_lock
     else
         debug_off
         echo

modules.d/99base/init.sh

@@ -85,7 +85,7 @@ if ! ismounted /run; then
     mount -t tmpfs -o mode=0755,nosuid,nodev,strictatime tmpfs /newrun >/dev/null 
     cp -a /run/* /newrun >/dev/null 2>&1
     mount --move /newrun /run
-    rm -fr /newrun
+    rm -fr -- /newrun
 fi
 
 trap "action_on_fail Signal caught!" 0
@@ -174,7 +174,7 @@ while :; do
     check_finished && break
 
     if [ -f $hookdir/initqueue/work ]; then
-        rm $hookdir/initqueue/work
+        rm -f -- $hookdir/initqueue/work
     fi
 
     for job in $hookdir/initqueue/*.sh; do
@@ -237,7 +237,7 @@ while :; do
             usable_root "$NEWROOT" && break;
             warn "$NEWROOT has no proper rootfs layout, ignoring and removing offending mount hook"
             umount "$NEWROOT"
-            rm -f "$f"
+            rm -f -- "$f"
         fi
     done
 
@@ -317,7 +317,7 @@ for i in $(export -p); do
     esac
 done
 . /tmp/export.orig 2>/dev/null || :
-rm -f /tmp/export.orig
+rm -f -- /tmp/export.orig
 
 initargs=""
 read CLINE </proc/cmdline
@@ -356,7 +356,7 @@ fi
 wait_for_loginit
 
 # remove helper symlink
-[ -h /dev/root ] && rm -f /dev/root
+[ -h /dev/root ] && rm -f -- /dev/root
 
 getarg rd.break -d rdbreak && emergency_shell -n switch_root "Break before switch_root"
 info "Switching root"

modules.d/99base/initqueue.sh

@@ -46,7 +46,7 @@ shift
 [ -x "$exe" ] || exe=$(command -v $exe)
 
 {
-    [ -n "$onetime" ] && echo '[ -e "$job" ] && rm "$job"'
+    [ -n "$onetime" ] && echo '[ -e "$job" ] && rm -f -- "$job"'
     [ -n "$env" ] && echo "$env"
     echo "$exe $@"
 } > "/tmp/$$-${job}.sh"

modules.d/99base/loginit.sh

@@ -14,7 +14,7 @@ exec 6>/run/initramfs/init.log
 
 while read line; do
     if [ "$line" = "DRACUT_LOG_END" ]; then
-        rm -f /run/initramfs/loginit.pipe
+        rm -f -- /run/initramfs/loginit.pipe
         exit 0
     fi
     echo "<31>dracut: $line" >&5

modules.d/99shutdown/shutdown.sh

@@ -86,7 +86,7 @@ _check_shutdown() {
         [ -e "$__f" ] || continue
         ( . "$__f" $1 )
         if [ $? -eq 0 ]; then
-            rm -f $__f
+            rm -f -- $__f
             __s=0
         fi
     done

test/TEST-01-BASIC/create-root.sh

@@ -3,7 +3,7 @@
 for x in 64-lvm.rules 70-mdadm.rules 99-mount-rules; do
     > "/etc/udev/rules.d/$x"
 done
-rm /etc/lvm/lvm.conf
+rm -f -- /etc/lvm/lvm.conf
 udevadm control --reload
 set -e
 # save a partition at the beginning for future flagging purposes

test/TEST-01-BASIC/test.sh

@@ -20,7 +20,7 @@ test_run() {
 }
 
 test_setup() {
-    rm -f $TESTDIR/root.ext3
+    rm -f -- $TESTDIR/root.ext3
     # Create the blank file to use as a root filesystem
     dd if=/dev/null of=$TESTDIR/root.ext3 bs=1M seek=80
 
@@ -66,7 +66,7 @@ test_setup() {
 	-d "piix ide-gd_mod ata_piix ext3 sd_mod" \
         --nomdadmconf \
 	-f $TESTDIR/initramfs.makeroot $KVERSION || return 1
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
     # Invoke KVM and/or QEMU to actually create the target filesystem.
 
     $testdir/run-qemu \

test/TEST-02-SYSTEMD/create-root.sh

@@ -3,7 +3,7 @@
 for x in 64-lvm.rules 70-mdadm.rules 99-mount-rules; do
     > "/etc/udev/rules.d/$x"
 done
-rm /etc/lvm/lvm.conf
+rm -f -- /etc/lvm/lvm.conf
 udevadm control --reload
 set -e
 # save a partition at the beginning for future flagging purposes

test/TEST-02-SYSTEMD/test.sh

@@ -16,7 +16,7 @@ test_run() {
 }
 
 test_setup() {
-    rm -f $TESTDIR/root.ext3
+    rm -f -- $TESTDIR/root.ext3
     # Create the blank file to use as a root filesystem
     dd if=/dev/null of=$TESTDIR/root.ext3 bs=1M seek=80
 
@@ -62,7 +62,7 @@ test_setup() {
 	-d "piix ide-gd_mod ata_piix ext3 sd_mod" \
         --nomdadmconf \
 	-f $TESTDIR/initramfs.makeroot $KVERSION || return 1
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
     # Invoke KVM and/or QEMU to actually create the target filesystem.
 
     $testdir/run-qemu \

test/TEST-03-USR-MOUNT/create-root.sh

@@ -3,7 +3,7 @@
 for x in 64-lvm.rules 70-mdadm.rules 99-mount-rules; do
     > "/etc/udev/rules.d/$x"
 done
-rm /etc/lvm/lvm.conf
+rm -f -- /etc/lvm/lvm.conf
 udevadm control --reload
 set -e
 # save a partition at the beginning for future flagging purposes

test/TEST-03-USR-MOUNT/test.sh

@@ -45,8 +45,8 @@ test_run() {
 }
 
 test_setup() {
-    rm -f $TESTDIR/root.btrfs
-    rm -f $TESTDIR/usr.btrfs
+    rm -f -- $TESTDIR/root.btrfs
+    rm -f -- $TESTDIR/usr.btrfs
     # Create the blank file to use as a root filesystem
     dd if=/dev/null of=$TESTDIR/root.btrfs bs=1M seek=160
     dd if=/dev/null of=$TESTDIR/usr.btrfs bs=1M seek=160
@@ -101,7 +101,7 @@ test_setup() {
 #    echo $TESTDIR/overlay
 #    echo $TESTDIR/initramfs.makeroot
 #exit 1
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
 
     $testdir/run-qemu \
 	-hda $TESTDIR/root.btrfs \
@@ -126,7 +126,7 @@ test_setup() {
 	-d "piix ide-gd_mod ata_piix btrfs sd_mod i6300esb ib700wdt" \
 	-f $TESTDIR/initramfs.testing $KVERSION || return 1
 
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
 
 #	-o "plymouth network md dmraid multipath fips caps crypt btrfs resume dmsquash-live dm"
 }

test/TEST-04-FULL-SYSTEMD/create-root.sh

@@ -3,7 +3,7 @@
 for x in 64-lvm.rules 70-mdadm.rules 99-mount-rules; do
     > "/etc/udev/rules.d/$x"
 done
-rm /etc/lvm/lvm.conf
+rm -f -- /etc/lvm/lvm.conf
 udevadm control --reload
 set -e
 # save a partition at the beginning for future flagging purposes

test/TEST-04-FULL-SYSTEMD/test.sh

@@ -46,8 +46,8 @@ test_run() {
 }
 
 test_setup() {
-    rm -f $TESTDIR/root.btrfs
-    rm -f $TESTDIR/usr.btrfs
+    rm -f -- $TESTDIR/root.btrfs
+    rm -f -- $TESTDIR/usr.btrfs
     # Create the blank file to use as a root filesystem
     dd if=/dev/null of=$TESTDIR/root.btrfs bs=1M seek=320
     dd if=/dev/null of=$TESTDIR/usr.btrfs bs=1M seek=320
@@ -243,7 +243,7 @@ EOF
 #    echo $TESTDIR/overlay
 #    echo $TESTDIR/initramfs.makeroot
 #exit 1
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
 
     $testdir/run-qemu \
 	-hda $TESTDIR/root.btrfs \
@@ -268,7 +268,7 @@ EOF
 	-d "piix ide-gd_mod ata_piix btrfs sd_mod i6300esb ib700wdt" \
 	-f $TESTDIR/initramfs.testing $KVERSION || return 1
 
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
 
 #	-o "plymouth network md dmraid multipath fips caps crypt btrfs resume dmsquash-live dm"
 }

test/TEST-10-RAID/create-root.sh

@@ -3,7 +3,7 @@
 for x in 64-lvm.rules 70-mdadm.rules 99-mount-rules; do
     > "/etc/udev/rules.d/$x"
 done
-rm /etc/lvm/lvm.conf
+rm -f -- /etc/lvm/lvm.conf
 udevadm control --reload
 # save a partition at the beginning for future flagging purposes
 sfdisk -C 1280 -H 2 -S 32 -L /dev/sda <<EOF

test/TEST-10-RAID/test.sh

@@ -20,7 +20,7 @@ test_run() {
 test_setup() {
     DISKIMAGE=$TESTDIR/TEST-10-RAID-root.img
     # Create the blank file to use as a root filesystem
-    rm -f $DISKIMAGE
+    rm -f -- $DISKIMAGE
     dd if=/dev/null of=$DISKIMAGE bs=1M seek=40
 
     kernel=$KVERSION
@@ -64,7 +64,7 @@ test_setup() {
 	-d "piix ide-gd_mod ata_piix ext2 sd_mod" \
         --nomdadmconf \
 	-f $TESTDIR/initramfs.makeroot $KVERSION || return 1
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
     # Invoke KVM and/or QEMU to actually create the target filesystem.
     $testdir/run-qemu \
 	-hda $DISKIMAGE \

test/TEST-11-LVM/create-root.sh

@@ -3,7 +3,7 @@
 for x in 64-lvm.rules 70-mdadm.rules 99-mount-rules; do
     > "/etc/udev/rules.d/$x"
 done
-rm /etc/lvm/lvm.conf
+rm -f -- /etc/lvm/lvm.conf
 udevadm control --reload
 # save a partition at the beginning for future flagging purposes
 sfdisk -C 1280 -H 2 -S 32 -L /dev/sda <<EOF

test/TEST-11-LVM/test.sh

@@ -60,7 +60,7 @@ test_setup() {
 	-m "dash lvm mdraid udev-rules base rootfs-block kernel-modules" \
 	-d "piix ide-gd_mod ata_piix ext2 sd_mod" \
 	-f $TESTDIR/initramfs.makeroot $KVERSION || return 1
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
     # Invoke KVM and/or QEMU to actually create the target filesystem.
     $testdir/run-qemu -hda $TESTDIR/root.ext2 -m 256M -smp 2 -nographic -net none \
 	-kernel "/boot/vmlinuz-$kernel" \

test/TEST-12-RAID-DEG/create-root.sh

@@ -6,7 +6,7 @@ trap 'poweroff -f' EXIT
 for x in 64-lvm.rules 70-mdadm.rules 99-mount-rules; do
     > "/etc/udev/rules.d/$x"
 done
-rm /etc/lvm/lvm.conf
+rm -f -- /etc/lvm/lvm.conf
 udevadm control --reload
 # save a partition at the beginning for future flagging purposes
 sfdisk -C 1280 -H 2 -S 32 -L /dev/sda <<EOF

test/TEST-12-RAID-DEG/test.sh

@@ -55,7 +55,7 @@ test_run() {
 
 test_setup() {
     # Create the blank file to use as a root filesystem
-    rm -f $TESTDIR/root.ext2
+    rm -f -- $TESTDIR/root.ext2
     dd if=/dev/null of=$TESTDIR/root.ext2 bs=1M seek=40
     dd if=/dev/null of=$TESTDIR/disk1.img bs=1M seek=20
     dd if=/dev/null of=$TESTDIR/disk2.img bs=1M seek=20
@@ -100,7 +100,7 @@ test_setup() {
 	-m "dash crypt lvm mdraid udev-rules base rootfs-block kernel-modules" \
 	-d "piix ide-gd_mod ata_piix ext2 sd_mod" \
 	-f $TESTDIR/initramfs.makeroot $KVERSION || return 1
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
     # Invoke KVM and/or QEMU to actually create the target filesystem.
     $testdir/run-qemu \
 	-hda $TESTDIR/root.ext2 \

test/TEST-13-ENC-RAID-LVM/create-root.sh

@@ -4,7 +4,7 @@ set -x
 for x in 64-lvm.rules 70-mdadm.rules 99-mount-rules; do
     > "/etc/udev/rules.d/$x"
 done
-rm /etc/lvm/lvm.conf
+rm -f -- /etc/lvm/lvm.conf
 udevadm control --reload
 # save a partition at the beginning for future flagging purposes
 sfdisk -C 2560 -H 2 -S 32 -L /dev/sda <<EOF

test/TEST-13-ENC-RAID-LVM/test.sh

@@ -55,7 +55,7 @@ test_run() {
 
 test_setup() {
     # Create the blank file to use as a root filesystem
-    rm -f $TESTDIR/root.ext2
+    rm -f -- $TESTDIR/root.ext2
     dd if=/dev/null of=$TESTDIR/root.ext2 bs=1M seek=80
 
     kernel=$KVERSION
@@ -97,7 +97,7 @@ test_setup() {
 	-m "dash crypt lvm mdraid udev-rules base rootfs-block kernel-modules" \
 	-d "piix ide-gd_mod ata_piix ext2 sd_mod" \
 	-f $TESTDIR/initramfs.makeroot $KVERSION || return 1
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
     # Invoke KVM and/or QEMU to actually create the target filesystem.
     $testdir/run-qemu -hda $TESTDIR/root.ext2 -m 256M -smp 2 -nographic -net none \
 	-kernel "/boot/vmlinuz-$kernel" \

test/TEST-15-BTRFSRAID/test.sh

@@ -19,7 +19,7 @@ test_run() {
 test_setup() {
     # Create the blank file to use as a root filesystem
     DISKIMAGE=$TESTDIR/TEST-15-BTRFSRAID-root.img
-    rm -f $DISKIMAGE
+    rm -f -- $DISKIMAGE
     dd if=/dev/null of=$DISKIMAGE bs=1M seek=1024
 
     kernel=$KVERSION
@@ -62,7 +62,7 @@ test_setup() {
         --nomdadmconf \
 	-f $TESTDIR/initramfs.makeroot $KVERSION || return 1
 
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
 
     # Invoke KVM and/or QEMU to actually create the target filesystem.
     $testdir/run-qemu \

test/TEST-20-NFS/test.sh

@@ -187,7 +187,7 @@ test_nfsv4() {
 test_run() {
     if [[ -s server.pid ]]; then
         sudo kill -TERM $(cat $TESTDIR/server.pid)
-        rm -f $TESTDIR/server.pid
+        rm -f -- $TESTDIR/server.pid
     fi
 
     if ! run_server; then
@@ -202,7 +202,7 @@ test_run() {
 
     if [[ -s $TESTDIR/server.pid ]]; then
         sudo kill -TERM $(cat $TESTDIR/server.pid)
-        rm -f $TESTDIR/server.pid
+        rm -f -- $TESTDIR/server.pid
     fi
 
     return $ret
@@ -327,7 +327,7 @@ test_setup() {
     mkdir -p $TESTDIR/mnt/nfs/tftpboot/nfs4-5
 
     sudo umount $TESTDIR/mnt
-    rm -fr $TESTDIR/mnt
+    rm -fr -- $TESTDIR/mnt
 
     # Make an overlay with needed tools for the test harness
     (
@@ -356,7 +356,7 @@ test_setup() {
 test_cleanup() {
     if [[ -s $TESTDIR/server.pid ]]; then
         sudo kill -TERM $(cat $TESTDIR/server.pid)
-        rm -f $TESTDIR/server.pid
+        rm -f -- $TESTDIR/server.pid
     fi
 }
 

test/TEST-30-ISCSI/create-root.sh

@@ -3,7 +3,7 @@
 for x in 64-lvm.rules 70-mdadm.rules 99-mount-rules; do
     > "/etc/udev/rules.d/$x"
 done
-rm /etc/lvm/lvm.conf
+rm -f -- /etc/lvm/lvm.conf
 udevadm control --reload
 mkfs.ext3 -j -F /dev/sda && \
 mkdir -p /sysroot && \

test/TEST-30-ISCSI/test.sh

@@ -84,7 +84,7 @@ test_run() {
     ret=$?
     if [[ -s $TESTDIR/server.pid ]]; then
         sudo kill -TERM $(cat $TESTDIR/server.pid)
-        rm -f $TESTDIR/server.pid
+        rm -f -- $TESTDIR/server.pid
     fi
     return $ret
 }
@@ -135,7 +135,7 @@ test_setup() {
         -m "dash crypt lvm mdraid udev-rules base rootfs-block kernel-modules" \
         -d "piix ide-gd_mod ata_piix ext3 sd_mod" \
         -f $TESTDIR/initramfs.makeroot $KVERSION || return 1
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
 
 
     # Need this so kvm-qemu will boot (needs non-/dev/zero local disk)
@@ -154,7 +154,7 @@ test_setup() {
         -append "root=/dev/fakeroot rw rootfstype=ext3 quiet console=ttyS0,115200n81 selinux=0" \
         -initrd $TESTDIR/initramfs.makeroot  || return 1
     grep -F -m 1 -q dracut-root-block-created $TESTDIR/client.img || return 1
-    rm $TESTDIR/client.img
+    rm -- $TESTDIR/client.img
     (
         export initdir=$TESTDIR/overlay
         . $basedir/dracut-functions.sh
@@ -210,7 +210,7 @@ test_setup() {
     )
 
     sudo umount $TESTDIR/mnt
-    rm -fr $TESTDIR/mnt
+    rm -fr -- $TESTDIR/mnt
 
     # Make server's dracut image
     $basedir/dracut.sh -l -i $TESTDIR/overlay / \
@@ -223,7 +223,7 @@ test_setup() {
 test_cleanup() {
     if [[ -s $TESTDIR/server.pid ]]; then
         sudo kill -TERM $(cat $TESTDIR/server.pid)
-        rm -f $TESTDIR/server.pid
+        rm -f -- $TESTDIR/server.pid
     fi
 }
 

test/TEST-40-NBD/create-root.sh

@@ -3,7 +3,7 @@
 for x in 64-lvm.rules 70-mdadm.rules 99-mount-rules; do
     > "/etc/udev/rules.d/$x"
 done
-rm /etc/lvm/lvm.conf
+rm -f -- /etc/lvm/lvm.conf
 udevadm control --reload
 echo -n test >keyfile
 cryptsetup -q luksFormat /dev/sdb /keyfile

test/TEST-40-NBD/test.sh

@@ -181,7 +181,7 @@ client_run() {
 
     if [[ -s server.pid ]]; then
         sudo kill -TERM $(cat $TESTDIR/server.pid)
-        rm -f $TESTDIR/server.pid
+        rm -f -- $TESTDIR/server.pid
     fi
 
 }
@@ -229,7 +229,7 @@ make_encrypted_root() {
         -m "dash crypt lvm mdraid udev-rules base rootfs-block kernel-modules" \
         -d "piix ide-gd_mod ata_piix ext2 ext3 sd_mod" \
         -f $TESTDIR/initramfs.makeroot $KVERSION || return 1
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
 
     # Invoke KVM and/or QEMU to actually create the target filesystem.
     $testdir/run-qemu \
@@ -276,7 +276,7 @@ make_client_root() {
     )
 
     sudo umount $TESTDIR/mnt
-    rm -fr $TESTDIR/mnt
+    rm -fr -- $TESTDIR/mnt
 }
 
 make_server_root() {
@@ -321,7 +321,7 @@ make_server_root() {
     )
 
     sudo umount $TESTDIR/mnt
-    rm -fr $TESTDIR/mnt
+    rm -fr -- $TESTDIR/mnt
 }
 
 test_setup() {
@@ -366,7 +366,7 @@ test_setup() {
 kill_server() {
     if [[ -s $TESTDIR/server.pid ]]; then
         sudo kill -TERM $(cat $TESTDIR/server.pid)
-        rm -f $TESTDIR/server.pid
+        rm -f -- $TESTDIR/server.pid
     fi
 }
 

test/TEST-50-MULTINIC/test.sh

@@ -237,7 +237,7 @@ test_setup() {
     )
 
     sudo umount $TESTDIR/mnt
-    rm -fr $TESTDIR/mnt
+    rm -fr -- $TESTDIR/mnt
 
     # Make an overlay with needed tools for the test harness
     (
@@ -265,7 +265,7 @@ test_setup() {
 kill_server() {
     if [[ -s $TESTDIR/server.pid ]]; then
         sudo kill -TERM $(cat $TESTDIR/server.pid)
-        rm -f $TESTDIR/server.pid
+        rm -f -- $TESTDIR/server.pid
     fi
 }
 

test/TEST-99-RPM/test.sh

@@ -14,8 +14,8 @@ test_run() {
     mkdir -p "$rootdir/sys"
     mkdir -p "$rootdir/dev"
 
-trap 'ret=$?; [[ -d $rootdir ]] && { umount "$rootdir/proc"; umount "$rootdir/sys"; umount "$rootdir/dev"; rm -rf "$rootdir"; }; exit $ret;' EXIT
-trap '[[ -d $rootdir ]] && { umount "$rootdir/proc"; umount "$rootdir/sys"; umount "$rootdir/dev"; rm -rf "$rootdir"; }; exit 1;' SIGINT
+trap 'ret=$?; [[ -d $rootdir ]] && { umount "$rootdir/proc"; umount "$rootdir/sys"; umount "$rootdir/dev"; rm -rf -- "$rootdir"; }; exit $ret;' EXIT
+trap '[[ -d $rootdir ]] && { umount "$rootdir/proc"; umount "$rootdir/sys"; umount "$rootdir/dev"; rm -rf -- "$rootdir"; }; exit 1;' SIGINT
 
     mount --bind /proc "$rootdir/proc"
     mount --bind /sys "$rootdir/sys"

test/old.TEST-14-IMSM/create-root.sh

@@ -1,9 +1,9 @@
 #!/bin/sh
 # don't let udev and this script step on eachother's toes
 for x in 61-dmraid-imsm.rules 64-md-raid.rules 65-md-incremental-imsm.rules 65-md-incremental.rules 64-lvm.rules 70-mdadm.rules 99-mount-rules; do
-    rm "/etc/udev/rules.d/$x"
+    rm -f -- "/etc/udev/rules.d/$x"
 done
-rm /etc/lvm/lvm.conf
+rm -f -- /etc/lvm/lvm.conf
 
 udevadm control --reload
 # dmraid does not want symlinks in --disk "..."

test/old.TEST-14-IMSM/test.sh

@@ -47,9 +47,9 @@ test_setup() {
 #   return 1
 
     # Create the blank file to use as a root filesystem
-    rm -f $TESTDIR/root.ext2
-    rm -f $TESTDIR/disk1
-    rm -f $TESTDIR/disk2
+    rm -f -- $TESTDIR/root.ext2
+    rm -f -- $TESTDIR/disk1
+    rm -f -- $TESTDIR/disk2
     dd if=/dev/null of=$TESTDIR/root.ext2 bs=1M seek=1
     dd if=/dev/null of=$TESTDIR/disk1 bs=1M seek=80
     dd if=/dev/null of=$TESTDIR/disk2 bs=1M seek=80
@@ -92,7 +92,7 @@ test_setup() {
 	-m "dash lvm mdraid dmraid udev-rules base rootfs-block kernel-modules" \
 	-d "piix ide-gd_mod ata_piix ext2 sd_mod dm-multipath dm-crypt dm-round-robin faulty linear multipath raid0 raid10 raid1 raid456" \
 	-f $TESTDIR/initramfs.makeroot $KVERSION || return 1
-    rm -rf $TESTDIR/overlay
+    rm -rf -- $TESTDIR/overlay
     # Invoke KVM and/or QEMU to actually create the target filesystem.
     $testdir/run-qemu \
 	-hda $TESTDIR/root.ext2 \

test/test-functions

@@ -46,8 +46,8 @@ while (($# > 0)); do
         --clean)
 	    echo "TEST CLEANUP: $TEST_DESCRIPTION"
 	    test_cleanup
-	    rm -fr "$TESTDIR"
-	    rm -f .testdir
+	    rm -fr -- "$TESTDIR"
+	    rm -f -- .testdir
 	    exit $?;;
         --all)
             check_root
@@ -63,8 +63,8 @@ while (($# > 0)); do
 		test_setup && test_run
 		ret=$?
 		test_cleanup
-		rm -fr "$TESTDIR"
-		rm -f .testdir
+		rm -fr -- "$TESTDIR"
+		rm -f -- .testdir
 		exit $ret
 	    ) </dev/null >test.log 2>&1
             else
@@ -73,15 +73,15 @@ while (($# > 0)); do
 		test_setup && test_run
 		ret=$?
 		test_cleanup
-		rm -fr "$TESTDIR"
-		rm -f .testdir
+		rm -fr -- "$TESTDIR"
+		rm -f -- .testdir
 		exit $ret
 	    ) </dev/null 2>&1 | tee test.log
             fi
 	    ret=$?
             set +o pipefail
 	    if [ $ret -eq 0 ]; then
-               rm test.log
+               rm -- test.log
                SETCOLOR_SUCCESS
 	       echo "[OK]"
                SETCOLOR_NORMAL