V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
2025-07-09 08:47:21 +02:00
parent 980f81bfb3
commit 514e9d550b
10 changed files with 14 additions and 331 deletions

View File

@@ -1,183 +0,0 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
guard_sourcing
#######################################
# Function to generate btrfs-subvolumes.
# Globals:
# ERR_BTRFS_SUBVOL
# TARGET
# Arguments:
# $1: MOUNT_PATH
# $2: SUBVOLUME
#######################################
create_btrfs_subvolume() {
declare var_mount_path="$1"
declare var_subvolume="$2"
btrfs subvolume create "${TARGET}${var_mount_path}/${var_subvolume}" || {
do_log "error" "false" "Error occurred at creation of subvolume: '${var_subvolume}' in: '${TARGET}${var_mount_path}'."
exit "${ERR_BTRFS_SUBVOL}"
}
do_log "info" "false" "Created: '${var_subvolume}' at: '${TARGET}${var_mount_path}'."
}
#######################################
# Function to create the mount path and mount the respective device on it.
# Globals:
# ERR_MOUNTING_DEV
# TARGET
# Arguments:
# $1: MOUNT_PATH
# $2: MOUNT_DEVICE
# $3: MOUNT_OPTIONS
#######################################
mount_with_dir() {
declare var_mount_path="$1"
declare var_mount_device="$2"
declare var_mount_options="$3"
if [[ "${var_mount_path}" == "/" ]]; then
var_mount_path=""
fi
mkdir -p "${TARGET}${var_mount_path}"
mount "${var_mount_options:+-o $var_mount_options}" "${var_mount_device}" "${TARGET}${var_mount_path}" || {
do_log "error" "false" "Error occurred at mounting '${var_mount_device}' on: '${TARGET}${var_mount_path}'."
exit "${ERR_MOUNTING_DEV}"
}
do_log "info" "false" "Mounted: '${var_mount_device}' on: '${TARGET}${var_mount_path}' incl. options: '${var_mount_options}'."
}
#######################################
# Function for mounting all partitions for debootstrap, including the generation of btrfs subvolumes.
# Globals:
# ERR_MOUNTING_ROOT
# HMP_MOUNTPATH_DEV
# TARGET
# VAR_RECIPE_STRING
# VAR_SETUP_PART
# var_fs_options
# Arguments:
# None
#######################################
mount_partition() {
### Mount "/"-filesystem
declare -r var_mount_path_root="/"
if [[ -n ${HMP_MOUNTPATH_DEV[$var_mount_path_root]} ]]; then
mount_with_dir "${var_mount_path_root}" "${HMP_MOUNTPATH_DEV[$var_mount_path_root]}"
else
do_log "error" "false" "Root-filesystem '${var_mount_path_root}' not found in Hashmap."
exit "${ERR_MOUNTING_ROOT}"
fi
### Ensure order of "/boot" and "/boot/efi"
declare var_path
for var_path in "/boot" "/boot/efi"; do
if [[ -n ${HMP_MOUNTPATH_DEV[${var_path}]} ]]; then
mount_with_dir "${var_path}" "${HMP_MOUNTPATH_DEV[${var_path}]}"
else
do_log "info" "false" "Entry '${var_path}' not found in Hashmap."
fi
done
declare var_dev var_part var_fs_btrfs_compress var_fs_btrfs_level var_encryption_enable var_encryption_label \
var_fs_label var_fs_version var_mount_path var_mount_options var_mount_subvolume
### Iterate over all devices in the recipe.
for var_dev in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}"); do
### Iterate over all partitions for this device.
for var_part in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}"); do
### Extract parameters from YAML.
var_fs_btrfs_compress=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
var_fs_btrfs_level=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level" "${VAR_SETUP_PART}")
var_encryption_enable=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
var_encryption_label=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label" "${VAR_SETUP_PART}")
var_fs_label=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label" "${VAR_SETUP_PART}")
var_fs_version=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_path=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
var_mount_options=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options" "${VAR_SETUP_PART}")
var_mount_subvolume=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.subvolume" "${VAR_SETUP_PART}")
### Skip already mounted paths ("/", "/boot", "/boot/efi") and skip ("/recovery")
if [[ "${var_mount_path}" == "/" || "${var_mount_path}" == "/boot" || "${var_mount_path}" == "/boot/efi" || "${var_mount_path}" == "/recovery" ]]; then
continue
fi
if [[ "${var_mount_path}" == "SWAP" ]]; then
cryptsetup open --type plain --key-file /dev/random \
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
mkswap "/dev/mapper/${var_encryption_label}"
swapon "/dev/mapper/${var_encryption_label}"
do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
elif [[ "${var_mount_path}" == "/tmp" ]]; then
cryptsetup open --type plain --key-file /dev/random \
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
mkdir -p "${TARGET}/tmp"
mkfs.ext4 "/dev/mapper/${var_encryption_label}" "${var_fs_options:+ $var_fs_options}"
mount "${var_mount_options:+-o $var_mount_options}" "/dev/mapper/${var_encryption_label}" "${TARGET}/tmp"
do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
fi
if [[ "${var_fs_version,,}" == "btrfs" && "${var_encryption_enable}" == "true" ]]; then
declare var_btrfs_compression_options="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
mount_with_dir "${var_mount_path}" "/dev/mapper/${var_encryption_label}" "${var_btrfs_compression_options}"
[[ -n ${var_mount_subvolume} ]] && create_btrfs_subvolume "${var_mount_path}" "${var_mount_subvolume}"
do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
elif [[ "${var_fs_version,,}" == "btrfs" && "${var_encryption_enable}" == "false" ]]; then
declare var_btrfs_compression_options="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
mount_with_dir "${var_mount_path}" "/dev/${var_dev}${var_part}" "${var_btrfs_compression_options}"
[[ -n ${var_mount_subvolume} ]] && create_btrfs_subvolume "${var_mount_path}" "${var_mount_subvolume}"
do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/${var_dev}${var_part}'."
elif [[ "${var_fs_version,,}" == "ext4" && "${var_encryption_enable}" == "true" ]]; then
mount_with_dir "${var_mount_path}" "/dev/mapper/${var_encryption_label}"
do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
elif [[ "${var_fs_version,,}" == "ext4" && "${var_encryption_enable}" == "false" ]]; then
mount_with_dir "${var_mount_path}" "/dev/${var_dev}${var_part}"
do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/${var_dev}${var_part}'."
fi
done
done
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

View File

@@ -1,108 +0,0 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
#######################################
# Function that generates each partition on each device according to the chosen recipe string.
# Globals:
# ERR_PARTITIONTBL
# HMP_RECIPE_DEV_PARTITIONS
# HMP_UUID_PARTITION
# RECIPE_STRING
# RECIPE_TABLE
# VAR_RECIPE_TABLE
# Arguments:
# None
#######################################
partitioning() {
### REMINDER
# HashMap : "${!HMP_RECIPE_DEV_PARTITIONS[@]}"
# ${DEVICE}: "${HMP_RECIPE_DEV_PARTITIONS[$DEVICE]}"
declare var_dev var_partition var_partition_number
### Iterate through each device.
for var_dev in "${!HMP_RECIPE_DEV_PARTITIONS[@]}"; do
var_partition_number=${HMP_RECIPE_DEV_PARTITIONS[${var_dev}]}
### All current data for the respective device will be deleted.
blkdiscard /dev/"${var_dev}"
do_log "info" "false" "Partition table of '/dev/${var_dev}' discarded."
if [[ ${VAR_RECIPE_TABLE} == "gpt" ]]; then
parted -s /dev/"${var_dev}" mklabel gpt
do_log "info" "false" "Partition table '${VAR_RECIPE_TABLE}' of '/dev/${var_dev}' generated."
elif [[ ${VAR_RECIPE_TABLE} == "mbr" ]]; then
parted -s /dev/"${var_dev}" mklabel mbr
do_log "info" "false" "Partition table '${VAR_RECIPE_TABLE}' of '/dev/${var_dev}' generated."
else
do_log "fatal" "false" "No valid partition table chosen. String was '${VAR_RECIPE_TABLE}'. Exiting setup."
exit "${ERR_PARTITIONTBL}"
fi
### Iterate through each partition on the current device.
for (( var_partition=1; var_partition<=var_partition_number; var_partition++ )); do
#for var_partition in $(seq 1 "${var_partition_number}"); do
### Generate variables for the current partition.
declare begin_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_begin"
declare end_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_end"
declare bootable_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_bootable"
declare primary_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_primary"
declare filesystem_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_filesystem_version"
### Initialise variables.
declare BEGIN=${!begin_var}
declare END=${!end_var}
declare BOOTABLE=${!bootable_var}
declare PRIMARY=${!primary_var}
declare FILESYSTEM=${!filesystem_var}
### Generate partition.
if [[ ${END} == "-1" ]]; then
parted -s /dev/"${var_dev}" mkpart "${PRIMARY}" "${FILESYSTEM}" "${BEGIN}" 100%
do_log "info" "false" "Partition generated: '${var_partition}' | on device '/dev/${var_dev}' | begin: '${BEGIN}' | end: 100 % of remaining disk."
else
parted -s /dev/"${var_dev}" mkpart "${PRIMARY}" "${FILESYSTEM}" "${BEGIN}" "${END}"
do_log "info" "false" "Partition generated: '${var_partition}' | on device '/dev/${var_dev}' | begin: '${BEGIN}' | end: '${END}'."
fi
### Set the bootable flag if necessary.
if [[ "${BOOTABLE,,}" == true ]]; then
parted -s "/dev/${var_dev}" set "${var_partition}" boot on
do_log "info" "false" "Partition: '/dev/${var_dev}${var_partition}' marked as bootable."
fi
if [[ "${PRIMARY,,}" == logical ]]; then
parted -s "/dev/${var_dev}" set "${var_partition}" "${FILESYSTEM}" on
fi
### Save UUID of the generated partition
# shellcheck disable=SC2155
declare UUID=$(blkid -s UUID -o value "/dev/${var_dev}${var_partition}")
HMP_UUID_PARTITION["UUID_${var_dev}${var_partition}"]="${UUID}"
do_log "info" "false" "Saved in HashMap HMP_UUID_PARTITION: 'UUID_${var_dev}${var_partition}' -> '${HMP_UUID_PARTITION["UUID_${var_dev}${var_partition}"]}'"
done
done
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

View File

@@ -462,7 +462,7 @@ user:
tty: false # Require 2FA for TTY (local console) login. tty: false # Require 2FA for TTY (local console) login.
privileges: privileges:
description: "Automation user without interactive shell and no sudo." description: "Automation user without interactive shell and no sudo."
sudo: false # Whether the user can escalate to root using sudo. sudo: true # Whether the user can escalate to root using sudo.
system_user: true # Whether this is a low-UID system user (e.g., for automation). system_user: true # Whether this is a low-UID system user (e.g., for automation).
restricted: true # If true, user is limited in scope (e.g., no login, no file access). restricted: true # If true, user is limited in scope (e.g., no login, no file access).
shell_access: false # MUST be "true" if shell is not '/usr/sbin/nologin' or '/bin/false'. shell_access: false # MUST be "true" if shell is not '/usr/sbin/nologin' or '/bin/false'.

View File

@@ -25,7 +25,8 @@ guard_sourcing
# 0: Successfully executed commands. # 0: Successfully executed commands.
####################################### #######################################
func_debootstrap() { func_debootstrap() {
if debootstrap --arch="${architecture}" "${distribution}" "${TARGET}" https://deb.debian.org/debian; then # shellcheck disable=SC2154 # "${architecture}" "${distribution}"
if debootstrap --arch="${architecture}" "${distribution}" "${TARGET}" https://deb.debian.org/debian | tee "${LOG_DBS}"; then
do_log "info" "false" "Executing 'debootstrap --arch=${architecture} ${distribution} '${TARGET}' https://deb.debian.org/debian' successful." do_log "info" "false" "Executing 'debootstrap --arch=${architecture} ${distribution} '${TARGET}' https://deb.debian.org/debian' successful."
return 0 return 0
else else

View File

@@ -23,7 +23,7 @@ guard_sourcing
# 0: Successfully executed commands. # 0: Successfully executed commands.
####################################### #######################################
setup_timezone() { setup_timezone() {
do_in_target "${TARGET}" ln -sf /usr/share/zoneinfo/"${ntp_timezone}" /etc/localtime do_in_target "${TARGET}" ln -sf "/usr/share/zoneinfo/${ntp_timezone}" /etc/localtime
do_in_target "${TARGET}" /bin/bash -c "echo ${ntp_timezone} | tee /etc/timezone" do_in_target "${TARGET}" /bin/bash -c "echo ${ntp_timezone} | tee /etc/timezone"
do_in_target "${TARGET}" dpkg-reconfigure -f noninteractive tzdata do_in_target "${TARGET}" dpkg-reconfigure -f noninteractive tzdata
return 0 return 0

View File

@@ -1,18 +1,16 @@
#!/bin/bash #!/bin/bash
# SPDX-Version: 3.0 # SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-02-13; WEIDNER, Marc S.; <cendev@coresecret.eu> # SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://cendev.eu/marc.weidner/CISS.2025.debian.installer.git # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <cendev@coresecret.eu> # SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE # SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0 # SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.2025.hardened.installer framework. # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.2025.hardened.installer # SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
########################################################################################### guard_sourcing
# 3.7.6. Functions - installation - setup locales #
###########################################################################################
########################################################################################### ###########################################################################################
# Set locale and configure keyboard layout # Set locale and configure keyboard layout
@@ -26,17 +24,12 @@
# Arguments: # Arguments:
# None # None
########################################################################################### ###########################################################################################
3_7_6_functions_installation_setup_locales() { setup_locales() {
declare -g -x MODULE_ERR="3_7_6_functions_installation_setup_locales"
declare -g -x MODULE_TXT="Setup locales and configure keyboard layout"
do_show_header "${MODULE_TXT}"
do_in_target "${TARGET}" apt-get install -y locales do_in_target "${TARGET}" apt-get install -y locales
do_log "info" "true" "Command: 'apt-get install -y locales' executed in: '${TARGET}'."
# TODO: Alternative elif statement to use separately configured variables '{$locale_country}' and '{$locale_language}'. # TODO: Alternative elif statement to use separately configured variables '{$locale_country}' and '{$locale_language}'.
# Give priority to '${locale_locale}' over separately configured variables '{$locale_country}' and '{$locale_language}'. # Give priority to '${locale_locale}' over separately configured variables '{$locale_country}' and '{$locale_language}'.
if [[ -n ${locale_locale} ]]; then if [[ -n "${locale_locale}" ]]; then
# Generate the specified locale # Generate the specified locale
do_in_target "${TARGET}" locale-gen "${locale_locale}" do_in_target "${TARGET}" locale-gen "${locale_locale}"

View File

@@ -35,6 +35,7 @@ gen_dir_files() {
touch "${LOG_INS}" && chmod 0600 "${LOG_INS}" touch "${LOG_INS}" && chmod 0600 "${LOG_INS}"
touch "${LOG_NIC}" && chmod 0600 "${LOG_NIC}" touch "${LOG_NIC}" && chmod 0600 "${LOG_NIC}"
touch "${LOG_UID}" && chmod 0600 "${LOG_UID}" touch "${LOG_UID}" && chmod 0600 "${LOG_UID}"
touch "${LOG_DBS}" && chmod 0600 "${LOG_DBS}"
touch "${VAR_PRESEED}" && chmod 0600 "${VAR_PRESEED}" touch "${VAR_PRESEED}" && chmod 0600 "${VAR_PRESEED}"
touch "${DIR_LOG}/btrfs.log" && chmod 0600 "${DIR_LOG}/btrfs.log" touch "${DIR_LOG}/btrfs.log" && chmod 0600 "${DIR_LOG}/btrfs.log"
touch "${DIR_LOG}/cpu.log" && chmod 0600 "${DIR_LOG}/cpu.log" touch "${DIR_LOG}/cpu.log" && chmod 0600 "${DIR_LOG}/cpu.log"

View File

@@ -10,7 +10,6 @@
# SPDX-PackageName: CISS.debian.installer # SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
. ./var/colors.var.sh . ./var/colors.var.sh
. ./var/dummy.var.sh
. ./var/errors.var.sh . ./var/errors.var.sh
. ./var/global.var.sh . ./var/global.var.sh
. ./var/terminal.var.sh . ./var/terminal.var.sh

View File

@@ -1,21 +0,0 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# This file is for static tests of preseed.yaml and partitioning.yaml only.
# 4000_debootstrap.sh
declare -g architecture="" distribution=""
# 4100_setup_timezone.sh
declare -g ntp_timezone=""
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

View File

@@ -36,6 +36,7 @@ declare -grx LOG_ERR="${DIR_LOG}/ciss_debian_installer_$$_error.log"
declare -grx LOG_INS="${DIR_LOG}/ciss_debian_installer_$$_install.log" declare -grx LOG_INS="${DIR_LOG}/ciss_debian_installer_$$_install.log"
declare -grx LOG_NIC="${DIR_LOG}/ciss_debian_installer_$$_nic.log" declare -grx LOG_NIC="${DIR_LOG}/ciss_debian_installer_$$_nic.log"
declare -grx LOG_UID="${DIR_LOG}/ciss_debian_installer_$$_uuid.log" declare -grx LOG_UID="${DIR_LOG}/ciss_debian_installer_$$_uuid.log"
declare -grx LOG_DBS="${DIR_LOG}/ciss_debian_installer_$$_debootstrap.log"
### Initialize variable of imported and cleaned 'YAML' -> 'BASH-variable'-file. ### Initialize variable of imported and cleaned 'YAML' -> 'BASH-variable'-file.
declare -grx VAR_PRESEED="${DIR_TMP}/combined.var" declare -grx VAR_PRESEED="${DIR_TMP}/combined.var"