V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-08-07 19:24:19 +02:00
parent b677595f9d
commit 01501f92be
11 changed files with 46 additions and 42 deletions
--- a/func/cdi_4200_boot/4230_installation_grub.sh
+++ b/func/cdi_4200_boot/4230_installation_grub.sh
@@ -212,6 +212,14 @@ EOF

  [[ "${var_update_grub_required}" == "true" ]] && do_in_target "${TARGET}" update-grub

+  if [[ "${grub_force_efi}" == "true" ]]; then
+
+    mkdir -p "${TARGET}/boot/efi/EFI/BOOT"
+    cp "${TARGET}/boot/efi/EFI/debian/grubx64.efi" "${TARGET}/boot/efi/EFI/BOOT/BOOTX64.EFI"
+    do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [UEFI] on: Default EFI Boot-Path."
+
+  fi
+
  ### Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them.
  if [[ -f "${TARGET}/boot/grub/grub.cfg" ]]; then
    chown root:root "${TARGET}/boot/grub/grub.cfg"
@@ -309,14 +317,6 @@ install_grub_uefi() {
  do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [UEFI]."
  var_update_grub_required="true"

-  if [[ "${grub_force_efi}" == "true" ]]; then
-
-    mkdir -p "${TARGET}/boot/efi/EFI/BOOT"
-    cp "${TARGET}/boot/efi/EFI/debian/grubx64.efi" "${TARGET}/boot/efi/EFI/BOOT/BOOTX64.EFI"
-    do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [UEFI] on: Default EFI Boot-Path."
-
- fi
-
  return 0
 }

--- a/func/cdi_4300_network/4310_dropbear_build.sh
+++ b/func/cdi_4300_network/4310_dropbear_build.sh
@@ -32,6 +32,9 @@ dropbear_build() {
  declare     var_dropbear_version="2025.88"
  declare     var_tar="${VAR_SETUP_PATH}/upgrades/dropbear/dropbear-${var_dropbear_version}.tar.bz2"
  declare     var_build_dir="${DIR_TMP}/build/dropbear-${var_dropbear_version}"
+  declare -r  var_logfile="/root/.ciss/cdi/log/4310_dropbear_build.log"
+
+  touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"

  apt-get install -y autoconf automake build-essential libtool libtomcrypt-dev libtommath-dev musl-tools

@@ -49,12 +52,13 @@ dropbear_build() {
  #  -Wl,-z,relro,-z,now: Enables full RELRO (symbol resolution at program startup)

  [[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x
-  (
+  # shellcheck disable=SC2016,SC2312
+  setsid bash -c '
    ### Sterile environment for the build-process.
    export -n SHELLOPTS
    set +u
    unset PATH_SEPARATOR
-    PATH_SEPARATOR=':'
+    PATH_SEPARATOR=":"
    PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
    CC=musl-gcc \
      CFLAGS="-Os -fPIE -Wno-undef -fstack-protector-strong -D_FORTIFY_SOURCE=2" \
@@ -67,7 +71,7 @@ dropbear_build() {

    # shellcheck disable=2312
    make -j"$(nproc)"
-  )
+  ' 2>&1 | tee -a "${TARGET}${var_logfile}"
  [[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set -x

  do_log "info" "file_only" "4310() Ultra Hardened [dropbear-${var_dropbear_version}] build successfully from sources."
--- a/func/cdi_4300_network/4311_dropbear_initramfs.sh
+++ b/func/cdi_4300_network/4311_dropbear_initramfs.sh
@@ -37,7 +37,7 @@ dropbear_initramfs() {

  do_in_target_script "${TARGET}" '
    export INITRD=No
-    apt-mark hold -y dropbear dropbear-initramfs 2>&1 | tee -a '"${var_logfile}"'
+    apt-mark hold dropbear dropbear-initramfs 2>&1 | tee -a '"${var_logfile}"'
    echo ExitCode: $? >> '"${var_logfile}"'
  '

--- a/func/cdi_4300_network/4312_dropbear_setup.sh
+++ b/func/cdi_4300_network/4312_dropbear_setup.sh
@@ -15,26 +15,20 @@ guard_sourcing
 #######################################
 # Set up Dropbear Initramfs Environment.
 # Globals:
-#   HMP_PATH_ENCLABEL
 #   TARGET
-#   VAR_CRYPT_ROOT
 #   VAR_FINAL_FQDN
 #   VAR_FINAL_IPV4
 #   VAR_FINAL_IPV4_GW
 #   VAR_FINAL_IPV4_SUBNET
 #   VAR_FINAL_NIC
-#   VAR_GRUB_CMDLINE_LINUX
 #   VAR_SETUP_PATH
-#   dropbear_dhcp
 #   dropbear_firewall
 #   dropbear_port
+#   network_autoconfig_enable
 #   network_static_ipv4nameserver_0
 #   network_static_ipv4nameserver_1
 #   ssh_allow_ipv4_0
-#   user_root_ssh_pubkeys_0
-#   user_root_ssh_pubkeys_1
-#   user_root_ssh_pubkeys_2
-#   user_root_ssh_pubkeys_3
+#   user_root_sshpubkey
 # Arguments:
 #   None
 # Returns:
--- a/func/cdi_4300_network/4320_update_initramfs.sh
+++ b/func/cdi_4300_network/4320_update_initramfs.sh
@@ -34,7 +34,7 @@ update_initramfs() {


  do_in_target_script "${TARGET}" "
-    update-initramfs -u -v -k all 2>&1 | tee -a ${var_logfile}
+    update-initramfs -c -v -k all 2>&1 | tee -a ${var_logfile}
    echo ExitCode: \$? >> ${var_logfile}
  "

--- a/func/cdi_4400_hardening/4400_kernel_modules.sh
+++ b/func/cdi_4400_hardening/4400_kernel_modules.sh
@@ -38,7 +38,7 @@ kernel_modules() {
 jitterentropy_rng
 EOF
  chmod 0644 "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
-  do_log "info" "file_only" "Installed: '/usr/lib/modules-load.d/30_security-misc.conf'."
+  do_log "info" "file_only" "4400() Installed: '/usr/lib/modules-load.d/30_security-misc.conf'."
  return 0
 }

@@ -53,9 +53,9 @@ EOF
 #   0: on success
 #######################################
 setup_modprobe() {
- install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/etc/modprobe.d/0000_ciss_debian_installer.cnf" \
+ install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/modprobe.d/0000_ciss_debian_installer.cnf" \
    "${TARGET}/etc/modprobe.d/0000_ciss_debian_installer.conf"
-  do_log "info" "file_only" "Installed: '/etc/modprobe.d/0000_ciss_debian_installer.conf'."
+  do_log "info" "file_only" "4400() Installed: '/etc/modprobe.d/0000_ciss_debian_installer.conf'."
  return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/func/cdi_4400_hardening/4410_kernel_sysctl.sh
+++ b/func/cdi_4400_hardening/4410_kernel_sysctl.sh
@@ -23,9 +23,9 @@ guard_sourcing
 #   0: on success
 #######################################
 kernel_sysctl() {
-  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/sysctl.d/99_local.hardened.ini" \
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/sysctl.d/99_local.hardened.ini" \
    "${TARGET}/etc/sysctl.d/99_local.hardened"
-  do_log "info" "file_only" "Installed: '/etc/sysctl.d/99_local.hardened'."
+  do_log "info" "file_only" "4410() Installed: '/etc/sysctl.d/99_local.hardened'."
  return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/func/cdi_4400_hardening/4420_installation_ssh.sh
+++ b/func/cdi_4400_hardening/4420_installation_ssh.sh
@@ -31,18 +31,16 @@ guard_sourcing
 #   0: on success
 #######################################
 installation_ssh() {
-  do_in_target "${TARGET}" apt-get install -y ssh
-
-  #######################################
-  # Variable declaration
-  #######################################
+  ### Declare Arrays, HashMaps, and Variables.
  declare -a ary_user=()
-  declare -i i
+  declare -i i=0
  declare    var_auth="" var_name=""

-  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/banner" "${TARGET}/etc/"
-  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/motd" "${TARGET}/etc/"
-  do_log "info" "file_only" "Installed SSH banner and motd to '${TARGET}/etc/'."
+  do_in_target "${TARGET}" apt-get install -y --no-install-recommends --no-install-suggests ssh
+
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/banner" "${TARGET}/etc/"
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/motd" "${TARGET}/etc/"
+  do_log "info" "file_only" "4420() Installed SSH banner and motd to '${TARGET}/etc/'."

  ### Only process those for which both *_name and *_authentication_access_ssh are set.
  for ((i = 0; i <= VAR_USER_MAX; i++)); do
@@ -69,7 +67,7 @@ installation_ssh() {

  rm -f "${TARGET}/etc/ssh/sshd_config"

-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/etc/ssh/sshd_config" "${TARGET}/etc/ssh/sshd_config"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/ssh/sshd_config" "${TARGET}/etc/ssh/sshd_config"
  chmod 0600 "${TARGET}/etc/ssh/ssh_config"

  # shellcheck disable=SC2153
@@ -107,6 +105,8 @@ installation_ssh() {
  #echo "readonly HISTFILE" >> "${TARGET}/etc/profile.d/idle-users.sh"
  chmod +x "${TARGET}/etc/profile.d/idle-users.sh"

+  do_log "info" "file_only" "4420() Installed: [ssh] successfully."
+
  return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/func/cdi_4400_hardening/4430_installation_skel.sh
+++ b/func/cdi_4400_hardening/4430_installation_skel.sh
@@ -35,7 +35,7 @@ installation_skel() {
  echo 'set clipboard=unnamed' >| "${TARGET}/etc/skel/.vimrc"
  chmod 0644 "${TARGET}/etc/skel/.vimrc"

-  do_log "info" "file_only" "4095() Installed: '/etc/skel'-Files."
+  do_log "info" "file_only" "4430() Installed: [/etc/skel]-Files successfully."

  return 0
 }
--- a/includes/target/etc/modprobe.d/0000_ciss_debian_installer.cnf
+++ b/includes/target/etc/modprobe.d/0000_ciss_debian_installer.cnf
@@ -9,7 +9,7 @@
 # SPDX-PackageName: CISS.debian.installer
 # SPDX-Security-Contact: security@coresecret.eu

-### Version Master V8.03.864.2025.07.15
+### Version Master V8.00.000.2025.06.17

 # The kernel allows unprivileged users to indirectly cause certain modules to be loaded via module auto-loading. This allows an
 # attacker to auto-load a vulnerable module which is then exploited. One such example is CVE-2017-6074, in which an attacker
--- a/lib/cdi_0050_debug/0051_debug_var_dump.sh
+++ b/lib/cdi_0050_debug/0051_debug_var_dump.sh
@@ -44,6 +44,7 @@ dump_vars_exiting() {
  ### Capture the final snapshot of all variables (excluding '^(BASH|_).*').
  # shellcheck disable=SC2155
  declare var_dump_vars_final=$(mktemp var_dump_vars_final.XXXXXXXX)
+
  set +x
  # shellcheck disable=SC2312
  {
@@ -52,6 +53,7 @@ dump_vars_exiting() {
      declare -p "${var}" 2>/dev/null
    done < <(compgen -v | grep -Ev '^(BASH|_).*')
  } | sort >| "${var_dump_vars_final}"
+  set -x

  {
    printf "✅ CISS.debian.installer Config Variable Dump. \n"
@@ -60,15 +62,19 @@ dump_vars_exiting() {
    printf "===== Initial VAR Environment ===== \n"
  } >> "${LOG_VAR}"

+  set +x
  comm -23 "${VAR_DUMP_VARS_INITIAL}" "${var_dump_vars_final}" >> "${LOG_VAR}"  || true
+  set -x

  {
    printf "\n"
    printf "===== Final VAR Environment ===== \n"
  } >> "${LOG_VAR}"

+  set +x
  comm -13 "${VAR_DUMP_VARS_INITIAL}" "${var_dump_vars_final}" >> "${LOG_VAR}" || true
  set -x
+
  rm -f "${VAR_DUMP_VARS_INITIAL}" "${var_dump_vars_final}"
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh