msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 43s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-07-26 22:30:11 +02:00
parent 35e7ea588f
commit 106ed253f4
5 changed files with 70 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
func/partitioning/3220_partition_encryption.sh
View File

@@ -44,6 +44,9 @@ partition_encryption() {
readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
for var_dev in "${ary_devs[@]}"; do
touch "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
chmod 0600 "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
### Iterate over all partitions for this device.
# shellcheck disable=SC2312
readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
@@ -69,10 +72,8 @@ partition_encryption() {
fi
if [[ "${var_mount_path,,}" == "/boot" ]]; then
#ary_luks_opts=( "--key-file=$(tr -d '\n' <<< "${DIR_CNF}")/password_luks_boot.txt" )
ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_boot.txt" )
else
#ary_luks_opts=( "--key-file=$(tr -d '\n' <<< "${DIR_CNF}")/password_luks_common.txt" )
ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_common.txt" )
fi
@@ -99,18 +100,20 @@ partition_encryption() {
SWAP|/tmp)
mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
do_log "info" "file_only" "Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."
do_log "info" "file_only" "3220() Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."
HMP_EPHEMERAL_DEV["${var_mount_path}"]="/dev/${var_dev}${var_part}"
HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]="${var_filesystem_label}"
do_log "info" "file_only" "Stored in HashMap [HMP_EPHEMERAL_DEV] : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
do_log "info" "file_only" "Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_DEV] : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_filesystem_label}"]}'"
continue
;;
*)
do_log "error" "file_only" "Invalid mount path: '${var_mount_path}' for partition: '/dev/${var_dev}${var_part}'."
do_log "error" "file_only" "3220() Invalid mount path: '${var_mount_path}' for partition: '/dev/${var_dev}${var_part}'."
continue
;;
@@ -122,16 +125,16 @@ partition_encryption() {
if [[ "${var_encryption_integrity,,}" == "true" ]]; then
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' dm-integrity encrypted."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' dm-integrity encrypted."
else
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' encrypted."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' encrypted."
fi
cryptsetup luksHeaderBackup --header-backup-file="${DIR_BAK}/luks_header_${var_dev}${var_part}.bak" "/dev/${var_dev}${var_part}"
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
### Opening encrypted container.
if [[ "${var_mount_path,,}" == "/boot" ]]; then
@@ -143,7 +146,11 @@ partition_encryption() {
--key-file="${DIR_CNF}/password_luks_common.txt" \
"${var_encryption_label}"
fi
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."
### Create luksDump log entry.
printf "#------------------------------------------------------------------#" >> "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
crpytsetup luksDump "/dev/${var_dev}${var_part}" >> "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
### Store UUID of the LUKS container.
var_uuid=$(blkid -s UUID -o value "/dev/${var_dev}${var_part}")
@@ -156,6 +163,7 @@ partition_encryption() {
done
done
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh