From 06439cc5b15f9201db181e5740ec9dd4bce5fcf9 Mon Sep 17 00:00:00 2001
From: Ken Gaillot <kgaillot@redhat.com>
Date: Wed, 17 Jul 2019 14:13:20 -0500
Subject: [PATCH 6/6] Low: extra: quote shell variables in agent code where
 appropriate

... and correspondingly, don't quote where inappropriate (i.e. numeric
comparisons), for general good practice, resilience against misconfigurations,
and improved support for spaces in some user input values.
---
 extra/resources/ClusterMon.in  | 40 +++++++-------
 extra/resources/Dummy          | 14 ++---
 extra/resources/HealthCPU      | 16 +++---
 extra/resources/HealthIOWait   | 12 ++---
 extra/resources/HealthSMART.in | 54 +++++++++----------
 extra/resources/Stateful       | 43 ++++++++-------
 extra/resources/SysInfo.in     | 48 ++++++++---------
 extra/resources/SystemHealth   | 12 ++---
 extra/resources/attribute      | 12 ++---
 extra/resources/controld       | 22 ++++----
 extra/resources/ifspeed.in     | 98 +++++++++++++++++-----------------
 extra/resources/o2cb.in        | 22 ++++----
 extra/resources/ping           | 40 +++++++-------
 extra/resources/pingd          | 14 ++---
 extra/resources/remote         |  6 +--
 15 files changed, 228 insertions(+), 225 deletions(-)

diff --git a/extra/resources/ClusterMon.in b/extra/resources/ClusterMon.in
index cc687acd8..407202a8a 100755
--- a/extra/resources/ClusterMon.in
+++ b/extra/resources/ClusterMon.in
@@ -23,9 +23,9 @@
 
 #######################################################################
 # Initialization:
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 #######################################################################
 
@@ -117,30 +117,30 @@ ClusterMon_exit() {
 }
 
 ClusterMon_start() {
-    if [ ! -z $OCF_RESKEY_user ]; then
-        su - $OCF_RESKEY_user -c "$CMON_CMD"
+    if [ ! -z "$OCF_RESKEY_user" ]; then
+        su - "$OCF_RESKEY_user" -c "$CMON_CMD"
     else
-        $CMON_CMD
+        eval $CMON_CMD
     fi
     ClusterMon_exit $?
 }
 
 ClusterMon_stop() {
-    if [ -f $OCF_RESKEY_pidfile ]; then
-        pid=`cat $OCF_RESKEY_pidfile`
-        if [ ! -z $pid ]; then
+    if [ -f "$OCF_RESKEY_pidfile" ]; then
+        pid=`cat "$OCF_RESKEY_pidfile"`
+        if [ ! -z "$pid" ]; then
             kill -s 9 $pid
-            rm -f $OCF_RESKEY_pidfile
+            rm -f "$OCF_RESKEY_pidfile"
         fi
     fi
     ClusterMon_exit 0
 }
 
 ClusterMon_monitor() {
-    if [ -f $OCF_RESKEY_pidfile ]; then
-        pid=`cat $OCF_RESKEY_pidfile`
-        if [ ! -z $pid ]; then
-            str=$(echo "su - $OCF_RESKEY_user -c \"$CMON_CMD\"" | tr 'crmon, \t' 'xxxxxxxx')
+    if [ -f "$OCF_RESKEY_pidfile" ]; then
+        pid=`cat "$OCF_RESKEY_pidfile"`
+        if [ ! -z "$pid" ]; then
+            str=$(echo "su - \"$OCF_RESKEY_user\" -c \"$CMON_CMD\"" | tr 'crmon, \t' 'xxxxxxxx')
             ps -o "args=${str}" -p $pid 2>/dev/null | \
                 grep -qE "[c]rm_mon.*${OCF_RESKEY_pidfile}"
             rc=$?
@@ -157,7 +157,7 @@ ClusterMon_monitor() {
 CheckOptions() {
 while getopts Vi:nrh:cdp: OPTION
 do
-    case $OPTION in
+    case "$OPTION" in
     V|n|r|c|d);;
     i)  ocf_log warn "You should not have specified the -i option, since OCF_RESKEY_update is set already!";;
     h)  ocf_log warn "You should not have specified the -h option, since OCF_RESKEY_htmlfile is set already!";;
@@ -181,7 +181,7 @@ fi
 
 ClusterMon_validate() {
 # Existence of the user
-    if [ ! -z $OCF_RESKEY_user ]; then
+    if [ ! -z "$OCF_RESKEY_user" ]; then
         getent passwd "$OCF_RESKEY_user" >/dev/null
         if [ $? -eq 0 ]; then
             : Yes, user exists. We can further check his permission on crm_mon if necessary
@@ -192,7 +192,7 @@ ClusterMon_validate() {
     fi
 
 # Pidfile better be an absolute path
-    case $OCF_RESKEY_pidfile in
+    case "$OCF_RESKEY_pidfile" in
         /*) ;;
         *) ocf_log warn "You should have pidfile($OCF_RESKEY_pidfile) of absolute path!" ;;
     esac
@@ -213,7 +213,7 @@ ClusterMon_validate() {
     fi
 
 # Htmlfile better be an absolute path
-    case $OCF_RESKEY_htmlfile in
+    case "$OCF_RESKEY_htmlfile" in
         /*) ;;
         *) ocf_log warn "You should have htmlfile($OCF_RESKEY_htmlfile) of absolute path!" ;;
     esac
@@ -235,9 +235,9 @@ if [ ${OCF_RESKEY_update} -ge 1000 ]; then
     OCF_RESKEY_update=$(( $OCF_RESKEY_update / 1000 ))
 fi
 
-CMON_CMD="${HA_SBIN_DIR}/crm_mon -p $OCF_RESKEY_pidfile -d -i $OCF_RESKEY_update $OCF_RESKEY_extra_options -h $OCF_RESKEY_htmlfile"
+CMON_CMD="${HA_SBIN_DIR}/crm_mon -p \"$OCF_RESKEY_pidfile\" -d -i $OCF_RESKEY_update $OCF_RESKEY_extra_options -h \"$OCF_RESKEY_htmlfile\""
 
-case $__OCF_ACTION in
+case "$__OCF_ACTION" in
 meta-data)      meta_data
                 exit $OCF_SUCCESS
                 ;;
diff --git a/extra/resources/Dummy b/extra/resources/Dummy
index be93c92ea..89eee588d 100755
--- a/extra/resources/Dummy
+++ b/extra/resources/Dummy
@@ -17,9 +17,9 @@
 #######################################################################
 # Initialization:
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 #######################################################################
 
@@ -163,7 +163,7 @@ dummy_start() {
 dummy_stop() {
     dummy_monitor --force
     if [ $? -eq $OCF_SUCCESS ]; then
-        rm ${OCF_RESKEY_state}
+        rm "${OCF_RESKEY_state}"
     fi
     rm -f "${VERIFY_SERIALIZED_FILE}"
     return $OCF_SUCCESS
@@ -232,7 +232,7 @@ dummy_validate() {
     return $OCF_SUCCESS
 }
 
-: ${OCF_RESKEY_fake:=dummy}
+: ${OCF_RESKEY_fake:="dummy"}
 : ${OCF_RESKEY_op_sleep:=0}
 : ${OCF_RESKEY_CRM_meta_interval:=0}
 : ${OCF_RESKEY_CRM_meta_globally_unique:="false"}
@@ -240,7 +240,7 @@ dummy_validate() {
 if [ -z "$OCF_RESKEY_state" ]; then
     OCF_RESKEY_state="${HA_VARRUN%%/}/Dummy-${OCF_RESOURCE_INSTANCE}.state"
 
-    if [ ${OCF_RESKEY_CRM_meta_globally_unique} = "false" ]; then
+    if [ "${OCF_RESKEY_CRM_meta_globally_unique}" = "false" ]; then
         # Strip off the trailing clone marker (note + is not portable in sed)
         OCF_RESKEY_state=`echo $OCF_RESKEY_state | sed s/:[0-9][0-9]*\.state/.state/`
     fi
@@ -249,7 +249,7 @@ VERIFY_SERIALIZED_FILE="${OCF_RESKEY_state}.serialized"
 
 dump_env
 
-case $__OCF_ACTION in
+case "$__OCF_ACTION" in
 meta-data)      meta_data
                 exit $OCF_SUCCESS
                 ;;
diff --git a/extra/resources/HealthCPU b/extra/resources/HealthCPU
index 053ade05f..5ae5c13c6 100755
--- a/extra/resources/HealthCPU
+++ b/extra/resources/HealthCPU
@@ -23,9 +23,9 @@
 #######################################################################
 # Initialization:
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 #######################################################################
 
@@ -96,13 +96,13 @@ dummy_start() {
     if [ $? =  $OCF_SUCCESS ]; then
         return $OCF_SUCCESS
     fi
-    touch ${OCF_RESKEY_state}
+    touch "${OCF_RESKEY_state}"
 }
 
 dummy_stop() {
     dummy_monitor
     if [ $? =  $OCF_SUCCESS ]; then
-        rm ${OCF_RESKEY_state}
+        rm "${OCF_RESKEY_state}"
     fi
     return $OCF_SUCCESS
 }
@@ -112,7 +112,7 @@ dummy_monitor() {
     # (SUCCESS), failed (ERROR) or _cleanly_ stopped (NOT RUNNING).
     # That is THREE states, not just yes/no.
 
-    if [ -f ${OCF_RESKEY_state} ]; then
+    if [ -f "${OCF_RESKEY_state}" ]; then
 
         IDLE=`top -b -n2 | grep Cpu | tail -1 | awk -F",|.[0-9][ %]id" '{ print $4 }'`
         # echo "System idle: " $IDLE
@@ -159,7 +159,7 @@ dummy_validate() {
 : ${OCF_RESKEY_CRM_meta_globally_unique:="false"}
 
 if [ "x$OCF_RESKEY_state" = "x" ]; then
-    if [ ${OCF_RESKEY_CRM_meta_globally_unique} = "false" ]; then
+    if [ "${OCF_RESKEY_CRM_meta_globally_unique}" = "false" ]; then
         state="${HA_VARRUN%%/}/Dummy-${OCF_RESOURCE_INSTANCE}.state"
 
         # Strip off the trailing clone marker
@@ -177,7 +177,7 @@ if [ "x${OCF_RESKEY_yellow_limit}" = "x" ] ; then
     OCF_RESKEY_yellow_limit=50
 fi
 
-case $__OCF_ACTION in
+case "$__OCF_ACTION" in
 meta-data)      meta_data
                 exit $OCF_SUCCESS
                 ;;
diff --git a/extra/resources/HealthIOWait b/extra/resources/HealthIOWait
index 8d21bbb45..00512bc4c 100755
--- a/extra/resources/HealthIOWait
+++ b/extra/resources/HealthIOWait
@@ -16,9 +16,9 @@
 #######################################################################
 # Initialization:
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 #######################################################################
 
@@ -95,7 +95,7 @@ agent_start() {
 agent_stop() {
     agent_monitor
     if [ $? =  $OCF_SUCCESS ]; then
-        rm ${OCF_RESKEY_state}
+        rm "${OCF_RESKEY_state}"
     fi
     return $OCF_SUCCESS
 }
@@ -104,7 +104,7 @@ agent_monitor() {
         # Monitor _MUST!_ differentiate correctly between running
         # (SUCCESS), failed (ERROR) or _cleanly_ stopped (NOT RUNNING).
         # That is THREE states, not just yes/no.
-        if [ -f ${OCF_RESKEY_state} ]; then
+        if [ -f "${OCF_RESKEY_state}" ]; then
           WAIT=`top -b -n2 | grep Cpu | tail -1 | awk -F",|.[0-9][ %]wa" '{ print $5 }'`
           # echo "System iowait: " $WAIT
           # echo $OCF_RESKEY_yellow_limit
@@ -139,7 +139,7 @@ agent_validate() {
 : ${OCF_RESKEY_CRM_meta_globally_unique:="false"}
 
 if [ "x$OCF_RESKEY_state" = "x" ]; then
-    if [ ${OCF_RESKEY_CRM_meta_globally_unique} = "false" ]; then
+    if [ "${OCF_RESKEY_CRM_meta_globally_unique}" = "false" ]; then
       state="${HA_VARRUN%%/}/HealthIoWait-${OCF_RESOURCE_INSTANCE}.state"
       #Strip off the trailing clone marker
       OCF_RESKEY_state=`echo $state | sed s/:[0-9][0-9]*\.state/.state/`
diff --git a/extra/resources/HealthSMART.in b/extra/resources/HealthSMART.in
index 5f0815dd3..18ace44f5 100755
--- a/extra/resources/HealthSMART.in
+++ b/extra/resources/HealthSMART.in
@@ -19,9 +19,9 @@
 #######################################################################
 # Initialization:
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 #
 SMARTCTL=/usr/sbin/smartctl
 ATTRDUP=/usr/sbin/attrd_updater
@@ -110,25 +110,25 @@ check_temperature() {
 
     if [ $1 -lt ${lower_red_limit} ] ; then
         ocf_log info "Drive ${DRIVE} ${DEVICE} too cold: ${1} C"
-        $ATTRDUP -n "#health-smart" -U "red" -d "5s"
+        "$ATTRDUP" -n "#health-smart" -U "red" -d "5s"
         return 1
     fi
 
     if [ $1 -gt ${upper_red_limit} ] ; then
         ocf_log info "Drive ${DRIVE} ${DEVICE} too hot: ${1} C"
-        $ATTRDUP -n "#health-smart" -U "red" -d "5s"
+        "$ATTRDUP" -n "#health-smart" -U "red" -d "5s"
         return 1
     fi
 
     if [ $1 -lt ${lower_yellow_limit} ] ; then
         ocf_log info "Drive ${DRIVE} ${DEVICE} quite cold: ${1} C"
-        $ATTRDUP -n "#health-smart" -U "yellow" -d "5s"
+        "$ATTRDUP" -n "#health-smart" -U "yellow" -d "5s"
         return 1
     fi
 
     if [ $1 -gt ${upper_yellow_limit} ] ; then
         ocf_log info "Drive ${DRIVE} ${DEVICE} quite hot: ${1} C"
-        $ATTRDUP -n "#health-smart" -U "yellow" -d "5s"
+        "$ATTRDUP" -n "#health-smart" -U "yellow" -d "5s"
         return 1
     fi
 }
@@ -136,20 +136,20 @@ check_temperature() {
 
 init_smart() {
     #Set temperature defaults
-    if [ -z ${OCF_RESKEY_temp_warning} ]; then
+    if [ -z "${OCF_RESKEY_temp_warning}" ]; then
         yellow_threshold=5
     else
         yellow_threshold=${OCF_RESKEY_temp_warning}
     fi
 
-    if [ -z ${OCF_RESKEY_temp_lower_limit} ] ; then
+    if [ -z "${OCF_RESKEY_temp_lower_limit}" ] ; then
         lower_red_limit=0
     else
         lower_red_limit=${OCF_RESKEY_temp_lower_limit}
     fi
     lower_yellow_limit=$((${lower_red_limit}+${yellow_threshold}))
 
-    if [ -z ${OCF_RESKEY_temp_upper_limit} ] ; then
+    if [ -z "${OCF_RESKEY_temp_upper_limit}" ] ; then
         upper_red_limit=60
     else
         upper_red_limit=${OCF_RESKEY_temp_upper_limit}
@@ -164,7 +164,7 @@ init_smart() {
     fi
 
     #Test for presence of smartctl
-    if [ ! -x $SMARTCTL ] ; then
+    if [ ! -x "$SMARTCTL" ] ; then
         ocf_log err "${SMARTCTL} not installed."
         exit $OCF_ERR_INSTALLED
     fi
@@ -172,15 +172,15 @@ init_smart() {
     for DRIVE in $DRIVES; do
         if [ "${OCF_RESKEY_devices}" ]; then
             for DEVICE in ${OCF_RESKEY_devices}; do
-                $SMARTCTL -d $DEVICE -i ${DRIVE} | grep -q "SMART support is: Enabled"
-                if [ $? -ne "0" ] ; then
+                "$SMARTCTL" -d "$DEVICE" -i "${DRIVE}" | grep -q "SMART support is: Enabled"
+                if [ $? -ne 0 ] ; then
                     ocf_log err "S.M.A.R.T. not enabled for drive "${DRIVE}
                     exit $OCF_ERR_INSTALLED
                 fi
             done
         else
-            $SMARTCTL -i ${DRIVE} | grep -q "SMART support is: Enabled"
-            if [ $? -ne "0" ] ; then
+            "$SMARTCTL" -i "${DRIVE}" | grep -q "SMART support is: Enabled"
+            if [ $? -ne 0 ] ; then
                 ocf_log err "S.M.A.R.T. not enabled for drive "${DRIVE}
                 exit $OCF_ERR_INSTALLED
             fi
@@ -201,13 +201,13 @@ HealthSMART_start() {
     if [ $? =  $OCF_SUCCESS ]; then
         return $OCF_SUCCESS
     fi
-    touch ${OCF_RESKEY_state}
+    touch "${OCF_RESKEY_state}"
 }
 
 HealthSMART_stop() {
     HealthSMART_monitor
     if [ $? =  $OCF_SUCCESS ]; then
-        rm ${OCF_RESKEY_state}
+        rm "${OCF_RESKEY_state}"
     fi
     return $OCF_SUCCESS
 }
@@ -220,22 +220,22 @@ HealthSMART_monitor() {
     # (SUCCESS), failed (ERROR) or _cleanly_ stopped (NOT RUNNING).
     # That is THREE states, not just yes/no.
 
-    if [ -f ${OCF_RESKEY_state} ]; then
+    if [ -f "${OCF_RESKEY_state}" ]; then
 
         # Check overall S.M.A.R.T. status
         for DRIVE in $DRIVES; do
             if [ "${OCF_RESKEY_devices}" ]; then
                 for DEVICE in ${OCF_RESKEY_devices}; do
-                    $SMARTCTL -d $DEVICE -H ${DRIVE} | grep -q "SMART overall-health self-assessment test result: PASSED"
-                    if [ $? -ne "0" ]; then
-                        $ATTRDUP -n "#health-smart" -U "red" -d "5s"
+                    "$SMARTCTL" -d "$DEVICE" -H ${DRIVE} | grep -q "SMART overall-health self-assessment test result: PASSED"
+                    if [ $? -ne 0 ]; then
+                        "$ATTRDUP" -n "#health-smart" -U "red" -d "5s"
                         return $OCF_SUCCESS
                     fi
                 done
             else
-                $SMARTCTL -H ${DRIVE} | grep -q "SMART overall-health self-assessment test result: PASSED"
-                if [ $? -ne "0" ]; then
-                    $ATTRDUP -n "#health-smart" -U "red" -d "5s"
+                "$SMARTCTL" -H "${DRIVE}" | grep -q "SMART overall-health self-assessment test result: PASSED"
+                if [ $? -ne 0 ]; then
+                    "$ATTRDUP" -n "#health-smart" -U "red" -d "5s"
                     return $OCF_SUCCESS
                 fi
             fi
@@ -256,7 +256,7 @@ HealthSMART_monitor() {
             fi
         done
 
-        $ATTRDUP -n "#health-smart" -U "green" -d "5s"
+        "$ATTRDUP" -n "#health-smart" -U "green" -d "5s"
         return $OCF_SUCCESS
     fi
 
@@ -283,7 +283,7 @@ HealthSMART_validate() {
 : ${OCF_RESKEY_CRM_meta_globally_unique:="true"}
 
 if [ "x$OCF_RESKEY_state" = "x" ]; then
-    if [ ${OCF_RESKEY_CRM_meta_globally_unique} = "false" ]; then
+    if [ "${OCF_RESKEY_CRM_meta_globally_unique}" = "false" ]; then
         state="${HA_VARRUN%%/}/HealthSMART-${OCF_RESOURCE_INSTANCE}.state"
 
         # Strip off the trailing clone marker
@@ -293,7 +293,7 @@ if [ "x$OCF_RESKEY_state" = "x" ]; then
     fi
 fi
 
-case $__OCF_ACTION in
+case "$__OCF_ACTION" in
     start)        HealthSMART_start;;
     stop)         HealthSMART_stop;;
     monitor)      HealthSMART_monitor;;
diff --git a/extra/resources/Stateful b/extra/resources/Stateful
index e65c96c1b..43ddfabd5 100755
--- a/extra/resources/Stateful
+++ b/extra/resources/Stateful
@@ -17,10 +17,9 @@
 #######################################################################
 # Initialization:
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
-CRM_MASTER="${HA_SBIN_DIR}/crm_master -l reboot"
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 #######################################################################
 
@@ -91,13 +90,13 @@ END
 }
 
 stateful_update() {
-    echo $1 > ${OCF_RESKEY_state}
+    echo $1 > "${OCF_RESKEY_state}"
 }
 
 stateful_check_state() {
-    target=$1
-    if [ -f ${OCF_RESKEY_state} ]; then
-        state=`cat ${OCF_RESKEY_state}`
+    target="$1"
+    if [ -f "${OCF_RESKEY_state}" ]; then
+        state=`cat "${OCF_RESKEY_state}"`
         if [ "x$target" = "x$state" ]; then
             return 0
         fi
@@ -119,6 +118,10 @@ $(env | sort)
     fi
 }
 
+set_master_score() {
+    "${HA_SBIN_DIR}/crm_master" -l reboot -v "$1"
+}
+
 stateful_start() {
     stateful_check_state master
     if [ $? = 0 ]; then
@@ -126,7 +129,7 @@ stateful_start() {
         return $OCF_RUNNING_MASTER
     fi
     stateful_update slave
-    $CRM_MASTER -v ${slave_score}
+    set_master_score "${slave_score}"
     return 0
 }
 
@@ -137,7 +140,7 @@ stateful_demote() {
         return $OCF_NOT_RUNNING
     fi
     stateful_update slave
-    $CRM_MASTER -v ${slave_score}
+    set_master_score "${slave_score}"
     return 0
 }
 
@@ -147,19 +150,19 @@ stateful_promote() {
         return $OCF_NOT_RUNNING
     fi
     stateful_update master
-    $CRM_MASTER -v ${master_score}
+    set_master_score "${master_score}"
     return 0
 }
 
 stateful_stop() {
-    $CRM_MASTER -D
+    "${HA_SBIN_DIR}/crm_master" -l reboot -D
     stateful_check_state master
     if [ $? = 0 ]; then
         # CRM Error - Should never happen
         return $OCF_RUNNING_MASTER
     fi
-    if [ -f ${OCF_RESKEY_state} ]; then
-        rm ${OCF_RESKEY_state}
+    if [ -f "${OCF_RESKEY_state}" ]; then
+        rm "${OCF_RESKEY_state}"
     fi
     return 0
 }
@@ -169,7 +172,7 @@ stateful_monitor() {
     if [ $? = 0 ]; then
         if [ $OCF_RESKEY_CRM_meta_interval = 0 ]; then
             # Restore the master setting during probes
-            $CRM_MASTER -v ${master_score}
+            set_master_score "${master_score}"
         fi
         return $OCF_RUNNING_MASTER
     fi
@@ -178,14 +181,14 @@ stateful_monitor() {
     if [ $? = 0 ]; then
         if [ $OCF_RESKEY_CRM_meta_interval = 0 ]; then
             # Restore the master setting during probes
-            $CRM_MASTER -v ${slave_score}
+            set_master_score "${slave_score}"
         fi
         return $OCF_SUCCESS
     fi
 
-    if [ -f ${OCF_RESKEY_state} ]; then
+    if [ -f "${OCF_RESKEY_state}" ]; then
         echo "File '${OCF_RESKEY_state}' exists but contains unexpected contents"
-        cat ${OCF_RESKEY_state}
+        cat "${OCF_RESKEY_state}"
         return $OCF_ERR_GENERIC
     fi
     return 7
@@ -210,7 +213,7 @@ stateful_validate() {
 : ${OCF_RESKEY_CRM_meta_globally_unique:="false"}
 
 if [ "x$OCF_RESKEY_state" = "x" ]; then
-    if [ ${OCF_RESKEY_CRM_meta_globally_unique} = "false" ]; then
+    if [ "${OCF_RESKEY_CRM_meta_globally_unique}" = "false" ]; then
         state="${HA_VARRUN%%/}/Stateful-${OCF_RESOURCE_INSTANCE}.state"
 
         # Strip off the trailing clone marker
@@ -222,7 +225,7 @@ fi
 
 dump_env
 
-case $__OCF_ACTION in
+case "$__OCF_ACTION" in
 meta-data)      meta_data;;
 start)          stateful_start;;
 promote)        stateful_promote;;
diff --git a/extra/resources/SysInfo.in b/extra/resources/SysInfo.in
index 022ebd0d9..562546b4d 100755
--- a/extra/resources/SysInfo.in
+++ b/extra/resources/SysInfo.in
@@ -17,9 +17,9 @@
 #######################################################################
 # Initialization:
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 #######################################################################
 
@@ -134,13 +134,13 @@ END
 #######################################################################
 
 UpdateStat() {
-    name=$1; shift
+    name="$1"; shift
     value="$*"
     printf "%s:\t%s\n" "$name" "$value"
     if [ "$__OCF_ACTION" = "start" ] ; then
-        ${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -S status -n $name -B "$value"
+        "${HA_SBIN_DIR}/attrd_updater" ${OCF_RESKEY_delay} -S status -n $name -B "$value"
     else
-        ${HA_SBIN_DIR}/attrd_updater ${OCF_RESKEY_delay} -S status -n $name -v "$value"
+        "${HA_SBIN_DIR}/attrd_updater" ${OCF_RESKEY_delay} -S status -n $name -v "$value"
     fi
 }
 
@@ -153,8 +153,8 @@ SysInfoStats() {
         "Darwin")
             mem=`top -l 1 | grep Mem: | awk '{print $10}'`
             mem_used=`top -l 1 | grep Mem: | awk '{print $8}'`
-            mem=`SysInfo_mem_units $mem`
-            mem_used=`SysInfo_mem_units $mem_used`
+            mem=`SysInfo_mem_units "$mem"`
+            mem_used=`SysInfo_mem_units "$mem_used"`
             mem_total=`expr $mem_used + $mem`
             cpu_type=`system_profiler SPHardwareDataType | awk -F': ' '/^CPU Type/ {print $2; exit}'`
             cpu_speed=`system_profiler SPHardwareDataType | awk -F': ' '/^CPU Speed/ {print $2; exit}'`
@@ -185,7 +185,7 @@ SysInfoStats() {
             if [ -f /proc/meminfo ]; then
                 # meminfo results are in kB
                 mem=`grep "SwapFree" /proc/meminfo | awk '{print $2"k"}'`
-                if [ ! -z $mem ]; then
+                if [ ! -z "$mem" ]; then
                     UpdateStat free_swap "$(SysInfo_mem_units "$mem")"
                 fi
                 mem=`grep "Inactive" /proc/meminfo | awk '{print $2"k"}'`
@@ -224,11 +224,11 @@ SysInfoStats() {
     #     'tail -n <c>' to the equivalent 'tail -<c>'.
     for disk in "/" ${OCF_RESKEY_disks}; do
         unset disk_free disk_label
-        disk_free=`df -h ${disk} | tail -1 | awk '{print $4}'`
+        disk_free=`df -h "${disk}" | tail -1 | awk '{print $4}'`
         if [ x != x"$disk_free" ]; then
             disk_label=`echo $disk | sed -e 's#^/$#root#;s#^/*##;s#/#_#g'`
-            disk_free=`SysInfo_hdd_units $disk_free`
-            UpdateStat ${disk_label}_free $disk_free
+            disk_free=`SysInfo_hdd_units "$disk_free"`
+            UpdateStat "${disk_label}_free" $disk_free
             if [ -n "$MIN_FREE" ]; then
                 if [ $disk_free -le $MIN_FREE ]; then
                     UpdateStat "#health_disk" "red"
@@ -252,9 +252,9 @@ SysInfo_megabytes() {
 }
 
 SysInfo_mem_units() {
-    mem=$1
+    mem="$1"
 
-    if [ -z $1 ]; then
+    if [ -z "$1" ]; then
         return
     fi
 
@@ -271,7 +271,7 @@ SysInfo_mem_units() {
 SysInfo_hdd_units() {
     # Defauts to size in gigabytes
 
-    case $OCF_RESKEY_disk_unit in
+    case "$OCF_RESKEY_disk_unit" in
         [Pp]) echo $(($(SysInfo_megabytes "$1") / 1024 / 1024 / 1024));;
         [Tt]) echo $(($(SysInfo_megabytes "$1") / 1024 / 1024));;
         [Gg]) echo $(($(SysInfo_megabytes "$1") / 1024));;
@@ -293,26 +293,26 @@ END
 }
 
 SysInfo_start() {
-    echo $OCF_RESKEY_clone > $OCF_RESKEY_pidfile
+    echo $OCF_RESKEY_clone > "$OCF_RESKEY_pidfile"
     SysInfoStats
     exit $OCF_SUCCESS
 }
 
 SysInfo_stop() {
-    rm $OCF_RESKEY_pidfile
+    rm "$OCF_RESKEY_pidfile"
     exit $OCF_SUCCESS
 }
 
 SysInfo_monitor() {
-    if [ -f $OCF_RESKEY_pidfile ]; then
-        clone=`cat $OCF_RESKEY_pidfile`
+    if [ -f "$OCF_RESKEY_pidfile" ]; then
+        clone=`cat "$OCF_RESKEY_pidfile"`
     fi
 
-    if [ x$clone = x ]; then
-        rm $OCF_RESKEY_pidfile
+    if [ "x$clone" = "x" ]; then
+        rm "$OCF_RESKEY_pidfile"
         exit $OCF_NOT_RUNNING
 
-    elif [ $clone = $OCF_RESKEY_clone ]; then
+    elif [ "$clone" = "$OCF_RESKEY_clone" ]; then
         SysInfoStats
         exit $OCF_SUCCESS
 
@@ -335,7 +335,7 @@ fi
 : ${OCF_RESKEY_pidfile:="${HA_VARRUN%%/}/SysInfo-${OCF_RESOURCE_INSTANCE}"}
 : ${OCF_RESKEY_disk_unit:="G"}
 : ${OCF_RESKEY_clone:="0"}
-if [ x != x${OCF_RESKEY_delay} ]; then
+if [ "x" != "x${OCF_RESKEY_delay}" ]; then
     OCF_RESKEY_delay="-d ${OCF_RESKEY_delay}"
 else
     OCF_RESKEY_delay="-d 0"
@@ -347,7 +347,7 @@ if [ -n "$OCF_RESKEY_min_disk_free" ]; then
     MIN_FREE=`SysInfo_hdd_units $OCF_RESKEY_min_disk_free`
 fi
 
-case $__OCF_ACTION in
+case "$__OCF_ACTION" in
 meta-data)      meta_data
                 exit $OCF_SUCCESS
                 ;;
diff --git a/extra/resources/SystemHealth b/extra/resources/SystemHealth
index c76c5f330..1df5d55b0 100755
--- a/extra/resources/SystemHealth
+++ b/extra/resources/SystemHealth
@@ -13,9 +13,9 @@
 #######################################################################
 # Initialization:
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 #######################################################################
 
@@ -74,7 +74,7 @@ SystemHealth_check_tools() {
         return $OCF_ERR_INSTALLED
     fi
 
-    test -x $OCF_RESKEY_program
+    test -x "$OCF_RESKEY_program"
     RC=$?
 
     if [ $RC != 0 ]; then
@@ -214,13 +214,13 @@ SystemHealth_check_tools
 RC=$?
 
 if [ $RC != 0 ]; then
-        case $__OCF_ACTION in
+        case "$__OCF_ACTION" in
         stop)           exit $OCF_SUCCESS;;
         *)              exit $RC;;
         esac
 fi
 
-case $__OCF_ACTION in
+case "$__OCF_ACTION" in
 start)          SystemHealth_start;;
 stop)           SystemHealth_stop;;
 monitor)        SystemHealth_monitor;;
diff --git a/extra/resources/attribute b/extra/resources/attribute
index fc814b75a..c58260d90 100755
--- a/extra/resources/attribute
+++ b/extra/resources/attribute
@@ -15,9 +15,9 @@ USAGE="Usage: $0 {start|stop|monitor|migrate_to|migrate_from|validate-all|meta-d
 Expects to have a fully populated OCF RA-compliant environment set."
 
 # Load OCF helper functions
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 # Ensure certain variables are set and not empty
 : ${HA_VARRUN:="/var/run"}
@@ -25,7 +25,7 @@ Expects to have a fully populated OCF RA-compliant environment set."
 : ${OCF_RESOURCE_INSTANCE:="undef"}
 
 DEFAULT_STATE_FILE="${HA_VARRUN%%/}/opa-${OCF_RESOURCE_INSTANCE}.state"
-if [ ${OCF_RESKEY_CRM_meta_globally_unique} = "false" ]; then
+if [ "${OCF_RESKEY_CRM_meta_globally_unique}" = "false" ]; then
     # Strip off any trailing clone marker (note + is not portable in sed)
     DEFAULT_STATE_FILE=$(echo "$DEFAULT_STATE_FILE" | sed s/:[0-9][0-9]*\.state/.state/)
 fi
@@ -38,10 +38,10 @@ DEFAULT_INACTIVE_VALUE="0"
 : ${OCF_RESKEY_name:="$DEFAULT_ATTR_NAME"}
 
 # Values may be empty string
-if [ -z ${OCF_RESKEY_active_value+x} ]; then
+if [ -z "${OCF_RESKEY_active_value+x}" ]; then
     OCF_RESKEY_active_value="$DEFAULT_ACTIVE_VALUE"
 fi
-if [ -z ${OCF_RESKEY_inactive_value+x} ]; then
+if [ -z "${OCF_RESKEY_inactive_value+x}" ]; then
     OCF_RESKEY_inactive_value="$DEFAULT_INACTIVE_VALUE"
 fi
 
diff --git a/extra/resources/controld b/extra/resources/controld
index ca9a0f6a4..3ef12a519 100755
--- a/extra/resources/controld
+++ b/extra/resources/controld
@@ -16,15 +16,15 @@
 #######################################################################
 # Initialization:
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 #######################################################################
 
 if [ -e "$OCF_ROOT/resource.d/heartbeat/controld" ]; then
     ocf_log info "Using heartbeat controld agent"
-    $OCF_ROOT/resource.d/heartbeat/controld $1
+    "$OCF_ROOT/resource.d/heartbeat/controld" "$1"
     exit $?
 fi
 
@@ -103,7 +103,7 @@ END
 
 check_uncontrolled_locks()
 {
-    CUL_TMP=$(ls $DLM_SYSFS_DIR 2>&1)
+    CUL_TMP=$(ls "$DLM_SYSFS_DIR" 2>&1)
     if [ $? -eq 0 ]; then
         if [ -n "$CUL_TMP" ]; then
 
@@ -152,7 +152,7 @@ controld_start() {
         return $OCF_ERR_CONFIGURED
     fi
 
-    ${OCF_RESKEY_daemon} $OCF_RESKEY_args
+    "${OCF_RESKEY_daemon}" $OCF_RESKEY_args
 
     while true
     do
@@ -185,7 +185,7 @@ controld_stop() {
         return $OCF_SUCCESS
     fi
 
-    killall -TERM ${OCF_RESKEY_daemon}; rc=$?
+    killall -TERM "${OCF_RESKEY_daemon}"; rc=$?
 
     if [ $rc != 0 ]; then
         return $OCF_ERR_GENERIC
@@ -235,9 +235,9 @@ controld_monitor() {
 
 controld_validate() {
     check_binary killall
-    check_binary ${OCF_RESKEY_daemon}
+    check_binary "${OCF_RESKEY_daemon}"
 
-    case ${OCF_RESKEY_CRM_meta_globally_unique} in
+    case "${OCF_RESKEY_CRM_meta_globally_unique}" in
         yes|Yes|true|True|1)
             ocf_log err "$OCF_RESOURCE_INSTANCE must be configured with the globally_unique=false meta attribute"
             exit $OCF_ERR_CONFIGURED
@@ -249,7 +249,7 @@ controld_validate() {
     return $OCF_SUCCESS
 }
 
-: ${OCF_RESKEY_sctp:=false}
+: ${OCF_RESKEY_sctp:="false"}
 : ${OCF_RESKEY_CRM_meta_globally_unique:="false"}
 
 case "$OCF_RESOURCE_INSTANCE" in
@@ -266,7 +266,7 @@ case "$OCF_RESOURCE_INSTANCE" in
         : ${OCF_RESKEY_daemon:=dlm_controld}
 esac
 
-case $__OCF_ACTION in
+case "$__OCF_ACTION" in
 meta-data)      meta_data
                 exit $OCF_SUCCESS
                 ;;
diff --git a/extra/resources/ifspeed.in b/extra/resources/ifspeed.in
index 63a1291cd..4d8f93e1a 100755
--- a/extra/resources/ifspeed.in
+++ b/extra/resources/ifspeed.in
@@ -33,7 +33,7 @@
 #
 # Initialization:
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
 
 # If these aren't available, we can still show help,
 # which is all that is needed to build the man pages.
@@ -184,14 +184,14 @@ start() {
 }
 
 stop() {
-    ha_pseudo_resource ${ha_pseudo_resource_name} stop
-    attrd_updater -D -n ${OCF_RESKEY_name} -d ${OCF_RESKEY_dampen} ${attrd_options}
+    ha_pseudo_resource "${ha_pseudo_resource_name}" stop
+    attrd_updater -D -n "${OCF_RESKEY_name}" -d "${OCF_RESKEY_dampen}" ${attrd_options}
     return $OCF_SUCCESS
 }
 
 monitor() {
     local ret
-    ha_pseudo_resource ${ha_pseudo_resource_name} monitor
+    ha_pseudo_resource "${ha_pseudo_resource_name}" monitor
     ret=$?
     if [ ${ret} -eq $OCF_SUCCESS ] ; then
         update
@@ -204,7 +204,7 @@ get_nic_name_by_ip(){
     # $FINDIF takes its parameters from the environment.
     # Its output is as follows:
     # [NIC_NAME] netmask [NETMASK] broadcast [BROADCAST}
-    NICINFO=$( ${FINDIF} )
+    NICINFO=$( "${FINDIF}" )
     rc=$?
     if [ $rc -eq 0 ];then
         # Get NIC_NAME part of findif function output.
@@ -235,20 +235,20 @@ validate() {
 }
 
 iface_get_speed() {
-    local iface=$1
+    local iface="$1"
     local operstate
     local carrier
     local speed
 
     if [ ! -e "/sys/class/net/${iface}" ] ; then
         echo "0"
-    elif iface_is_bridge ${iface} ; then # bridges do not have operstate
+    elif iface_is_bridge "${iface}" ; then # bridges do not have operstate
         read carrier < "/sys/class/net/${iface}/carrier"
 
         if [ "${carrier}" != "1" ] ; then
             echo "0"
         else
-            bridge_get_speed ${iface}
+            bridge_get_speed "${iface}"
         fi
     else
         read operstate < "/sys/class/net/${iface}/operstate"
@@ -256,54 +256,54 @@ iface_get_speed() {
 
         if [ "${operstate}" != "up" ] || [ "${carrier}" != "1" ] ; then
             echo "0"
-        elif iface_is_bond ${iface} ; then
-            bond_get_speed ${iface}
-        elif iface_is_vlan ${iface} ; then
+        elif iface_is_bond "${iface}" ; then
+            bond_get_speed "${iface}"
+        elif iface_is_vlan "${iface}" ; then
             iface_get_speed "$(vlan_get_phy "${iface}")"
         elif iface_is_hfi1 "${iface}" ; then
             hfi1_get_speed "${iface}"
         else
             read speed < "/sys/class/net/${iface}/speed"
-            echo ${speed}
+            echo "${speed}"
         fi
     fi
 }
 
 iface_is_vlan() {
-    local iface=$1
+    local iface="$1"
     [ -e "/proc/net/vlan/${iface}" ] && return 0 || return 1
 }
 
 iface_is_bridge() {
-    local iface=$1
+    local iface="$1"
     [ -e "/sys/class/net/${iface}/bridge" ] && return 0 || return 1
 }
 
 iface_is_bond() {
-    local iface=$1
+    local iface="$1"
     [ -e "/sys/class/net/${iface}/bonding" ] && return 0 || return 1
 }
 
 iface_is_hfi1() {
-    local iface=$1
-    driver=$(readlink /sys/class/net/${iface}/device/driver)
-    [[ $(basename ${driver}) =~ "hfi1" ]] && return 0 || return 1
+    local iface="$1"
+    driver=$(readlink "/sys/class/net/${iface}/device/driver")
+    [[ $(basename "${driver}") =~ "hfi1" ]] && return 0 || return 1
 }
 
 vlan_get_phy() {
-    local iface=$1
+    local iface="$1"
     sed -ne "s/^${iface} .*| *//p" < /proc/net/vlan/config
 }
 
 bridge_is_stp_enabled() {
-    local iface=$1
+    local iface="$1"
     local stp
     read stp < "/sys/class/net/${iface}/bridge/stp_state"
     [ "${stp}" = "1" ] && return 0 || return 1
 }
 
 bridge_get_root_ports() {
-    local bridge=$1
+    local bridge="$1"
     local root_id
     local root_ports=""
     local bridge_id
@@ -334,7 +334,7 @@ bridge_get_root_ports() {
 #define BR_STATE_BLOCKING 4
 
 bridge_get_active_ports() {
-    local bridge=$1
+    local bridge="$1"
     shift 1
     local ports="$*"
     local active_ports=""
@@ -342,11 +342,11 @@ bridge_get_active_ports() {
     local stp_state
     local warn=0
 
-    bridge_is_stp_enabled ${bridge}
+    bridge_is_stp_enabled "${bridge}"
     stp_state=$?
 
     if [ -z "${ports}" ] || [ "${ports}" = "detect" ] ; then
-        bridge_get_root_ports ${bridge} ports
+        bridge_get_root_ports "${bridge}" ports
     fi
 
     for port in $ports ; do
@@ -369,17 +369,17 @@ bridge_get_active_ports() {
 }
 
 bridge_get_speed() {
-    local iface=$1
+    local iface="$1"
     local aggregate_speed=0
 
-    if ! iface_is_bridge ${iface} ; then
+    if ! iface_is_bridge "${iface}" ; then
         echo 0
         return
     fi
 
     BGS_PORTS=$( bridge_get_active_ports "${iface}" "${OCF_RESKEY_bridge_ports}" )
     for port in ${BGS_PORTS} ; do
-        : $(( aggregate_speed += $( iface_get_speed ${port} ) ))
+        : $(( aggregate_speed += $( iface_get_speed "${port}" ) ))
     done
     if [ -n "$2" ] ; then # Record value in specified var. This expects we were called not in a sub-shell.
         eval "$2=\${aggregate_speed}"
@@ -389,7 +389,7 @@ bridge_get_speed() {
 }
 
 hfi1_get_speed() {
-    local iface=$1
+    local iface="$1"
     local hfi1_speed
     local hfi1_value
     local hfi1_desc
@@ -399,15 +399,15 @@ hfi1_get_speed() {
     # method to get the speed. Example output:
     # [root@es-host0 ~]# cat /sys/class/net/ib0/device/infiniband/*/ports/*/rate
     # 100 Gb/sec (4X EDR)
-    read hfi1_speed hfi1_value hfi1_desc < /sys/class/net/${iface}/device/infiniband/*/ports/*/rate
-    ocf_is_true ${OCF_RESKEY_debug} && ocf_log debug "Detected speed $hfi1_speed $hfi1_value $hfi1_desc"
+    read hfi1_speed hfi1_value hfi1_desc < "/sys/class/net/${iface}/device/infiniband"/*/ports/*/rate
+    ocf_is_true "${OCF_RESKEY_debug}" && ocf_log debug "Detected speed $hfi1_speed $hfi1_value $hfi1_desc"
 
     # hfi1_value always in Gb/sec, so we need to convert hfi1_speed in Mb/sec
     echo $(( hfi1_speed * 1000 ))
 }
 
 bond_get_slaves() {
-    local iface=$1
+    local iface="$1"
     local slaves
     read slaves < "/sys/class/net/${iface}/bonding/slaves"
     if [ -n "$2" ] ; then # Record value in specified var. This expects we were called not in a sub-shell.
@@ -418,7 +418,7 @@ bond_get_slaves() {
 }
 
 bond_get_active_iface() {
-    local iface=$1
+    local iface="$1"
     local active
     read active < "/sys/class/net/${iface}/bonding/active_slave"
     if [ -n "$2" ] ; then # Record value in specified var. This expects we were called not in a sub-shell.
@@ -429,10 +429,10 @@ bond_get_active_iface() {
 }
 
 bond_is_balancing() {
-    local iface=$1
+    local iface="$1"
     read mode mode_index < "/sys/class/net/${iface}/bonding/mode"
-    ocf_is_true ${OCF_RESKEY_debug} && ocf_log debug "Detected balancing $mode $mode_index"
-    case ${mode} in
+    ocf_is_true "${OCF_RESKEY_debug}" && ocf_log debug "Detected balancing $mode $mode_index"
+    case "${mode}" in
         "balance-rr"|"balance-xor"|"802.3ad"|"balance-tlb"|"balance-alb")
             return 0
             ;;
@@ -443,27 +443,27 @@ bond_is_balancing() {
 }
 
 bond_get_speed() {
-    local iface=$1
+    local iface="$1"
     local aggregate_speed=0
     local active_iface
     local bond_slaves
 
-    if ! iface_is_bond ${iface} ; then
+    if ! iface_is_bond "${iface}" ; then
         echo 0
         return
     fi
 
-    bond_get_slaves ${iface} bond_slaves
+    bond_get_slaves "${iface}" bond_slaves
 
-    if bond_is_balancing ${iface} ; then
+    if bond_is_balancing "${iface}" ; then
         for slave in ${bond_slaves} ; do
-            : $(( aggregate_speed += $( iface_get_speed ${slave} ) ))
+            : $(( aggregate_speed += $( iface_get_speed "${slave}" ) ))
         done
         # Bonding is unable to get speed*n
         : $(( aggregate_speed = aggregate_speed * 8 / 10 ))
     else
-        bond_get_active_iface ${iface} active_iface
-        aggregate_speed=$( iface_get_speed $active_iface )
+        bond_get_active_iface "${iface}" "active_iface"
+        aggregate_speed=$( iface_get_speed "$active_iface" )
     fi
     if [ -n "$2" ] ; then # Record value in specified var. This expects we were called not in a sub-shell.
         eval "$2=\${aggregate_speed}"
@@ -474,7 +474,7 @@ bond_get_speed() {
 
 update() {
     local speed;
-    local nic=${OCF_RESKEY_iface};
+    local nic="${OCF_RESKEY_iface}";
     if [ -z "${OCF_RESKEY_iface}" ]; then
         nic=$( get_nic_name_by_ip )
         if [ -z "${nic}" ];then
@@ -482,18 +482,18 @@ update() {
             exit $OCF_ERR_GENERIC
         fi
     fi
-    speed=$( iface_get_speed ${nic} )
+    speed=$( iface_get_speed "${nic}" )
 
     : $(( score = speed * ${OCF_RESKEY_weight_base} / 1000 ))
     if [ "$__OCF_ACTION" = "start" ] ; then
-        attrd_updater -n ${OCF_RESKEY_name} -B ${score} -d ${OCF_RESKEY_dampen} ${attrd_options}
+        attrd_updater -n "${OCF_RESKEY_name}" -B "${score}" -d "${OCF_RESKEY_dampen}" ${attrd_options}
     else
-        attrd_updater -n ${OCF_RESKEY_name} -v ${score} -d ${OCF_RESKEY_dampen} ${attrd_options}
+        attrd_updater -n "${OCF_RESKEY_name}" -v "${score}" -d "${OCF_RESKEY_dampen}" ${attrd_options}
     fi
     rc=$?
     case ${rc} in
         0)
-            ocf_is_true ${OCF_RESKEY_debug} && ocf_log debug "Updated ${OCF_RESKEY_name} = ${score}"
+            ocf_is_true "${OCF_RESKEY_debug}" && ocf_log debug "Updated ${OCF_RESKEY_name} = ${score}"
             ;;
         *)
             ocf_log warn "Could not update ${OCF_RESKEY_name} = ${score}: rc=${rc}"
@@ -521,13 +521,13 @@ fi
 : ${ha_pseudo_resource_name:="ifspeed-${OCF_RESOURCE_INSTANCE}"}
 
 attrd_options='-q'
-if ocf_is_true ${OCF_RESKEY_debug} ; then
+if ocf_is_true "${OCF_RESKEY_debug}" ; then
     attrd_options=''
 fi
 
 validate || exit $?
 
-case $__OCF_ACTION in
+case "$__OCF_ACTION" in
     start)
         start
         ;;
diff --git a/extra/resources/o2cb.in b/extra/resources/o2cb.in
index 1cc7fb3bb..2f54b825a 100755
--- a/extra/resources/o2cb.in
+++ b/extra/resources/o2cb.in
@@ -13,9 +13,9 @@
 
 #######################################################################
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 : ${OCF_RESKEY_stack:="pcmk"}
 : ${OCF_RESKEY_sysfs:="/sys/fs"}
@@ -54,7 +54,7 @@ driver_filesystem() {
 #
 check_filesystem()
 {
-    if [ "$#" != "2" -o -z "$1" -o -z "$2" ]
+    if [ $# != 2 -o -z "$1" -o -z "$2" ]
     then
         ocf_log err "check_filesystem(): Missing arguments"
         exit 4
@@ -76,7 +76,7 @@ check_filesystem()
 #
 unload_filesystem()
 {
-    if [ "$#" != "1" -o -z "$1" ]
+    if [ $# != 1 -o -z "$1" ]
     then
         ocf_log err "unload_filesystem(): Missing an argument"
         return 1
@@ -106,7 +106,7 @@ unload_filesystem()
     esac
 
     modprobe -rs "$FSNAME"
-    if [ "$?" != 0 ]; then
+    if [ $? != 0 ]; then
         ocf_log err "Unable to unload module: $FSNAME"
         return 1
     fi
@@ -177,7 +177,7 @@ kill_daemon()
 #
 unload_module()
 {
-    if [ "$#" -lt "1" -o -z "$1" ]
+    if [ $# -lt 1 -o -z "$1" ]
     then
         ocf_log err  "unload_module(): Requires an argument"
         return 1
@@ -203,7 +203,7 @@ unload_module()
     esac
 
     modprobe -rs "$MODNAME"
-    if [ "$?" != 0 ]; then
+    if [ $? != 0 ]; then
         ocf_log err "Unable to unload module \"$MODNAME\""
         return 1
     fi
@@ -258,7 +258,7 @@ o2cb_start() {
     driver_filesystem ocfs2; rc=$?
     if [ $rc != 0 ]; then
         modprobe -s ocfs2
-        if [ "$?" != 0 ]; then
+        if [ $? != 0 ]; then
             ocf_log err "Unable to load ocfs2 module"
             return $OCF_ERR_INSTALLED
         fi
@@ -356,7 +356,7 @@ o2cb_usage() {
 o2cb_validate() {
     check_binary ${DAEMON}
 
-    case ${OCF_RESKEY_CRM_meta_globally_unique} in
+    case "${OCF_RESKEY_CRM_meta_globally_unique}" in
         yes|Yes|true|True|1)
             ocf_log err "$OCF_RESOURCE_INSTANCE must be configured with the globally_unique=false meta attribute"
             exit $OCF_ERR_CONFIGURED
@@ -422,7 +422,7 @@ Number of seconds to allow the control daemon to come up
 END
 }
 
-case $__OCF_ACTION in
+case "$__OCF_ACTION" in
 meta-data)      meta_data
                 exit $OCF_SUCCESS
                 ;;
diff --git a/extra/resources/ping b/extra/resources/ping
index 6d64d4db3..f9e5d9be5 100755
--- a/extra/resources/ping
+++ b/extra/resources/ping
@@ -13,9 +13,9 @@
 #######################################################################
 # Initialization:
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 #######################################################################
 
@@ -137,9 +137,9 @@ END
 #######################################################################
 
 ping_conditional_log() {
-    level=$1; shift
-    if [ ${OCF_RESKEY_debug} = "true" ]; then
-        ocf_log $level "$*"
+    level="$1"; shift
+    if [ "${OCF_RESKEY_debug}" = "true" ]; then
+        ocf_log "$level" "$*"
     fi
 }
 
@@ -156,21 +156,21 @@ ping_start() {
     if [ $? =  $OCF_SUCCESS ]; then
         return $OCF_SUCCESS
     fi
-    touch ${OCF_RESKEY_pidfile}
+    touch "${OCF_RESKEY_pidfile}"
     ping_update
 }
 
 ping_stop() {
 
-    rm -f ${OCF_RESKEY_pidfile}
+    rm -f "${OCF_RESKEY_pidfile}"
 
-    attrd_updater -D -n $OCF_RESKEY_name -d $OCF_RESKEY_dampen $attrd_options
+    attrd_updater -D -n "$OCF_RESKEY_name" -d "$OCF_RESKEY_dampen" $attrd_options
 
     return $OCF_SUCCESS
 }
 
 ping_monitor() {
-    if [ -f ${OCF_RESKEY_pidfile} ]; then
+    if [ -f "${OCF_RESKEY_pidfile}" ]; then
         ping_update
         if [ $? -eq 0 ]; then
             return $OCF_SUCCESS
@@ -191,7 +191,7 @@ ping_validate() {
     rm "$state_dir/$$"
 
 # Pidfile better be an absolute path
-    case $OCF_RESKEY_pidfile in
+    case "$OCF_RESKEY_pidfile" in
         /*) ;;
         *) ocf_log warn "You should use an absolute path for pidfile not: $OCF_RESKEY_pidfile" ;;
     esac
@@ -261,7 +261,7 @@ ping_check() {
             *) ocf_log err "Unknown host type: `uname`"; exit $OCF_ERR_INSTALLED;;
         esac
 
-        case $host in
+        case "$host" in
             *:*) p_exe=ping6
         esac
 
@@ -288,9 +288,9 @@ ping_update() {
 
     score=`expr $active \* $OCF_RESKEY_multiplier`
     if [ "$__OCF_ACTION" = "start" ] ; then
-        attrd_updater -n $OCF_RESKEY_name -B $score -d $OCF_RESKEY_dampen $attrd_options
+        attrd_updater -n "$OCF_RESKEY_name" -B "$score" -d "$OCF_RESKEY_dampen" $attrd_options
     else
-        attrd_updater -n $OCF_RESKEY_name -v $score -d $OCF_RESKEY_dampen $attrd_options
+        attrd_updater -n "$OCF_RESKEY_name" -v "$score" -d "$OCF_RESKEY_dampen" $attrd_options
     fi
     rc=$?
     case $rc in
@@ -330,7 +330,7 @@ hosts_family() {
     # For fping allow only same IP versions or hostnames
     family=0
     for host in $OCF_RESKEY_host_list; do
-        host_family $host
+        host_family "$host"
         f=$?
         if [ $family -ne 0 ] && [ $f -ne 0 ] && [ $f -ne $family ] ; then
             family=99
@@ -353,14 +353,14 @@ hosts_family() {
 : ${OCF_RESKEY_CRM_meta_globally_unique:="false"}
 
 integer=`echo ${OCF_RESKEY_timeout} | egrep -o '[0-9]*'`
-case ${OCF_RESKEY_timeout} in
+case "${OCF_RESKEY_timeout}" in
     *[0-9]ms|*[0-9]msec) OCF_RESKEY_timeout=`expr $integer / 1000`;;
     *[0-9]m|*[0-9]min) OCF_RESKEY_timeout=`expr $integer \* 60`;;
     *[0-9]h|*[0-9]hr)  OCF_RESKEY_timeout=`expr $integer \* 60 \* 60`;;
     *) OCF_RESKEY_timeout=$integer;;
 esac
 
-if [ -z ${OCF_RESKEY_timeout} ]; then
+if [ -z "${OCF_RESKEY_timeout}" ]; then
     if [ x"$OCF_RESKEY_host_list" != x ]; then
         host_count=`echo $OCF_RESKEY_host_list | awk '{print NF}'`
         OCF_RESKEY_timeout=`expr $OCF_RESKEY_CRM_meta_timeout / $host_count / $OCF_RESKEY_attempts`
@@ -377,7 +377,7 @@ elif [ ${OCF_RESKEY_timeout} -gt 1000 ]; then
     OCF_RESKEY_timeout=300
 fi
 
-if [ ${OCF_RESKEY_CRM_meta_globally_unique} = "false" ]; then
+if [ "${OCF_RESKEY_CRM_meta_globally_unique}" = "false" ]; then
     : ${OCF_RESKEY_pidfile:="${HA_VARRUN%%/}/ping-${OCF_RESKEY_name}"}
 else
     : ${OCF_RESKEY_pidfile:="${HA_VARRUN%%/}/ping-${OCF_RESOURCE_INSTANCE}"}
@@ -394,11 +394,11 @@ case "${OCF_RESKEY_debug}" in
 esac
 
 attrd_options='-q'
-if [ ${OCF_RESKEY_debug} = "true" ]; then
+if [ "${OCF_RESKEY_debug}" = "true" ]; then
     attrd_options=''
 fi
 
-case $__OCF_ACTION in
+case "$__OCF_ACTION" in
 meta-data)      meta_data
                 exit $OCF_SUCCESS
                 ;;
diff --git a/extra/resources/pingd b/extra/resources/pingd
index cec8ccfa8..2cd7b629c 100755
--- a/extra/resources/pingd
+++ b/extra/resources/pingd
@@ -17,9 +17,9 @@
 #######################################################################
 # Initialization:
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 : ${OCF_RESKEY_name:="pingd"}
 : ${OCF_RESKEY_interval:="1"}
@@ -29,7 +29,7 @@ upgrade1="This agent (ocf:pacemaker:pingd) has been replaced by the more reliabl
 upgrade2="Attempting automated conversion, run 'crm ra info ocf:pacemaker:ping' for all configuration options"
 upgrade3="You will need to remove the existing resource and replace it with one that uses 'ocf:pacemaker:ping' directly"
 
-case $__OCF_ACTION in
+case "$__OCF_ACTION" in
     start|monitor)
         if [ "x" != "x$OCF_RESKEY_host_list" ]; then
             ocf_log err "$upgrade1"
@@ -39,9 +39,9 @@ case $__OCF_ACTION in
             exit $OCF_ERR_ARGS
         fi
 
-        recurring=`crm configure show $OCF_RESOURCE_INSTANCE | grep "op monitor.*interval=\"[1-9]" | sed s/.*interval=// | awk -F\" '{print $2}' | sed s/.*interval=// | awk -F\" '{print $2}' | sort | head -n 1`
+        recurring=`crm configure show "$OCF_RESOURCE_INSTANCE" | grep "op monitor.*interval=\"[1-9]" | sed s/.*interval=// | awk -F\" '{print $2}' | sed s/.*interval=// | awk -F\" '{print $2}' | sort | head -n 1`
 
-        if [ -z $recurring ]; then
+        if [ -z "$recurring" ]; then
             ocf_log err "$upgrade1"
             ocf_log err "$upgrade2"
             ocf_log err "Automatic conversion to ocf:pacemaker:ping failed: no monitor operation configured"
@@ -183,7 +183,7 @@ END
         ;;
 esac
 
-${OCF_ROOT}/resource.d/pacemaker/ping $1
+"${OCF_ROOT}/resource.d/pacemaker/ping" "$1"
 exit $?
 
 # vim: set filetype=sh expandtab tabstop=4 softtabstop=4 shiftwidth=4 textwidth=80:
diff --git a/extra/resources/remote b/extra/resources/remote
index 0a2d09e15..e571d820e 100755
--- a/extra/resources/remote
+++ b/extra/resources/remote
@@ -19,9 +19,9 @@
 #######################################################################
 # Initialization:
 
-: ${OCF_FUNCTIONS:=${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs}
-. ${OCF_FUNCTIONS}
-: ${__OCF_ACTION:=$1}
+: ${OCF_FUNCTIONS:="${OCF_ROOT}/resource.d/heartbeat/.ocf-shellfuncs"}
+. "${OCF_FUNCTIONS}"
+: ${__OCF_ACTION:="$1"}
 
 #######################################################################
 
-- 
2.26.2

