use "rm --" to guard against filenames beginning with "-"

34 files changed, 62 insertions, 62 deletions

diff --git a/modules.d/01fips/fips-boot.sh b/modules.d/01fips/fips-boot.sh
index a2f64ecb..d3a3d1e8 100755
--- a/modules.d/01fips/fips-boot.sh
+++ b/modules.d/01fips/fips-boot.sh
@@ -3,7 +3,7 @@
 # ex: ts=8 sw=4 sts=4 et filetype=sh
 
 if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then
-    rm -f /etc/modprobe.d/fips.conf >/dev/null 2>&1
+    rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1
 elif getarg boot= >/dev/null; then
     . /sbin/fips.sh
     if mount_boot; then
diff --git a/modules.d/01fips/fips-noboot.sh b/modules.d/01fips/fips-noboot.sh
index 8c4ac0bb..e7208cd3 100755
--- a/modules.d/01fips/fips-noboot.sh
+++ b/modules.d/01fips/fips-noboot.sh
@@ -3,7 +3,7 @@
 # ex: ts=8 sw=4 sts=4 et filetype=sh
 
 if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then
-    rm -f /etc/modprobe.d/fips.conf >/dev/null 2>&1
+    rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1
 elif ! [ -f /tmp/fipsdone ]; then
     . /sbin/fips.sh
     mount_boot
diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
index 0095416a..2ec2152b 100755
--- a/modules.d/01fips/fips.sh
+++ b/modules.d/01fips/fips.sh
@@ -44,7 +44,7 @@ mount_boot()
         info "Mounting $boot as /boot"
         mount -oro "$boot" /boot || return 1
     elif [ -d "$NEWROOT/boot" ]; then
-        rm -fr /boot
+        rm -fr -- /boot
         ln -sf "$NEWROOT/boot" /boot
     fi
 }
diff --git a/modules.d/10i18n/module-setup.sh b/modules.d/10i18n/module-setup.sh
index 195364c2..a91b5806 100755
--- a/modules.d/10i18n/module-setup.sh
+++ b/modules.d/10i18n/module-setup.sh
@@ -102,7 +102,7 @@ install() {
         done
 
         # remove unnecessary files
-        rm -f "${initdir}${kbddir}/consoletrans/utflist"
+        rm -f -- "${initdir}${kbddir}/consoletrans/utflist"
         find "${initdir}${kbddir}/" -name README\* -delete
         find "${initdir}${kbddir}/" -name '*.gz' -print -quit \
             | while read line; do
diff --git a/modules.d/10i18n/parse-i18n.sh b/modules.d/10i18n/parse-i18n.sh
index 94271947..348c5bc8 100755
--- a/modules.d/10i18n/parse-i18n.sh
+++ b/modules.d/10i18n/parse-i18n.sh
@@ -36,7 +36,7 @@ if [ -f /etc/locale.conf ]; then
 fi
 
 if [ -n "$DRACUT_SYSTEMD" ]; then
-    rm -f /etc/udev/rules.d/10-console.rules
-    rm -f /lib/udev/rules.d/10-console.rules
-    rm -f /lib/udev/console_init
+    rm -f -- /etc/udev/rules.d/10-console.rules
+    rm -f -- /lib/udev/rules.d/10-console.rules
+    rm -f -- /lib/udev/console_init
 fi
diff --git a/modules.d/30convertfs/convertfs.sh b/modules.d/30convertfs/convertfs.sh
index 137664a8..d717c69f 100755
--- a/modules.d/30convertfs/convertfs.sh
+++ b/modules.d/30convertfs/convertfs.sh
@@ -56,22 +56,22 @@ if ! needconvert; then
 fi
 
 testfile="$ROOT/.usrmovecheck$$"
-rm -f "$testfile"
+rm -f -- "$testfile"
 > "$testfile"
 if [[ ! -e "$testfile" ]]; then
     echo "Cannot write to $ROOT/"
     exit 1
 fi
-rm -f "$testfile"
+rm -f -- "$testfile"
 
 testfile="$ROOT/usr/.usrmovecheck$$"
-rm -f "$testfile"
+rm -f -- "$testfile"
 > "$testfile"
 if [[ ! -e "$testfile" ]]; then
     echo "Cannot write to $ROOT/usr/"
     exit 1
 fi
-rm -f "$testfile"
+rm -f -- "$testfile"
 
 find_mount() {
     local dev mnt etc wanted_dev
@@ -108,11 +108,11 @@ cleanup() {
     for dir in "$ROOT/bin" "$ROOT/sbin" "$ROOT/lib" "$ROOT/lib64" \
 	"$ROOT/usr/bin" "$ROOT/usr/sbin" "$ROOT/usr/lib" \
         "$ROOT/usr/lib64"; do
-        [[ -d "${dir}.usrmove-new" ]] && rm -fr "${dir}.usrmove-new"
+        [[ -d "${dir}.usrmove-new" ]] && rm -fr -- "${dir}.usrmove-new"
         if [[ -d "${dir}.usrmove-old" ]]; then
             mv "$dir" "${dir}.del~"
             mv "${dir}.usrmove-old" "$dir"
-            rm -fr "${dir}.del~"
+            rm -fr -- "${dir}.del~"
         fi
     done
 }
@@ -126,7 +126,7 @@ set -e
 
 # merge / and /usr in new dir in /usr
 for dir in bin sbin lib lib64; do
-    rm -rf "$ROOT/usr/${dir}.usrmove-new"
+    rm -rf -- "$ROOT/usr/${dir}.usrmove-new"
     [[ -L "$ROOT/$dir" ]] && continue
     [[ -d "$ROOT/$dir" ]] || continue
     echo "Make a copy of \`$ROOT/usr/$dir'."
@@ -150,7 +150,7 @@ done
 for dir in bin sbin lib lib64; do
     [[ -d "$ROOT/usr/${dir}.usrmove-new" ]] || continue
     echo "Switch to new \`$ROOT/usr/$dir'."
-    rm -fr "$ROOT/usr/${dir}.usrmove-old"
+    rm -fr -- "$ROOT/usr/${dir}.usrmove-old"
     mv "$ROOT/usr/$dir" "$ROOT/usr/${dir}.usrmove-old"
     mv "$ROOT/usr/${dir}.usrmove-new" "$ROOT/usr/$dir"
 done
@@ -160,7 +160,7 @@ for dir in bin sbin lib lib64; do
     [[ -L "$ROOT/$dir" ]] && continue
     [[ -d "$ROOT/$dir" ]] || continue
     echo "Create \`$ROOT/$dir' symlink."
-    rm -rf "$ROOT/${dir}.usrmove-old" || :
+    rm -fr -- "$ROOT/${dir}.usrmove-old" || :
     mv "$ROOT/$dir" "$ROOT/${dir}.usrmove-old"
     ln -sfn usr/$dir "$ROOT/$dir"
 done
@@ -178,9 +178,9 @@ done
 
 for dir in bin sbin lib lib64; do
     [[ -d "$ROOT/usr/${dir}.usrmove-old~" ]] \
-        && rm -rf "$ROOT/usr/${dir}.usrmove-old~" || :
+        && rm -rf -- "$ROOT/usr/${dir}.usrmove-old~" || :
     [[ -d "$ROOT/${dir}.usrmove-old~" ]] \
-        && rm -rf "$ROOT/${dir}.usrmove-old~" || :
+        && rm -rf -- "$ROOT/${dir}.usrmove-old~" || :
 done
 
 for dir in lib lib64; do
diff --git a/modules.d/40network/dhclient-script.sh b/modules.d/40network/dhclient-script.sh
index 8887add6..0124c06e 100755
--- a/modules.d/40network/dhclient-script.sh
+++ b/modules.d/40network/dhclient-script.sh
@@ -89,7 +89,7 @@ case $reason in
             [ -e /tmp/net.$netif.manualup ] || echo "/sbin/netroot $netif"
             echo "> /tmp/setup_net_$netif.ok"
             echo "> /tmp/setup_net_\$(cat /sys/class/net/$netif/address).ok"
-            echo "rm -f $hookdir/initqueue/setup_net_$netif.sh"
+            echo "rm -f -- $hookdir/initqueue/setup_net_$netif.sh"
         } > $hookdir/initqueue/setup_net_$netif.sh
 
         echo "[ -f /tmp/setup_net_$netif.ok ]" > $hookdir/initqueue/finished/dhclient-$netif.sh
diff --git a/modules.d/40network/net-lib.sh b/modules.d/40network/net-lib.sh
index 367a9f40..0e23d097 100644
--- a/modules.d/40network/net-lib.sh
+++ b/modules.d/40network/net-lib.sh
@@ -105,7 +105,7 @@ ifdown() {
     ip link set $netif down
     ip addr flush dev $netif
     echo "#empty" > /etc/resolv.conf
-    rm -f /tmp/net.$netif.did-setup
+    rm -f -- /tmp/net.$netif.did-setup
     # TODO: send "offline" uevent?
 }
 
diff --git a/modules.d/40network/netroot.sh b/modules.d/40network/netroot.sh
index 1dcae51a..daeb14ce 100755
--- a/modules.d/40network/netroot.sh
+++ b/modules.d/40network/netroot.sh
@@ -76,7 +76,7 @@ source_hook netroot $netif
 # Run the handler; don't store the root, it may change from device to device
 # XXX other variables to export?
 if $handler $netif $netroot $NEWROOT; then
-    rm -f $hookdir/initqueue/finished/dhcp.sh
+    rm -f -- $hookdir/initqueue/finished/dhcp.sh
     # Network rootfs mount successful - save interface info for ifcfg etc.
     save_netinfo $netif
 fi
diff --git a/modules.d/80cms/cmssetup.sh b/modules.d/80cms/cmssetup.sh
index 37fd84ee..16704c34 100755
--- a/modules.d/80cms/cmssetup.sh
+++ b/modules.d/80cms/cmssetup.sh
@@ -167,7 +167,7 @@ function dasd_settle_all() {
 
 	    printf 'SUBSYSTEM=="net", ACTION=="add", DRIVERS=="%s", KERNELS=="%s", ENV{INTERFACE}=="?*", RUN+="/sbin/initqueue --onetime --unique --name cmsifup-$env{INTERFACE} /sbin/cmsifup $env{INTERFACE}"\n' "$driver" "$devbusid" > /etc/udev/rules.d/99-cms.rules
         # remove the default net rules
-            rm -f /etc/udev/rules.d/91-default-net.rules
+            rm -f -- /etc/udev/rules.d/91-default-net.rules
 	    [[ -f /etc/udev/rules.d/90-net.rules ]] \
 	        || printf 'SUBSYSTEM=="net", ACTION=="online", RUN+="/sbin/initqueue --onetime --env netif=$env{INTERFACE} source_hook initqueue/online"\n' >> /etc/udev/rules.d/99-cms.rules
             udevadm control --reload
diff --git a/modules.d/90crypt/crypt-cleanup.sh b/modules.d/90crypt/crypt-cleanup.sh
index 04defde2..0671dc1d 100755
--- a/modules.d/90crypt/crypt-cleanup.sh
+++ b/modules.d/90crypt/crypt-cleanup.sh
@@ -2,7 +2,7 @@
 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
 # ex: ts=8 sw=4 sts=4 et filetype=sh
 # close everything which is not busy
-rm -f /etc/udev/rules.d/70-luks.rules >/dev/null 2>&1
+rm -f -- /etc/udev/rules.d/70-luks.rules >/dev/null 2>&1
 
 if ! getarg rd.luks.uuid -d rd_LUKS_UUID >/dev/null 2>&1 && getargbool 1 rd.luks -d -n rd_NO_LUKS >/dev/null 2>&1; then
     while true; do
diff --git a/modules.d/90crypt/parse-crypt.sh b/modules.d/90crypt/parse-crypt.sh
index 4cb281bf..961ec61b 100755
--- a/modules.d/90crypt/parse-crypt.sh
+++ b/modules.d/90crypt/parse-crypt.sh
@@ -4,7 +4,7 @@
 
 if ! getargbool 1 rd.luks -d -n rd_NO_LUKS; then
     info "rd.luks=0: removing cryptoluks activation"
-    rm -f /etc/udev/rules.d/70-luks.rules
+    rm -f -- /etc/udev/rules.d/70-luks.rules
 else
     {
         echo 'SUBSYSTEM!="block", GOTO="luks_end"'
diff --git a/modules.d/90dmsquash-live/iso-scan.sh b/modules.d/90dmsquash-live/iso-scan.sh
index 99eea0e3..36a6a2d1 100755
--- a/modules.d/90dmsquash-live/iso-scan.sh
+++ b/modules.d/90dmsquash-live/iso-scan.sh
@@ -24,7 +24,7 @@ do_iso_scan() {
         mount -t auto -o ro "$dev" "/run/initramfs/isoscan" || continue
         if [ -f "/run/initramfs/isoscan/$isofile" ]; then
             losetup -f "/run/initramfs/isoscan/$isofile"
-            rm -f "$job"
+            rm -f -- "$job"
             exit 0
         else
             umount "/run/initramfs/isoscan"
diff --git a/modules.d/90lvm/lvm_scan.sh b/modules.d/90lvm/lvm_scan.sh
index f5f5fcd1..cc006c83 100755
--- a/modules.d/90lvm/lvm_scan.sh
+++ b/modules.d/90lvm/lvm_scan.sh
@@ -125,7 +125,7 @@ if [ -z "$LVS" -o -n "$VGS" ]; then
 fi
 
 if [ "$lvmwritten" ]; then
-    rm -f /etc/lvm/lvm.conf
+    rm -f -- /etc/lvm/lvm.conf
 fi
 unset lvmwritten
 
diff --git a/modules.d/90lvm/parse-lvm.sh b/modules.d/90lvm/parse-lvm.sh
index 3e6b371b..74e1d43b 100755
--- a/modules.d/90lvm/parse-lvm.sh
+++ b/modules.d/90lvm/parse-lvm.sh
@@ -2,7 +2,7 @@
 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
 # ex: ts=8 sw=4 sts=4 et filetype=sh
 if [ -e /etc/lvm/lvm.conf ] && ! getargbool 1 rd.lvm.conf -d -n rd_NO_LVMCONF; then
-    rm -f /etc/lvm/lvm.conf
+    rm -f -- /etc/lvm/lvm.conf
 fi
 
 LV_DEVS="$(getargs rd.lvm.vg -d rd_LVM_VG=) $(getargs rd.lvm.lv -d rd_LVM_LV=)"
@@ -10,7 +10,7 @@ LV_DEVS="$(getargs rd.lvm.vg -d rd_LVM_VG=) $(getargs rd.lvm.lv -d rd_LVM_LV=)"
 if ! getargbool 1 rd.lvm -d -n rd_NO_LVM \
     || ( [ -z "$LV_DEVS" ] && ! getargbool 0 rd.auto ); then
     info "rd.lvm=0: removing LVM activation"
-    rm -f /etc/udev/rules.d/64-lvm*.rules
+    rm -f -- /etc/udev/rules.d/64-lvm*.rules
 else
     for dev in $LV_DEVS; do
         wait_for_dev "/dev/$dev"
diff --git a/modules.d/90mdraid/parse-md.sh b/modules.d/90mdraid/parse-md.sh
index 2de435b3..dd7bda25 100755
--- a/modules.d/90mdraid/parse-md.sh
+++ b/modules.d/90mdraid/parse-md.sh
@@ -32,11 +32,11 @@ fi
 
 if [ -e /etc/mdadm.conf ] && getargbool 1 rd.md.conf -d -n rd_NO_MDADMCONF; then
     udevproperty rd_MDADMCONF=1
-    rm -f $hookdir/pre-pivot/*mdraid-cleanup.sh
+    rm -f -- $hookdir/pre-pivot/*mdraid-cleanup.sh
 fi
 
 if ! getargbool 1 rd.md.conf -d -n rd_NO_MDADMCONF; then
-    rm -f /etc/mdadm/mdadm.conf /etc/mdadm.conf
+    rm -f -- /etc/mdadm/mdadm.conf /etc/mdadm.conf
     ln -s $(command -v mdraid-cleanup) $hookdir/pre-pivot/31-mdraid-cleanup.sh 2>/dev/null
 fi
 
diff --git a/modules.d/90multipath/multipathd.sh b/modules.d/90multipath/multipathd.sh
index 6d6eb990..8a9e8aa5 100755
--- a/modules.d/90multipath/multipathd.sh
+++ b/modules.d/90multipath/multipathd.sh
@@ -7,6 +7,6 @@ if [ -e /etc/multipath.conf ]; then
     multipathd -B || multipathd
     need_shutdown
 else
-    rm /etc/udev/rules.d/??-multipath.rules 2>/dev/null
+    rm -- /etc/udev/rules.d/??-multipath.rules 2>/dev/null
 fi
 
diff --git a/modules.d/95cifs/cifsroot.sh b/modules.d/95cifs/cifsroot.sh
index 677318b1..72f6f2b0 100755
--- a/modules.d/95cifs/cifsroot.sh
+++ b/modules.d/95cifs/cifsroot.sh
@@ -21,6 +21,6 @@ echo options: $options
 mount.cifs //$server/$path $NEWROOT -o $options && { [ -e /dev/root ] || ln -s null /dev/root ; }
 
 # inject new exit_if_exists
-echo 'settle_exit_if_exists="--exit-if-exists=/dev/root"; rm "$job"' > $hookdir/initqueue/cifs.sh
+echo 'settle_exit_if_exists="--exit-if-exists=/dev/root"; rm -f -- "$job"' > $hookdir/initqueue/cifs.sh
 # force udevsettle to break
 > $hookdir/initqueue/work
diff --git a/modules.d/95nfs/nfsroot.sh b/modules.d/95nfs/nfsroot.sh
index 067d1726..f04159e3 100755
--- a/modules.d/95nfs/nfsroot.sh
+++ b/modules.d/95nfs/nfsroot.sh
@@ -21,7 +21,7 @@ mount_nfs $root $NEWROOT $netif && { [ -e /dev/root ] || ln -s null /dev/root ;
 [ -f $NEWROOT/etc/fstab ] && cat $NEWROOT/etc/fstab > /dev/null
 
 # inject new exit_if_exists
-echo 'settle_exit_if_exists="--exit-if-exists=/dev/root"; rm "$job"' > $hookdir/initqueue/nfs.sh
+echo 'settle_exit_if_exists="--exit-if-exists=/dev/root"; rm -- "$job"' > $hookdir/initqueue/nfs.sh
 # force udevsettle to break
 > $hookdir/initqueue/work
 
diff --git a/modules.d/95resume/parse-resume.sh b/modules.d/95resume/parse-resume.sh
index 9da15507..20ece99f 100755
--- a/modules.d/95resume/parse-resume.sh
+++ b/modules.d/95resume/parse-resume.sh
@@ -55,10 +55,10 @@ if [ -n "$resume" ]; then
             ${resume#/dev/};
     } >> /etc/udev/rules.d/99-resume.rules
 
-    printf '[ -e "%s" ] && { ln -s "%s" /dev/resume; rm "$job" "%s/initqueue/timeout/resume.sh"; }\n' \
+    printf '[ -e "%s" ] && { ln -s "%s" /dev/resume; rm -f -- "$job" "%s/initqueue/timeout/resume.sh"; }\n' \
         "$resume" "$resume" "$hookdir" >> $hookdir/initqueue/settled/resume.sh
 
-    printf 'warn "Cancelling resume operation. Device not found."; cancel_wait_for_dev /dev/resume; rm "$job" "%s/initqueue/settled/resume.sh";' \
+    printf 'warn "Cancelling resume operation. Device not found."; cancel_wait_for_dev /dev/resume; rm -f -- "$job" "%s/initqueue/settled/resume.sh";' \
         "$hookdir" >> $hookdir/initqueue/timeout/resume.sh
 
     wait_for_dev "/dev/resume"
diff --git a/modules.d/95rootfs-block/mount-root.sh b/modules.d/95rootfs-block/mount-root.sh
index 6ed35c1f..5cd905f1 100755
--- a/modules.d/95rootfs-block/mount-root.sh
+++ b/modules.d/95rootfs-block/mount-root.sh
@@ -130,8 +130,8 @@ mount_root() {
     fi
 
     if ! getargbool 0 rd.skipfsck; then
-        [ -f "$NEWROOT"/forcefsck ] && rm -f "$NEWROOT"/forcefsck 2>/dev/null
-        [ -f "$NEWROOT"/.autofsck ] && rm -f "$NEWROOT"/.autofsck 2>/dev/null
+        [ -f "$NEWROOT"/forcefsck ] && rm -f -- "$NEWROOT"/forcefsck 2>/dev/null
+        [ -f "$NEWROOT"/.autofsck ] && rm -f -- "$NEWROOT"/.autofsck 2>/dev/null
     fi
 }
 
diff --git a/modules.d/95virtfs/mount-virtfs.sh b/modules.d/95virtfs/mount-virtfs.sh
index 7c07b462..a4846cba 100755
--- a/modules.d/95virtfs/mount-virtfs.sh
+++ b/modules.d/95virtfs/mount-virtfs.sh
@@ -66,8 +66,8 @@ mount_root() {
     info "Remounting ${root#virtfs:} with -o ${rflags}"
     mount -t ${rootfs} -o "$rflags" "${root#virtfs:}" "$NEWROOT" 2>&1 | vinfo
 
-    [ -f "$NEWROOT"/forcefsck ] && rm -f "$NEWROOT"/forcefsck 2>/dev/null
-    [ -f "$NEWROOT"/.autofsck ] && rm -f "$NEWROOT"/.autofsck 2>/dev/null
+    [ -f "$NEWROOT"/forcefsck ] && rm -f -- "$NEWROOT"/forcefsck 2>/dev/null
+    [ -f "$NEWROOT"/.autofsck ] && rm -f -- "$NEWROOT"/.autofsck 2>/dev/null
 }
 
 if [ -n "$root" -a -z "${root%%virtfs:*}" ]; then
diff --git a/modules.d/97biosdevname/parse-biosdevname.sh b/modules.d/97biosdevname/parse-biosdevname.sh
index 049b1569..5e80f827 100755
--- a/modules.d/97biosdevname/parse-biosdevname.sh
+++ b/modules.d/97biosdevname/parse-biosdevname.sh
@@ -4,7 +4,7 @@
 if ! getargbool 1 biosdevname; then
     info "biosdevname=0: removing biosdevname network renaming"
     udevproperty UDEV_BIOSDEVNAME=
-    rm -f /etc/udev/rules.d/71-biosdevname.rules
+    rm -f -- /etc/udev/rules.d/71-biosdevname.rules
 else
     info "biosdevname=1: activating biosdevname network renaming"
     udevproperty UDEV_BIOSDEVNAME=1
diff --git a/modules.d/98systemd/dracut-emergency.service b/modules.d/98systemd/dracut-emergency.service
index ebf5aac3..a4b81bc5 100644
--- a/modules.d/98systemd/dracut-emergency.service
+++ b/modules.d/98systemd/dracut-emergency.service
@@ -21,7 +21,7 @@ Environment=DRACUT_SYSTEMD=1
 Environment=NEWROOT=/sysroot
 WorkingDirectory=/
 ExecStart=/bin/dracut-emergency
-ExecStopPost=-/bin/rm -f /.console_lock
+ExecStopPost=-/bin/rm -f -- /.console_lock
 Type=oneshot
 StandardInput=tty-force
 StandardOutput=inherit
diff --git a/modules.d/98systemd/dracut-emergency.sh b/modules.d/98systemd/dracut-emergency.sh
index 8ab045ea..e1da2efe 100755
--- a/modules.d/98systemd/dracut-emergency.sh
+++ b/modules.d/98systemd/dracut-emergency.sh
@@ -36,6 +36,6 @@ else
     exit 1
 fi
 
-/bin/rm -f /.console_lock
+/bin/rm -f -- /.console_lock
 
 exit 0
diff --git a/modules.d/98systemd/dracut-initqueue.sh b/modules.d/98systemd/dracut-initqueue.sh
index 2c71bf44..35cd76f5 100755
--- a/modules.d/98systemd/dracut-initqueue.sh
+++ b/modules.d/98systemd/dracut-initqueue.sh
@@ -30,7 +30,7 @@ while :; do
     check_finished && break
 
     if [ -f $hookdir/initqueue/work ]; then
-        rm $hookdir/initqueue/work
+        rm -f -- "$hookdir/initqueue/work"
     fi
 
     for job in $hookdir/initqueue/*.sh; do
diff --git a/modules.d/98systemd/dracut-mount.sh b/modules.d/98systemd/dracut-mount.sh
index ae01512c..acebef67 100755
--- a/modules.d/98systemd/dracut-mount.sh
+++ b/modules.d/98systemd/dracut-mount.sh
@@ -26,7 +26,7 @@ while :; do
             usable_root "$NEWROOT" && break;
             warn "$NEWROOT has no proper rootfs layout, ignoring and removing offending mount hook"
             umount "$NEWROOT"
-            rm -f "$f"
+            rm -f -- "$f"
         fi
     done
 
diff --git a/modules.d/98systemd/dracut-pre-pivot.sh b/modules.d/98systemd/dracut-pre-pivot.sh
index 63cc9b34..8c7554ea 100755
--- a/modules.d/98systemd/dracut-pre-pivot.sh
+++ b/modules.d/98systemd/dracut-pre-pivot.sh
@@ -23,6 +23,6 @@ source_hook cleanup
 getarg rd.break -d rdbreak && emergency_shell -n switch_root "Break before switch_root"
 
 # remove helper symlink
-[ -h /dev/root ] && rm -f /dev/root
+[ -h /dev/root ] && rm -f -- /dev/root
 
 exit 0
diff --git a/modules.d/98systemd/rescue.service b/modules.d/98systemd/rescue.service
index 62f20673..edc24619 100644
--- a/modules.d/98systemd/rescue.service
+++ b/modules.d/98systemd/rescue.service
@@ -18,7 +18,7 @@ Environment=NEWROOT=/sysroot
 WorkingDirectory=/
 ExecStartPre=-/bin/plymouth quit
 ExecStart=-/bin/sh -i -l
-ExecStopPost=-/bin/rm -f /.console_lock
+ExecStopPost=-/bin/rm -f -- /.console_lock
 ExecStopPost=-/usr/bin/systemctl --fail --no-block default
 Type=idle
 StandardInput=tty-force
diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
index 581b63a0..e9021263 100755
--- a/modules.d/99base/dracut-lib.sh
+++ b/modules.d/99base/dracut-lib.sh
@@ -754,7 +754,7 @@ inst_hook() {
 
     if [ -n "$onetime" ]; then
         {
-            echo '[ -e "$_job" ] && rm "$_job"'
+            echo '[ -e "$_job" ] && rm -f -- "$_job"'
             echo "$_exe $@"
         } > "/tmp/$$-${_job}.sh"
     else
@@ -867,12 +867,12 @@ cancel_wait_for_dev()
 {
     local _name
     _name="$(str_replace "$1" '/' '\\x2f')"
-    rm -f "$hookdir/initqueue/finished/devexists-${_name}.sh"
-    rm -f "$hookdir/emergency/80-${_name}.sh"
+    rm -f -- "$hookdir/initqueue/finished/devexists-${_name}.sh"
+    rm -f -- "$hookdir/emergency/80-${_name}.sh"
     if [ -n "$DRACUT_SYSTEMD" ]; then
         _name=$(dev_unit_name "$1")
-        rm -f ${PREFIX}/etc/systemd/system/initrd.target.requires/${_name}.device
-        rm -f ${PREFIX}/etc/systemd/system/${_name}.device.d/timeout.conf
+        rm -f -- ${PREFIX}/etc/systemd/system/initrd.target.requires/${_name}.device
+        rm -f -- ${PREFIX}/etc/systemd/system/${_name}.device.d/timeout.conf
         /sbin/initqueue --onetime --unique --name daemon-reload systemctl daemon-reload
     fi
 }
@@ -921,7 +921,7 @@ wait_for_loginit()
     fi
 
     setdebug
-    rm -f /run/initramfs/loginit.pipe /run/initramfs/loginit.pid
+    rm -f -- /run/initramfs/loginit.pipe /run/initramfs/loginit.pid
 }
 
 _emergency_shell()
@@ -931,8 +931,8 @@ _emergency_shell()
         > /.console_lock
         echo "PS1=\"$_name:\\\${PWD}# \"" >/etc/profile
         systemctl start dracut-emergency.service
-        rm -f /etc/profile
-        rm -f /.console_lock
+        rm -f -- /etc/profile
+        rm -f -- /.console_lock
     else
         debug_off
         echo
diff --git a/modules.d/99base/init.sh b/modules.d/99base/init.sh
index c72129b9..16104ae0 100755
--- a/modules.d/99base/init.sh
+++ b/modules.d/99base/init.sh
@@ -85,7 +85,7 @@ if ! ismounted /run; then
     mount -t tmpfs -o mode=0755,nosuid,nodev,strictatime tmpfs /newrun >/dev/null 
     cp -a /run/* /newrun >/dev/null 2>&1
     mount --move /newrun /run
-    rm -fr /newrun
+    rm -fr -- /newrun
 fi
 
 trap "action_on_fail Signal caught!" 0
@@ -174,7 +174,7 @@ while :; do
     check_finished && break
 
     if [ -f $hookdir/initqueue/work ]; then
-        rm $hookdir/initqueue/work
+        rm -f -- $hookdir/initqueue/work
     fi
 
     for job in $hookdir/initqueue/*.sh; do
@@ -237,7 +237,7 @@ while :; do
             usable_root "$NEWROOT" && break;
             warn "$NEWROOT has no proper rootfs layout, ignoring and removing offending mount hook"
             umount "$NEWROOT"
-            rm -f "$f"
+            rm -f -- "$f"
         fi
     done
 
@@ -317,7 +317,7 @@ for i in $(export -p); do
     esac
 done
 . /tmp/export.orig 2>/dev/null || :
-rm -f /tmp/export.orig
+rm -f -- /tmp/export.orig
 
 initargs=""
 read CLINE </proc/cmdline
@@ -356,7 +356,7 @@ fi
 wait_for_loginit
 
 # remove helper symlink
-[ -h /dev/root ] && rm -f /dev/root
+[ -h /dev/root ] && rm -f -- /dev/root
 
 getarg rd.break -d rdbreak && emergency_shell -n switch_root "Break before switch_root"
 info "Switching root"
diff --git a/modules.d/99base/initqueue.sh b/modules.d/99base/initqueue.sh
index 3387e888..854a36a8 100755
--- a/modules.d/99base/initqueue.sh
+++ b/modules.d/99base/initqueue.sh
@@ -46,7 +46,7 @@ shift
 [ -x "$exe" ] || exe=$(command -v $exe)
 
 {
-    [ -n "$onetime" ] && echo '[ -e "$job" ] && rm "$job"'
+    [ -n "$onetime" ] && echo '[ -e "$job" ] && rm -f -- "$job"'
     [ -n "$env" ] && echo "$env"
     echo "$exe $@"
 } > "/tmp/$$-${job}.sh"
diff --git a/modules.d/99base/loginit.sh b/modules.d/99base/loginit.sh
index 97cb154f..d215abe0 100755
--- a/modules.d/99base/loginit.sh
+++ b/modules.d/99base/loginit.sh
@@ -14,7 +14,7 @@ exec 6>/run/initramfs/init.log
 
 while read line; do
     if [ "$line" = "DRACUT_LOG_END" ]; then
-        rm -f /run/initramfs/loginit.pipe
+        rm -f -- /run/initramfs/loginit.pipe
         exit 0
     fi
     echo "<31>dracut: $line" >&5
diff --git a/modules.d/99shutdown/shutdown.sh b/modules.d/99shutdown/shutdown.sh
index d6a532b0..f0401397 100755
--- a/modules.d/99shutdown/shutdown.sh
+++ b/modules.d/99shutdown/shutdown.sh
@@ -86,7 +86,7 @@ _check_shutdown() {
         [ -e "$__f" ] || continue
         ( . "$__f" $1 )
         if [ $? -eq 0 ]; then
-            rm -f $__f
+            rm -f -- $__f
             __s=0
         fi
     done