Fix issue where params which are sub-strings of other params caused problems e.g. ro and cros_secure

scripts/image_signing/ensure_secure_kernelparams.sh

 #!/bin/bash
 
 # Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Abort on error.
 set -e
 
 # Load common constants and variables.
@@ skipping 14 matching lines @@
 }
 
 # Given a dm param string which includes a long and unpredictable
 # sha1 hash, return the same string with the sha1 hash replaced
 # with a magic placeholder. This same magic placeholder is used
 # in the config file, for comparison purposes.
 dmparams_mangle_sha1() {
     echo "$1" | sed 's/sha1 [0-9a-fA-F]*/sha1 MAGIC_HASH/'
 }
 
+# This escapes any non-alphanum character, since many such characters
+# are regex metacharacters.
+escape_regexmetas() {
+    echo "$1" | sed 's/\([^a-zA-Z0-9]\)/\\\1/g'
+}
+
 usage() {
     echo "Usage $PROG image [config]"
 }
 
 main() {
     # We want to catch all the discrepancies, not just the first one.
     # So, any time we find one, we set testfail=1 and continue.
     # When finished we will use testfail to determine our exit value.
     local testfail=0
 
@@ skipping 34 matching lines @@
 
     # Special-case handling of the dm= param:
     if [[ "$dmparams" != "$required_dmparams" ]]; then
         echo "Kernel dm= parameter does not match expected value!"
         echo "Expected: $required_dmparams"
         echo "Actual:   $dmparams"
         testfail=1
     fi
 
     # Ensure all other required params are present.
-    for param in ${required_kparams[@]}; do :
+    for param in ${required_kparams[@]}; do
         if [[ "$kparams_nodm" != *$param* ]]; then
             echo "Kernel parameters missing required value: $param"
             testfail=1
         else
             # Remove matched params as we go. If all goes well, kparams_nodm
             # will be nothing left but whitespace by the end.
-            kparams_nodm=${kparams_nodm/$param/}
+            param=$(escape_regexmetas "$param")
+            kparams_nodm=$(echo "$kparams_nodm" | sed "s/\b$param\b//")
         fi
     done
 
     # Check-off each of the allowed-but-optional params that were present.
-    for param in ${optional_kparams[@]}; do :
-        kparams_nodm=${kparams_nodm/$param/}
+    for param in ${optional_kparams[@]}; do
+        param=$(escape_regexmetas "$param")
+        kparams_nodm=$(echo "$kparams_nodm" | sed "s/\b$param\b//")
     done
 
     # This section enforces the default-deny for any unexpected params
     # not already processed by one of the above loops.
     if [[ ! -z ${kparams_nodm// /} ]]; then
         echo "Unexpected kernel parameters found: $kparams_nodm"
         testfail=1
     fi
 
     exit $testfail
 }
 
 main $@