V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 54s
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 54s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
56
.archive/func/4230_update_grub.sh
Normal file
56
.archive/func/4230_update_grub.sh
Normal file
@@ -0,0 +1,56 @@
|
||||
#!/bin/bash
|
||||
#######################################
|
||||
# Detects and collects all boot devices for GRUB installation.
|
||||
# Supports /dev/sdX, /dev/vdX, /dev/hdX, /dev/nvmeXn1, /dev/mmcblkX.
|
||||
# Globals:
|
||||
# VAR_RECIPE_HIGHEST_DEVICE
|
||||
# ary_bootdev_all
|
||||
# grub_bootdev
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
get_all_boot_devs() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -ag ary_bootdev_all=()
|
||||
declare dev="" dev_prefix="" dev_path="" letter=""
|
||||
declare -i ascii=0 ascii_end=0 ascii_start=0
|
||||
|
||||
### Determine prefix from grub_bootdev (e.g., "sd", "vd", "nvme", "mmcblk")
|
||||
dev_prefix=$(basename "${grub_bootdev}" | sed -E 's/^([a-z]+)[a-z0-9]*$/\1/')
|
||||
|
||||
case "${dev_prefix}" in
|
||||
|
||||
sd|vd|hd)
|
||||
ascii_start=$(printf '%d' "'a")
|
||||
ascii_end=$(printf '%d' "'${VAR_RECIPE_HIGHEST_DEVICE}")
|
||||
for ((ascii = ascii_start; ascii <= ascii_end; ascii++)); do
|
||||
letter=$(printf "%b" "\\$(printf '%03o' "${ascii}")")
|
||||
dev_path="/dev/${dev_prefix}${letter}"
|
||||
[[ -b "${dev_path}" ]] && ary_bootdev_all+=("${dev_path}")
|
||||
done
|
||||
;;
|
||||
|
||||
nvme)
|
||||
# shellcheck disable=SC2312
|
||||
while read -r dev; do
|
||||
ary_bootdev_all+=("/dev/${dev}")
|
||||
done < <(lsblk -dn -o NAME | grep -E '^nvme[0-9]+n1$')
|
||||
;;
|
||||
|
||||
mmcblk)
|
||||
# shellcheck disable=SC2312
|
||||
while read -r dev; do
|
||||
ary_bootdev_all+=("/dev/${dev}")
|
||||
done < <(lsblk -dn -o NAME | grep -E '^mmcblk[0-9]+$')
|
||||
;;
|
||||
|
||||
*)
|
||||
do_log "warning" "file_only" "4230() Unrecognized boot device prefix: ${dev_prefix}"
|
||||
;;
|
||||
|
||||
esac
|
||||
|
||||
return 0
|
||||
}
|
||||
@@ -48,7 +48,7 @@ recipe:
|
||||
version: "1.2.0"
|
||||
dev:
|
||||
sda:
|
||||
1:
|
||||
1: # MUST be always 'ESP' for [UEFI|GPT] or 'BIOS' for [BIOS|GPT].
|
||||
begin: "min"
|
||||
end: "1024MiB"
|
||||
bootable: false
|
||||
|
||||
@@ -404,7 +404,7 @@ grub_parameter:
|
||||
grub:
|
||||
background: # RECOMMENDED settings: JPG 1280 x 1024 px or JPG 1920 x 1080 px
|
||||
enable: true # If you want to add a GRUB background.
|
||||
path: "/root/CISS.2025.debian.installer/.assets/background/background_hexagon_1280.jpg"
|
||||
path: "/includes/target/etc/default/grub.d/hexagon.png"
|
||||
bootdev: "/dev/sda" # Due notably to potential USB sticks, the location of the primary drive cannot be determined
|
||||
# safely in general, so this needs to be specified.
|
||||
force_efi: false # Force GRUB installation to the EFI removable media path?
|
||||
@@ -549,8 +549,6 @@ software:
|
||||
# btrfs-progs
|
||||
# busybox
|
||||
# bzip2
|
||||
# cryptsetup
|
||||
# cryptsetup-initramfs
|
||||
# dirmngr
|
||||
# dmsetup
|
||||
# dosfstools
|
||||
@@ -594,6 +592,11 @@ software:
|
||||
##############################################################################################################################
|
||||
# chrony
|
||||
##############################################################################################################################
|
||||
### Installed by 4220_installation_cryptsetup.sh
|
||||
##############################################################################################################################
|
||||
# cryptsetup
|
||||
# cryptsetup-initramfs
|
||||
##############################################################################################################################
|
||||
### Installed by 4230_update_grub.sh
|
||||
##############################################################################################################################
|
||||
# grub2
|
||||
|
||||
@@ -19,7 +19,6 @@
|
||||
# TODO: Check Packages for installation. Refactor preseed.yaml, 4130_installation_toolset.sh, 4700_setup_packages.sh
|
||||
# TODO: What do we need for CISS environment?
|
||||
# TODO: Any changes to the NTPSec Servers?
|
||||
# TODO: Hibernate deactivation
|
||||
# TODO: Hardening Scripts Integration
|
||||
# TODO: SSH 2fa integration
|
||||
# TODO: Recovery Partition Integration
|
||||
@@ -257,6 +256,8 @@ echo "MAIN PROGRAM SEQUENCE: 4131_installation_systemd.sh ..."
|
||||
installation_systemd
|
||||
echo "MAIN PROGRAM SEQUENCE: 4132_installation_machineid.sh ..."
|
||||
installation_machineid
|
||||
echo "MAIN PROGRAM SEQUENCE: 4133_installation_masking.sh ..."
|
||||
installation_masking
|
||||
echo "MAIN PROGRAM SEQUENCE: 4140_installation_microcode.sh ..."
|
||||
installation_microcode
|
||||
echo "MAIN PROGRAM SEQUENCE: 4150_installation_chrony.sh ..."
|
||||
@@ -267,8 +268,8 @@ echo "MAIN PROGRAM SEQUENCE: 4200_generate_fstab.sh ..."
|
||||
generate_fstab
|
||||
echo "MAIN PROGRAM SEQUENCE: 4210_generate_crypttab.sh ..."
|
||||
generate_crypttab
|
||||
echo "MAIN PROGRAM SEQUENCE: 4220_update_initramfs.sh ..."
|
||||
update_initramfs
|
||||
echo "MAIN PROGRAM SEQUENCE: 4220_installation_cryptsetup.sh ..."
|
||||
installation_cryptsetup
|
||||
echo "MAIN PROGRAM SEQUENCE: 4230_update_grub.sh ..."
|
||||
update_grub # TODO: Checks ongoing
|
||||
echo "MAIN PROGRAM SEQUENCE: 4240_update_grub_password.sh ..."
|
||||
@@ -285,6 +286,8 @@ echo "MAIN PROGRAM SEQUENCE: 4311_dropbear_initramfs.sh ..."
|
||||
dropbear_initramfs
|
||||
echo "MAIN PROGRAM SEQUENCE: 4312_dropbear_setup.sh ..."
|
||||
dropbear_setup
|
||||
echo "MAIN PROGRAM SEQUENCE: 4320_update_initramfs.sh ..."
|
||||
update_initramfs
|
||||
|
||||
### CDI_4400
|
||||
echo "MAIN PROGRAM SEQUENCE: 4400_kernel_modules.sh ..."
|
||||
|
||||
@@ -62,16 +62,31 @@ yaml_parser() {
|
||||
fi
|
||||
done < <(compgen -v)
|
||||
|
||||
### Delete the respective 'key:value'-variables in the global variable set.
|
||||
sed -i '/^grub_parameter_[0-9]\+=/d' "${VAR_PRESEED}"
|
||||
sed -i '/^locale_locale_[0-9]\+=/d' "${VAR_PRESEED}"
|
||||
sed -i '/^ntp_server_[0-9]\+=/d' "${VAR_PRESEED}"
|
||||
sed -i '/^software_[0-9]\+=/d' "${VAR_PRESEED}"
|
||||
### Remove obsolete variables, normalize empty assignments, wrap remaining values in single quotes
|
||||
sed -i -E '
|
||||
# --- Deletions --------------------------------------------------------
|
||||
/^grub_parameter_[0-9]+=/d # delete grub parameter variables
|
||||
/^locale_locale_[0-9]+=/d # delete locale variables
|
||||
/^ntp_server_[0-9]+=/d # delete NTP server variables
|
||||
/^software_[0-9]+=/d # delete software list variables
|
||||
|
||||
### Substitute all key= by key=""
|
||||
sed -i -E 's/^(.*)=\s*$/\1=""/' "${VAR_PRESEED}"
|
||||
### Wrap each key=value by '' e.g., key='value'
|
||||
sed -i -E "s/^(.*)=([^'\"]+)$/\1='\2'/" "${VAR_PRESEED}"
|
||||
# --- Empty-value normalisation ---------------------------------------
|
||||
s/^(.*)=\s*$/\1=""/ # turn key= into key=""
|
||||
|
||||
# --- Quote unquoted values -------------------------------------------
|
||||
s/^(.*)=([^'\''"]+)/\1='\''\2'\''/ # wrap value in single quotes
|
||||
' "${VAR_PRESEED}"
|
||||
|
||||
# ### Delete the respective 'key:value'-variables in the global variable set.
|
||||
# sed -i '/^grub_parameter_[0-9]\+=/d' "${VAR_PRESEED}"
|
||||
# sed -i '/^locale_locale_[0-9]\+=/d' "${VAR_PRESEED}"
|
||||
# sed -i '/^ntp_server_[0-9]\+=/d' "${VAR_PRESEED}"
|
||||
# sed -i '/^software_[0-9]\+=/d' "${VAR_PRESEED}"
|
||||
|
||||
# ### Substitute all key= by key=""
|
||||
# sed -i -E 's/^(.*)=\s*$/\1=""/' "${VAR_PRESEED}"
|
||||
# ### Wrap each key=value by '' e.g., key='value'
|
||||
# sed -i -E "s/^(.*)=([^'\"]+)$/\1='\2'/" "${VAR_PRESEED}"
|
||||
|
||||
# shellcheck disable=SC1090
|
||||
. "${VAR_PRESEED}"
|
||||
|
||||
@@ -164,7 +164,7 @@ END { print max }
|
||||
|
||||
elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
|
||||
|
||||
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
|
||||
do_log "warn" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
|
||||
|
||||
elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
|
||||
|
||||
|
||||
@@ -69,7 +69,7 @@ partitioning() {
|
||||
|
||||
declare -a ary_devs=() ary_parts=() ary_paths_unsorted=()
|
||||
|
||||
declare -i i=0 var_dev_size=0 var_dev_end=0
|
||||
declare -i i=0 var_dev_size=0 var_dev_end=0 var_multi_boot=0 var_multi_esp=0
|
||||
|
||||
### Iterate over all devices in the recipe.
|
||||
# shellcheck disable=SC2312
|
||||
|
||||
@@ -191,6 +191,7 @@ partition_encryption() {
|
||||
var_uuid=$(blkid -s UUID -o value "/dev/${var_dev}")
|
||||
|
||||
[[ "${var_encryption_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
|
||||
[[ "${var_encryption_path}" == "/boot" ]] && declare -grx VAR_CRYPT_BOOT="${var_uuid}"
|
||||
[[ "${var_encryption_path}" == "/recovery" ]] && declare -grx VAR_CRYPT_RECOVERY="${var_uuid}"
|
||||
|
||||
HMP_PATH_LUKSUUID["${var_encryption_path}"]="${var_uuid}"
|
||||
|
||||
@@ -42,8 +42,6 @@ installation_toolset() {
|
||||
[echo]="coreutils"
|
||||
[ln]="coreutils"
|
||||
[mkdir]="coreutils"
|
||||
[cryptsetup]="cryptsetup"
|
||||
[cryptsetup-initramfs]="cryptsetup-initramfs"
|
||||
[curl]="curl"
|
||||
[dirmngr]="dirmngr"
|
||||
[dmsetup]="dmsetup"
|
||||
33
func/cdi_4100_base/4133_installation_masking.sh
Normal file
33
func/cdi_4100_base/4133_installation_masking.sh
Normal file
@@ -0,0 +1,33 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Turn off Energy saving mode and ctrl-alt-del.
|
||||
# Globals:
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
installation_masking() {
|
||||
do_in_target_script "${TARGET}" "
|
||||
systemctl mask ctrl-alt-del.target sleep.target suspend.target hibernate.target hybrid-sleep.target
|
||||
"
|
||||
|
||||
do_log "info" "file_only" "4133() Masked: [ctrl-alt-del.target sleep.target suspend.target hibernate.target hybrid-sleep.target]."
|
||||
|
||||
return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -199,6 +199,8 @@ tmpfs /run tmpfs
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=200 ft=sh
|
||||
EOF
|
||||
|
||||
do_log "info" "file_only" "4200() fstab generated successfully."
|
||||
|
||||
return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -136,6 +136,8 @@ EOF
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=200 ft=sh
|
||||
EOF
|
||||
|
||||
do_log "info" "file_only" "4210() crypttab generated successfully."
|
||||
|
||||
return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
37
func/cdi_4200_boot/4220_installation_cryptsetup.sh
Normal file
37
func/cdi_4200_boot/4220_installation_cryptsetup.sh
Normal file
@@ -0,0 +1,37 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Installation of 'cryptsetup' and 'cryptsetup-initramfs' after '/etc/crypttab' generation.
|
||||
# Globals:
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
installation_cryptsetup() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -r var_logfile="/root/.ciss/cdi/log/4220_installation_cryptsetup.log"
|
||||
|
||||
touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"
|
||||
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get install -y --no-install-recommends --no-install-suggests cryptsetup cryptsetup-initramfs 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -27,29 +27,30 @@ guard_sourcing
|
||||
# Installation and setup of the GRUB2 (backported) version.
|
||||
# The backported version MUST be installed for LUKS2 '/boot' encryption.
|
||||
# Globals:
|
||||
# ERR_GRUB_BACKGROUND
|
||||
# ERR_GRUB_EFI_FORCE
|
||||
# TARGET
|
||||
# VAR_ARCHITECTURE
|
||||
# VAR_RECIPE_FIRMWARE
|
||||
# VAR_RECIPE_TABLE
|
||||
# VAR_SETUP_PATH
|
||||
# grub_background_enable
|
||||
# grub_background_path
|
||||
# grub_bootdev
|
||||
# grub_force_efi
|
||||
# grub_latest
|
||||
# grub_prober
|
||||
# grub_skip
|
||||
# var_update_grub_required
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
# ERR_GRUB_BACKGROUND
|
||||
# ERR_GRUB_EFI_FORCE
|
||||
# 0: on success
|
||||
#######################################
|
||||
update_grub() {
|
||||
declare -gx var_update_grub_required="false"
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -g var_update_grub_required="false" grub_update_nvram=${grub_update_nvram:-false}
|
||||
declare -r var_logfile="/root/.ciss/cdi/log/4230_update_grub.log"
|
||||
declare var_background=""
|
||||
|
||||
get_all_boot_devs
|
||||
touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"
|
||||
|
||||
if [[ "${grub_skip,,}" != "true" ]]; then
|
||||
|
||||
@@ -60,15 +61,15 @@ update_grub() {
|
||||
if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
|
||||
|
||||
case "${VAR_ARCHITECTURE,,}" in
|
||||
amd64) do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-efi-amd64 ;;
|
||||
arm64) do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-efi-arm64 ;;
|
||||
i386) do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-efi-ia32 ;;
|
||||
*) do_log "emergency" "file_only" "4140() Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
|
||||
amd64) do_in_target "${TARGET}" apt-get install -y --no-install-recommends -t bookworm-backports grub2 grub2-common grub-efi-amd64 ;;
|
||||
arm64) do_in_target "${TARGET}" apt-get install -y --no-install-recommends -t bookworm-backports grub2 grub2-common grub-efi-arm64 ;;
|
||||
i386) do_in_target "${TARGET}" apt-get install -y --no-install-recommends -t bookworm-backports grub2 grub2-common grub-efi-ia32 ;;
|
||||
*) do_log "emergency" "file_only" "4230() Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
|
||||
esac
|
||||
|
||||
else
|
||||
|
||||
do_in_target "${TARGET}" apt-get install -y -t bookworm-backports grub2 grub2-common grub-pc
|
||||
do_in_target "${TARGET}" apt-get install -y --no-install-recommends -t bookworm-backports grub2 grub2-common grub-pc
|
||||
|
||||
fi
|
||||
|
||||
@@ -78,46 +79,28 @@ update_grub() {
|
||||
if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
|
||||
|
||||
case "${VAR_ARCHITECTURE,,}" in
|
||||
amd64) do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-efi-amd64 ;;
|
||||
arm64) do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-efi-arm64 ;;
|
||||
i386) do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-efi-ia32 ;;
|
||||
*) do_log "emergency" "file_only" "4140() Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
|
||||
amd64) do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-efi-amd64 ;;
|
||||
arm64) do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-efi-arm64 ;;
|
||||
i386) do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-efi-ia32 ;;
|
||||
*) do_log "emergency" "file_only" "4230() Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
|
||||
esac
|
||||
|
||||
else
|
||||
|
||||
do_in_target "${TARGET}" apt-get install -y grub2 grub2-common grub-pc
|
||||
do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-pc
|
||||
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
### Install grub on the specific device.
|
||||
if [[ "${grub_force_efi,,}" == "false" ]]; then
|
||||
|
||||
if [[ "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
|
||||
|
||||
install_grub_uefi_all
|
||||
install_grub_uefi
|
||||
|
||||
elif [[ "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
|
||||
|
||||
install_grub_bios_all
|
||||
|
||||
fi
|
||||
|
||||
elif [[ "${grub_force_efi,,}" == "true" ]]; then
|
||||
|
||||
if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
|
||||
|
||||
do_in_target "${TARGET}" grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=Debian --no-nvram --modules="btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 part_gpt" --force-extra-removable
|
||||
var_update_grub_required="true"
|
||||
|
||||
else
|
||||
|
||||
do_log "emergency" "file_only" "4140() Unsupported combination of partition table: '${VAR_RECIPE_TABLE,,}' and setting: grub_force_efi '${grub_force_efi,,}'."
|
||||
return "${ERR_GRUB_EFI_FORCE}"
|
||||
|
||||
fi
|
||||
install_grub_bios
|
||||
|
||||
fi
|
||||
|
||||
@@ -134,10 +117,9 @@ EOF
|
||||
### Install a boot menu background.
|
||||
if [[ "${grub_background_enable,,}" == "true" ]]; then
|
||||
|
||||
declare var_background
|
||||
var_background=$(basename "${grub_background_path}")
|
||||
cp --no-preserve=ownership "${grub_background_path}" "${TARGET}/etc/default/grub.d/${var_background}" || return "${ERR_GRUB_BACKGROUND}"
|
||||
chmod 0640 "${TARGET}/etc/default/grub.d/${var_background}" || return "${ERR_GRUB_BACKGROUND}"
|
||||
install -m 0640 -o root -g root "${VAR_SETUP_PATH}${grub_background_path}" "${TARGET}/etc/default/grub.d/${var_background}"
|
||||
|
||||
cat << EOF >> "${TARGET}/etc/default/grub"
|
||||
# Enable boot menu background.
|
||||
GRUB_BACKGROUND="/etc/default/grub.d/${var_background}"
|
||||
@@ -154,7 +136,7 @@ EOF
|
||||
|
||||
fi
|
||||
|
||||
### Change GRUB OS detection configuration accordingly.
|
||||
### Change the GRUB OS detection configuration accordingly.
|
||||
if [[ "${grub_prober,,}" == "true" ]]; then
|
||||
|
||||
cat << EOF >> "${TARGET}/etc/default/grub"
|
||||
@@ -187,152 +169,104 @@ EOF
|
||||
|
||||
else
|
||||
|
||||
do_log "info" "file_only" "414() GRUB2 setup skipped."
|
||||
do_log "info" "file_only" "4230() GRUB2 setup skipped."
|
||||
|
||||
fi
|
||||
|
||||
[[ "${var_update_grub_required}" == "true" ]] && do_in_target "${TARGET}" update-grub
|
||||
|
||||
### Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them.
|
||||
if [[ -f "${TARGET}/boot/grub/grub.cfg" ]]; then
|
||||
chown root:root "${TARGET}/boot/grub/grub.cfg"
|
||||
chmod 0640 "${TARGET}/boot/grub/grub.cfg"
|
||||
fi
|
||||
chmod -R 0700 "${TARGET}/etc/grub.d"
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
#######################################
|
||||
# Detects and collects all boot devices for GRUB installation.
|
||||
# Supports /dev/sdX, /dev/vdX, /dev/hdX, /dev/nvmeXn1, /dev/mmcblkX.
|
||||
# Installs GRUB to BIOS in BIOS mode.
|
||||
# Globals:
|
||||
# VAR_RECIPE_HIGHEST_DEVICE
|
||||
# ary_bootdev_all
|
||||
# TARGET
|
||||
# grub_bootdev
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
get_all_boot_devs() {
|
||||
declare -ag ary_bootdev_all=()
|
||||
declare dev="" dev_prefix="" dev_path="" letter=""
|
||||
declare -i ascii=0 ascii_end=0 ascii_start=0
|
||||
|
||||
### Determine prefix from grub_bootdev (e.g., "sd", "vd", "nvme", "mmcblk")
|
||||
dev_prefix=$(basename "${grub_bootdev}" | sed -E 's/^([a-z]+)[a-z0-9]*$/\1/')
|
||||
|
||||
case "${dev_prefix}" in
|
||||
|
||||
sd|vd|hd)
|
||||
ascii_start=$(printf '%d' "'a")
|
||||
ascii_end=$(printf '%d' "'${VAR_RECIPE_HIGHEST_DEVICE}")
|
||||
for ((ascii = ascii_start; ascii <= ascii_end; ascii++)); do
|
||||
letter=$(printf "%b" "\\$(printf '%03o' "${ascii}")")
|
||||
dev_path="/dev/${dev_prefix}${letter}"
|
||||
[[ -b "${dev_path}" ]] && ary_bootdev_all+=("${dev_path}")
|
||||
done
|
||||
;;
|
||||
|
||||
nvme)
|
||||
# shellcheck disable=SC2312
|
||||
while read -r dev; do
|
||||
ary_bootdev_all+=("/dev/${dev}")
|
||||
done < <(lsblk -dn -o NAME | grep -E '^nvme[0-9]+n1$')
|
||||
;;
|
||||
|
||||
mmcblk)
|
||||
# shellcheck disable=SC2312
|
||||
while read -r dev; do
|
||||
ary_bootdev_all+=("/dev/${dev}")
|
||||
done < <(lsblk -dn -o NAME | grep -E '^mmcblk[0-9]+$')
|
||||
;;
|
||||
|
||||
*)
|
||||
do_log "warning" "file_only" "Unrecognized boot device prefix: ${dev_prefix}"
|
||||
;;
|
||||
|
||||
esac
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
#######################################
|
||||
# Installs GRUB in BIOS mode on all block devices.
|
||||
# Globals:
|
||||
# TARGET
|
||||
# VAR_RECIPE_TABLE
|
||||
# ary_bootdev_all
|
||||
# var_update_grub_required
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
# ERR_PARTITIONTBL on failure
|
||||
# ERR_GRUB_INSTALL
|
||||
#######################################
|
||||
install_grub_bios_all() {
|
||||
declare dev="" partmod=""
|
||||
install_grub_bios() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -a ary_bios_arg=()
|
||||
declare var_bios_mod=""
|
||||
|
||||
case "${VAR_RECIPE_TABLE,,}" in
|
||||
gpt) partmod="part_gpt" ;;
|
||||
msdos|mbr) partmod="part_msdos" ;;
|
||||
*) do_log "emergency" "file_only" "4140() Unknown partition table type: '${VAR_RECIPE_TABLE}'."; return "${ERR_PARTITIONTBL}" ;;
|
||||
esac
|
||||
### Cryptographic modules.
|
||||
var_bios_mod+="cryptodisk gcry_rijndael gcry_sha256 gcry_sha512 gcry_whirlpool gcry_serpent gcry_twofish luks luks2"
|
||||
### Filesystem modules.
|
||||
var_bios_mod+="btrfs ext2"
|
||||
### Partitioning / Device / GPT
|
||||
var_bios_mod+="biosdisk mdraid1x part_gpt"
|
||||
### Device / Terminal modules.
|
||||
var_bios_mod+="boot linux efi_gop efi_uga gfxterm gfxterm_background gfxterm_menu normal search search_fs_uuid search_label"
|
||||
### Debug modules.
|
||||
var_bios_mod+="cat echo hexdump ls test terminfo"
|
||||
|
||||
declare var_modules="biosdisk btrfs cryptodisk luks2 gcry_rijndael gcry_sha256 gcry_sha512 ${partmod}"
|
||||
declare -a args=(--target=i386-pc --boot-directory=/boot "--modules=${var_modules}")
|
||||
args+=(--recheck)
|
||||
ary_bios_arg+=( --target=i386-pc --boot-directory=/boot "--modules=${var_bios_mod}" )
|
||||
|
||||
for dev in "${ary_bootdev_all[@]}"; do
|
||||
do_in_target "${TARGET}" grub-install "${args[@]}" "${dev}"
|
||||
do_log "info" "file_only" "Installed: GRUB on Device: '${dev}' (BIOS)."
|
||||
do_in_target "${TARGET}" grub-install "${ary_bios_arg[@]}" "${grub_bootdev}" || return "${ERR_GRUB_INSTALL}"
|
||||
do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [BIOS]."
|
||||
var_update_grub_required="true"
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
#######################################
|
||||
# Installs GRUB to all ESPs in UEFI mode.
|
||||
# Installs GRUB to ESP in UEFI mode.
|
||||
# Globals:
|
||||
# TARGET
|
||||
# VAR_RECIPE_TABLE
|
||||
# ary_bootdev_all
|
||||
# grub_bootdev
|
||||
# grub_force_efi
|
||||
# grub_update_nvram
|
||||
# var_update_grub_required
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
# ERR_PARTITIONTBL on failure
|
||||
# ERR_GRUB_INSTALL
|
||||
#######################################
|
||||
install_grub_uefi_all() {
|
||||
install_grub_uefi() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -a ary_uefi_arg=()
|
||||
declare var_uefi_dev="" var_uefi_mod=""
|
||||
declare var_uefi_mod=""
|
||||
|
||||
### Cryptographic modules.
|
||||
var_uefi_mod+="cryptodisk gcry_rijndael gcry_sha256 gcry_sha512 gcry_whirlpool gcry_serpent gcry_twofish luks luks2"
|
||||
### Filesystem modules.
|
||||
var_uefi_mod+="btrfs ext2"
|
||||
### Partitioning / Device / GPT
|
||||
var_uefi_mod+="biosdisk mdraid1x part_gpt part_msdos"
|
||||
var_uefi_mod+="mdraid1x part_gpt"
|
||||
### Device / Terminal modules.
|
||||
var_uefi_mod+="boot linux efi_gop efi_uga gfxterm gfxterm_background gfxterm_menu normal search search_fs_uuid search_label"
|
||||
### Debug modules.
|
||||
var_uefi_mod+="cat echo hexdump ls test terminfo"
|
||||
|
||||
[[ "${grub_force_efi,,}" == "true" ]] && ary_uefi_arg+=( --force-extra-removable )
|
||||
ary_uefi_arg+=( --target=x86_64-efi --boot-directory=/boot --efi-directory=/boot/efi --bootloader-id=debian "--modules=${var_uefi_mod}" )
|
||||
|
||||
[[ "${grub_update_nvram,,}" == "false" ]] && ary_uefi_arg+=( --no-nvram )
|
||||
|
||||
ary_uefi_arg+=( --target=x86_64-efi --boot-directory=/boot --efi-directory=/boot/efi --bootloader-id=Debian "--modules=${var_uefi_mod}" )
|
||||
|
||||
for var_uefi_dev in "${ary_bootdev_all[@]}"; do
|
||||
|
||||
ary_uefi_arg+=( "--recheck ${var_uefi_dev}" )
|
||||
do_in_target "${TARGET}" grub-install "${ary_uefi_arg[@]}"
|
||||
do_log "info" "file_only" "4140() Installed: GRUB on Device: '${var_uefi_dev}' (UEFI)."
|
||||
do_in_target "${TARGET}" grub-install "${ary_uefi_arg[@]}" "${grub_bootdev}" || return "${ERR_GRUB_INSTALL}"
|
||||
do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [UEFI]."
|
||||
var_update_grub_required="true"
|
||||
|
||||
done
|
||||
if [[ "${grub_force_efi,,}" == "true" ]]; then
|
||||
|
||||
mkdir -p "${TARGET}/boot/efi/EFI/BOOT"
|
||||
cp "${TARGET}/boot/efi/EFI/debian/grubx64.efi" "${TARGET}/boot/efi/EFI/BOOT/BOOTX64.EFI"
|
||||
do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [UEFI] on: Default EFI Boot-Path."
|
||||
|
||||
fi
|
||||
|
||||
return 0
|
||||
}
|
||||
@@ -13,7 +13,7 @@
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Append GRUB superuser block to '/etc/grub.d/40_custom'.
|
||||
# Append the GRUB superuser block to '/etc/grub.d/40_custom'.
|
||||
# Globals:
|
||||
# DIR_CNF
|
||||
# ERR_READ_GRUB_FILE
|
||||
@@ -26,11 +26,8 @@ guard_sourcing
|
||||
# ERR_READ_GRUB_FILE
|
||||
#######################################
|
||||
update_grub_password() {
|
||||
declare var_username="superadmin"
|
||||
declare var_password=""
|
||||
declare var_password_file="${DIR_CNF}/password_grub.txt"
|
||||
declare var_of="${TARGET}/etc/grub.d/40_custom"
|
||||
declare var_grub_entry
|
||||
declare var_username="superadmin" var_password="" var_password_file="${DIR_CNF}/password_grub.txt" \
|
||||
var_of="${TARGET}/etc/grub.d/40_custom" var_grub_entry=""
|
||||
|
||||
### No tracing for security reasons
|
||||
[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x
|
||||
@@ -16,14 +16,21 @@ guard_sourcing
|
||||
# Calling 'update-initramfs -u -v -k all' inside Target.
|
||||
# Globals:
|
||||
# TARGET
|
||||
# VAR_ARCHITECTURE
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
update_initramfs() {
|
||||
do_in_target "${TARGET}" update-initramfs -u -v -k all
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -r var_logfile="/root/.ciss/cdi/log/4320_update_initramfs.log"
|
||||
|
||||
touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"
|
||||
|
||||
do_in_target_script "${TARGET}" "
|
||||
update-initramfs -u -v -k all 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
return 0
|
||||
}
|
||||
|
Before Width: | Height: | Size: 1.7 MiB After Width: | Height: | Size: 1.7 MiB |
|
Before Width: | Height: | Size: 776 KiB After Width: | Height: | Size: 776 KiB |
@@ -60,11 +60,13 @@ check_kernel() {
|
||||
((counter++))
|
||||
done < "${VAR_KERNEL_SRT}"
|
||||
|
||||
export NCURSES_NO_ALTSCREEN=1
|
||||
# shellcheck disable=SC2034
|
||||
if VAR_KERNEL=$(dialog \
|
||||
--no-collapse \
|
||||
--ascii-lines \
|
||||
--clear \
|
||||
--help-button \
|
||||
--backtitle "CISS.debian.installer" \
|
||||
--title "Select the Kernel for the CISS.debian.installer" \
|
||||
--radiolist "Kernel available \n *+bpo* : Debian Backported Kernel \n *cloud* : Special lightweight images for KVM \n *unsigned* : Unsigned Kernel \n *preempt_rt* : Special Kernel for real-time-computing \n Not unsigned marked are MS signed Kernel for Secure Boot \n" 0 0 "${options[@]}" 3>&1 1>&2 2>&3 3>&-); then
|
||||
|
||||
@@ -48,28 +48,30 @@ source_guard "./func/cdi_4000_debootstrap/4040_setup_timezone.sh"
|
||||
source_guard "./func/cdi_4000_debootstrap/4050_setup_locales.sh"
|
||||
|
||||
### cdi_4100_base_installation
|
||||
source_guard "./func/cdi_4100_base_installation/4100_generate_sources.sh"
|
||||
source_guard "./func/cdi_4100_base_installation/4110_update_sources.sh"
|
||||
source_guard "./func/cdi_4100_base_installation/4120_installation_kernel.sh"
|
||||
source_guard "./func/cdi_4100_base_installation/4130_installation_toolset.sh"
|
||||
source_guard "./func/cdi_4100_base_installation/4131_installation_systemd.sh"
|
||||
source_guard "./func/cdi_4100_base_installation/4132_installation_machineid.sh"
|
||||
source_guard "./func/cdi_4100_base_installation/4140_installation_microcode.sh"
|
||||
source_guard "./func/cdi_4100_base_installation/4150_installation_chrony.sh"
|
||||
source_guard "./func/cdi_4100_base/4100_generate_sources.sh"
|
||||
source_guard "./func/cdi_4100_base/4110_update_sources.sh"
|
||||
source_guard "./func/cdi_4100_base/4120_installation_kernel.sh"
|
||||
source_guard "./func/cdi_4100_base/4130_installation_toolset.sh"
|
||||
source_guard "./func/cdi_4100_base/4131_installation_systemd.sh"
|
||||
source_guard "./func/cdi_4100_base/4132_installation_machineid.sh"
|
||||
source_guard "./func/cdi_4100_base/4133_installation_masking.sh"
|
||||
source_guard "./func/cdi_4100_base/4140_installation_microcode.sh"
|
||||
source_guard "./func/cdi_4100_base/4150_installation_chrony.sh"
|
||||
|
||||
### cdi_4200_boot_installation
|
||||
source_guard "./func/cdi_4200_boot_installation/4200_generate_fstab.sh"
|
||||
source_guard "./func/cdi_4200_boot_installation/4210_generate_crypttab.sh"
|
||||
source_guard "./func/cdi_4200_boot_installation/4220_update_initramfs.sh"
|
||||
source_guard "./func/cdi_4200_boot_installation/4230_update_grub.sh"
|
||||
source_guard "./func/cdi_4200_boot_installation/4240_update_grub_password.sh"
|
||||
source_guard "./func/cdi_4200_boot_installation/4250_update_grub_bootparameter.sh"
|
||||
source_guard "./func/cdi_4200_boot/4200_generate_fstab.sh"
|
||||
source_guard "./func/cdi_4200_boot/4210_generate_crypttab.sh"
|
||||
source_guard "./func/cdi_4200_boot/4220_installation_cryptsetup.sh"
|
||||
source_guard "./func/cdi_4200_boot/4230_update_grub.sh"
|
||||
source_guard "./func/cdi_4200_boot/4240_update_grub_password.sh"
|
||||
source_guard "./func/cdi_4200_boot/4250_update_grub_bootparameter.sh"
|
||||
|
||||
### cdi_4300_network
|
||||
source_guard "./func/cdi_4300_network/4300_installation_network.sh"
|
||||
source_guard "./func/cdi_4300_network/4310_dropbear_build.sh"
|
||||
source_guard "./func/cdi_4300_network/4311_dropbear_initramfs.sh"
|
||||
source_guard "./func/cdi_4300_network/4312_dropbear_setup.sh"
|
||||
source_guard "./func/cdi_4300_network/4320_update_initramfs.sh"
|
||||
|
||||
### cdi_4400_hardening
|
||||
source_guard "./func/cdi_4400_hardening/4400_kernel_modules.sh"
|
||||
|
||||
@@ -40,16 +40,16 @@ declare -girx ERR_MOUNTING_DEV=233 # The Device could not be mounted.
|
||||
declare -girx ERR_MOUNTING_ROOT=232 # The '/' Volume could not be mounted.
|
||||
declare -girx ERR_MOUNTING_LUKS=231 # The LUKS Volume could not be mounted.
|
||||
declare -girx ERR_UNKNOWN_DEV=230 # Unknown Device Path.
|
||||
declare -girx ERR_DEBOOTSTRAP=229 # Failure occurred on debootstrap.
|
||||
declare -girx ERR_DEBOOTSTRAP=229 # Failure occurred on the debootstrap.
|
||||
declare -girx ERR_CHRT_MOUNTS=228 # Failure occurred while mounting system devices.
|
||||
declare -girx ERR_CHRT_COMMAND=227 # Failure occurred while executing chroot environment command.
|
||||
declare -girx ERR_GRUB_EFI_FORCE=226 # Invalid combination of Partition Table and grub_force_efi.
|
||||
declare -girx ERR_GRUB_INSTALL=226 # Error while installing Grub on the specified device.
|
||||
declare -girx ERR_GRUB_BACKGROUND=225 # Failure occurred on setting up the GRUB-background.
|
||||
declare -girx ERR_GRUB_ARCHITECTURE=224 # Architecture is not supported by Grub.
|
||||
declare -girx ERR_PATH_NOT_VALID=223 # Specific path is not existing.
|
||||
declare -girx ERR_READ_NUKE_FILE=222 # Error reading Luks Nuke password file.
|
||||
declare -girx ERR_READ_GRUB_FILE=221 # Error reading Grub password file.
|
||||
declare -girx ERR_READ_PASS_FILE=220 # Error reading password file.
|
||||
declare -girx ERR_PATH_NOT_VALID=223 # A specific path is not existing.
|
||||
declare -girx ERR_READ_NUKE_FILE=222 # Error reading the Luks Nuke password file.
|
||||
declare -girx ERR_READ_GRUB_FILE=221 # Error reading the Grub password file.
|
||||
declare -girx ERR_READ_PASS_FILE=220 # Error reading the password file.
|
||||
declare -girx ERR_GENERATE_SALT=219 # Error generating salt.
|
||||
|
||||
### Definition of error trap vars.
|
||||
|
||||
Reference in New Issue
Block a user