V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
2025-06-29 21:49:30 +02:00
parent d38eb96733
commit 2344a79886
16 changed files with 492 additions and 494 deletions

353
func/4040_generate_fstab.sh Normal file
View File

@@ -0,0 +1,353 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
guard_sourcing
###########################################################################################
# Generate target '/etc/fstab' entries.
# Globals:
# ERR_NO_DEVIC_PATH
# ERR_NO_ENCR_LABEL
# MAP_EPHEMERAL_ENCLABEL
# MAP_MOUNTPATH_DEV
# MODULE_ERR
# MODULE_TXT
# RECIPE_STRING
# TARGET
# Arguments:
# None
###########################################################################################
generate_fstab() {
### Generate '${TARGET}/etc/fstab' header
touch "${TARGET}/etc/fstab"
chmod 0644 "${TARGET}/etc/fstab"
cat << 'EOF' >> "${TARGET}/etc/fstab"
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# systemd generates mount units based on this file, see systemd.mount(5).
# Please run 'systemctl daemon-reload' after making changes here.
#
# <file system> <mount point> <type> <options> <dump> <pass>
EOF
### Generate '${TARGET}/etc/fstab' special entries '/' '/boot' '/boot/efi'.
### Define the order of the special paths.
declare -a var_path_order ary_devs ary_parts
declare var_dev var_part
var_path_order=("/" "/boot" "/boot/efi")
### Iterate over all devices in the recipe.
readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
for var_dev in "${ary_devs[@]}"; do
### Iterate over all partitions for this device.
readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
for var_part in "${ary_parts[@]}"; do
### Extract parameters from YAML.
var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level" "${VAR_SETUP_PART}")
var_fs_btrfs_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.subvolume" "${VAR_SETUP_PART}")
var_fs_btrfs_snapshot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.snapshot" "${VAR_SETUP_PART}")
var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label" "${VAR_SETUP_PART}")
var_fs_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label" "${VAR_SETUP_PART}")
var_fs_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.options" "${VAR_SETUP_PART}")
var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
var_mount_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options" "${VAR_SETUP_PART}")
var_mount_optsnap=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.optsnap" "${VAR_SETUP_PART}")
done
done
### Reminder ###
# HMP_MOUNTPATH_DEV["${MOUNT_PATH}"]="/dev/mapper/${ENCRYPTION_LABEL}"
# HMP_MOUNTPATH_DEV["${MOUNT_PATH}"]="/dev/${DEV}${PARTITION}"
### Generate '${TARGET}/etc/fstab' special entries '/' '/boot' '/boot/efi'.
### Define the order of the special paths.
declare -a var_path_order
var_path_order=("/" "/boot" "/boot/efi")
declare var_device_path var_device_uuid var_encryption_label var_path
declare MATCHING_VAR
declare TRANSFORMED_STRING
for var_path in "${var_path_order[@]}"; do
# Initialize variables
var_device_path="${HMP_MOUNTPATH_DEV[${var_path}]}"
var_device_uuid=$(blkid -s UUID -o value "${var_device_path}")
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
if [[ ${var_device_path} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
TRANSFORMED_STRING=$(echo "${var_device_path}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
elif [[ ${var_device_path} =~ ^/dev/mapper/ ]]; then
# Extract ENCRYPTION_LABEL
var_encryption_label="${var_device_path#/dev/mapper/}"
# Search matching variable of a sourced "${PRESEED}" variable file
MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${var_encryption_label}")
if [[ -n ${MATCHING_VAR} ]]; then
# Extract third, fourth and fifth part of the respective variable
TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
else
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${var_encryption_label}'."
exit "${ERR_NO_ENCR_LABEL}"
fi
else
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${var_device_path}'."
exit "${ERR_NO_DEVIC_PATH}"
fi
declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"
declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
if [[ ${var_path} == "/" ]]; then
if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
# shellcheck disable=2129
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
echo "${MAP_MOUNTPATH_DEV[${var_path}]} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 1" >> "${TARGET}"/etc/fstab
echo "" >> "${TARGET}"/etc/fstab
do_log "info" "false" "fstab entry generated: '${MAP_MOUNTPATH_DEV[${var_path}]} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 1'."
elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
# shellcheck disable=2129
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
echo "${MAP_MOUNTPATH_DEV[${var_path}]} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 1" >> "${TARGET}"/etc/fstab
echo "" >> "${TARGET}"/etc/fstab
do_log "info" "false" "fstab entry generated: '${MAP_MOUNTPATH_DEV[${var_path}]} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 1'."
else
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${var_path}'."
fi
elif [[ ${var_path} == "/boot" ]]; then
if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
# shellcheck disable=2129
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
echo "UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2" >> "${TARGET}"/etc/fstab
echo "" >> "${TARGET}"/etc/fstab
do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2'."
elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
# shellcheck disable=2129
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
echo "UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2" >> "${TARGET}"/etc/fstab
echo "" >> "${TARGET}"/etc/fstab
do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2'."
else
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${var_path}'."
fi
elif [[ ${var_path} == "/boot/efi" ]]; then
if [[ ${FILESYSTEM_VERSION} == "fat32" ]]; then
# shellcheck disable=2129
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
echo "UUID=${var_device_uuid} ${var_path} vfat umask=0077 0 2" >> "${TARGET}"/etc/fstab
echo "" >> "${TARGET}"/etc/fstab
do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid} ${var_path} vfat umask=0077 0 2'."
else
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${var_path}'."
fi
else
do_log "error" "false" "fstab entry - no valid '${var_path}' for '/', '/boot', '/boot/efi' found."
fi
done
# Generate '${TARGET}/etc/fstab' remaining entries
for var_path in "${!MAP_MOUNTPATH_DEV[@]}"; do
# Initialize variables
var_device_path="${MAP_MOUNTPATH_DEV[${var_path}]}"
var_device_uuid=$(blkid -s UUID -o value "${var_device_path}")
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
if [[ ${var_device_path} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
TRANSFORMED_STRING=$(echo "${var_device_path}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
elif [[ ${var_device_path} =~ ^/dev/mapper/ ]]; then
# Extract ENCRYPTION_LABEL
var_encryption_label="${var_device_path#/dev/mapper/}"
# Search matching variable of a sourced "${PRESEED}" variable file
MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${var_encryption_label}")
if [[ -n ${MATCHING_VAR} ]]; then
# Extract third, fourth and fifth part of the respective variable
TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
else
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${var_encryption_label}'."
exit "${ERR_NO_ENCR_LABEL}"
fi
else
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${var_device_path}'."
exit "${ERR_NO_DEVIC_PATH}"
fi
declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"
declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
# Skip already mounted paths ("/", "/boot", "/boot/efi")
if [[ " ${var_path_order[*]} " == *" ${var_path} "* ]]; then
continue
fi
if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
# shellcheck disable=2129
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
echo "UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2" >> "${TARGET}"/etc/fstab
echo "" >> "${TARGET}"/etc/fstab
do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2'."
elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
# shellcheck disable=2129
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
echo "UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2" >> "${TARGET}"/etc/fstab
echo "" >> "${TARGET}"/etc/fstab
do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2'."
else
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${var_path}'."
fi
done
# TODO: flexible entries for more than one CD-ROM drives.
# Add entry for CD-ROM device
# shellcheck disable=2129
echo "# /media/cdrom0 was on /dev/sr0 during installation" >> "${TARGET}"/etc/fstab
echo "/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0" >> "${TARGET}"/etc/fstab
echo "" >> "${TARGET}"/etc/fstab
do_log "info" "false" "fstab entry generated: '/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0'."
# Add entry for proc and tmpfs device
# shellcheck disable=2129
echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
echo "proc /proc proc nodev,nosuid,noexec,hidepid=2 0 0" >> "${TARGET}"/etc/fstab
echo "tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,relatime,size=1G 0 0" >> "${TARGET}"/etc/fstab
echo "" >> "${TARGET}"/etc/fstab
do_log "info" "false" "fstab entry generated: 'proc /proc proc nodev,nosuid,noexec,hidepid=2 0 0'."
do_log "info" "false" "fstab entry generated: 'tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,relatime,size=1G 0 0'."
# TODO: flexible 'SWAP' entry, not only ephemeral SWAP.
# Add entry for SWAP device
declare MOUNT_PATH="SWAP"
# shellcheck disable=2129
echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
echo "${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} none swap defaults 0 0" >> "${TARGET}"/etc/fstab
echo "" >> "${TARGET}"/etc/fstab
do_log "info" "false" "fstab entry generated: '${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} none swap defaults 0 0'."
# TODO: flexible '/tmp' entry, not only ephemeral SWAP.
# Add entry for '/tmp' device
declare MOUNT_PATH="/tmp"
# shellcheck disable=2129
echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
echo "${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} /tmp ext4 defaults,rw,nodev,nosuid,relatime 0 0" >> "${TARGET}"/etc/fstab
echo "" >> "${TARGET}"/etc/fstab
do_log "info" "false" "fstab entry generated: '${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} /tmp ext4 defaults,rw,nodev,nosuid,relatime 0 0'."
do_show_footer "${MODULE_TXT}"
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh: