V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/4060_generate_crypttab.sh

@@ -12,102 +12,102 @@
 
 guard_sourcing
 
-###########################################################################################
-# Generate "${TARGET}" /etc/crypttab entries.
+#######################################
+# '/etc/crypttab' entry writer and logger.
 # Globals:
-#   MAP_PATH_CRYPT
-#   MAP_UUID_CRYPT
-#   MODULE_ERR
-#   MODULE_TXT
 #   TARGET
 # Arguments:
+#   1: Encryption Label
+#   2: LUKS Container UUID
+#   3: Keyfile or none
+#   4: LUKS Options
+# Returns:
+#   0: Successfully executed commands.
+#######################################
+write_crypttab() {
+  declare _label="$1" _device="$2" _key_file="$3" _opts="$4"
+  printf "%s    %s    %s    %s    \n" "${_label}" "${_device}" "${_key_file}" "${_opts}" >> "${TARGET}/etc/crypttab"
+  do_log "info" "true" "crypttab entry generated: '${_label}    ${_device}    ${_key_file}    ${_opts}'."
+  return 0
+}
+
+#######################################
+# Generate target '/etc/crypttab' entries.
+# Globals:
+#   HMP_EPHEMERAL_ENCLABEL
+#   HMP_EPHEMERAL_FS_LABEL
+#   HMP_PATH_ENCLABEL
+#   HMP_PATH_LUKSUUID
+#   TARGET
+#   accounts_dropbear_unlock
+# Arguments:
 #   None
-###########################################################################################
-3_7_3_functions_installation_generate_crypttab() {
-  declare -g -x MODULE_ERR="3_7_3_functions_installation_generate_crypttab"
-  declare -g -x MODULE_TXT="Generating '${TARGET}/etc/crypttab' entries"
-  do_show_header "${MODULE_TXT}"
+# Returns:
+#   0: Successfully executed commands.
+#######################################
+generate_crypttab() {
+  declare var_key var_encryption_label var_luks_uuid var_ephemeral_enclabel var_ephemeral_fs_label
 
-  # Generate '${TARGET}/etc/crypttab'.
-  touch "${TARGET}"/etc/crypttab
-  chmod 0644 "${TARGET}"/etc/crypttab
+  ### Generate '${TARGET}/etc/crypttab' header.
+  : >| "${TARGET}/etc/crypttab"
+  chmod 0644 "${TARGET}/etc/crypttab"
 
-  # Generate '${TARGET}/etc/crypttab' header.
-  # shellcheck disable=SC2129
-  cat << 'EOF' >> "${TARGET}"/etc/crypttab
-# <name>  <device>  <password-file-or-none>  <options>
+  cat << 'EOF' >> "${TARGET}/etc/crypttab"
+# /etc/crypttab: static file system information.
+#
+# Basic rule: 'discard' / 'nodiscard' are normally only set in '/etc/crypttab' when LUKS/dm-crypt is in use.
+# Options like 'discard=async' or similar are typically only set in '/etc/fstab' (at the file system level).
+# The crypttab determines whether the underlying encrypted device (LUKS/dm-crypt) passes TRIM commands to the
+# physical drive or not. The fstab determines whether and how the file system itself generates the discard
+# operations and sends them down through the LUKS layer.
+#
+# RECOMMENDED: 'discard' enables the TRIM commands to be forwarded by the dm-crypt layer to the SSD/physical
+# device. If you do not specify discard in the crypttab, dm-crypt blocks TRIM by default. This would render a
+# discard in the fstab ineffective.
+#
+# <name>                                   <device>       <password-file-or-none>        <options>
 
 EOF
 
-  ### Reminder ###
-  # MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]="${UUID}"
-  # MAP_PATH_CRYPT["${MOUNT_PATH}"]="${ENCRYPTION_LABEL}"
-  # do_log "info" "false" "Saved in HashMap MAP_UUID_CRYPT: '${ENCRYPTION_LABEL}' -> '${MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]}'"
-  # do_log "info" "false" "Saved in HashMap MAP_PATH_CRYPT: '${MOUNT_PATH}' -> '${MAP_PATH_CRYPT["${MOUNT_PATH}"]}'"
+  ### Generate '${TARGET}/etc/crypttab' entries.
+  for var_key in "${HMP_PATH_LUKSUUID[@]}"; do
 
-  # Generate '${TARGET}/etc/crypttab' entries.
-  declare KEY=""
-  declare ENCRYPTION_LABEL=""
+    var_encryption_label="${HMP_PATH_ENCLABEL["${var_key}"]}"
+    var_luks_uuid="${HMP_PATH_LUKSUUID["${var_key}"]}"
 
-  for KEY in "${MAP_PATH_CRYPT[@]}"; do
+    if [[ "${accounts_dropbear_unlock,,}" == "true" ]]; then
 
-    ENCRYPTION_LABEL="${MAP_PATH_CRYPT["${KEY}"]}"
-
-    if [[ ${accounts_dropbear_unlock,,} == "true" ]]; then
-
-      # shellcheck disable=2129
-      echo "# ${KEY} was on /dev/mapper/${MAP_PATH_CRYPT["${KEY}"]} during installation" >> "${TARGET}"/etc/crypttab
-      echo "${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]} none luks,initramfs" >> "${TARGET}"/etc/crypttab
-      echo "" >> "${TARGET}"/etc/crypttab
-      do_log "info" "false" "'${TARGET}/etc/crypttab' entry generated: '${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT[${ENCRYPTION_LABEL}]} none luks,discard,initramfs'."
-
-    elif [[ ${accounts_dropbear_unlock,,} == "false" ]]; then
-
-       # shellcheck disable=2129
-      echo "# ${KEY} was on /dev/mapper/${MAP_PATH_CRYPT["${KEY}"]} during installation" >> "${TARGET}"/etc/crypttab
-      echo "${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]} none luks" >> "${TARGET}"/etc/crypttab
-      echo "" >> "${TARGET}"/etc/crypttab
-      do_log "info" "false" "'${TARGET}/etc/crypttab' entry generated: '${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT[${ENCRYPTION_LABEL}]} none luks,discard'."
-
-    fi
-
-  done
-
-  # TODO: Update loop to iterate thru dynamic number of ephemeral drives.
-  # Generate '${TARGET}/etc/crypttab' special ephemeral entries.
-  declare -a EPHEMERAL_MOUNT_PATH=("SWAP" "/tmp")
-  declare KEY=""
-
-  # MAP_EPHEMERAL_DEV["${MOUNT_PATH}"]="/dev/${DEV}${PARTITION}"
-  # MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]="${ENCRYPTION_LABEL}"
-  for KEY in "${EPHEMERAL_MOUNT_PATH[@]}"; do
-
-    if [[ ${KEY} == "SWAP" ]]; then
-
-      # shellcheck disable=2129
-      echo "# ${KEY} was on ${MAP_EPHEMERAL_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/crypttab
-      # TODO: Change static 'LABEL=' to dynamic extraction of partitioning.yaml 'recipe_..._filesystem_label' recipe string.
-      echo "${MAP_EPHEMERAL_ENCLABEL[${KEY}]}  LABEL=SWAP  /dev/random  swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096" >> "${TARGET}"/etc/crypttab
-      echo "" >> "${TARGET}"/etc/crypttab
-      do_log "info" "false" "'${TARGET}/etc/crypttab' entry generated: '${MAP_EPHEMERAL_ENCLABEL[${KEY}]}  LABEL=SWAP  /dev/random  swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096'."
-
-    elif [[ ${KEY} == "/tmp" ]]; then
-
-      # shellcheck disable=2129
-      echo "# ${KEY} was on ${MAP_EPHEMERAL_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/crypttab
-      # TODO: Change static 'LABEL=' to dynamic extraction of partitioning.yaml 'recipe_..._filesystem_label' recipe string.
-      echo "${MAP_EPHEMERAL_ENCLABEL[${KEY}]}  LABEL=ext4_tmp  /dev/random  offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4" >> "${TARGET}"/etc/crypttab
-      echo "" >> "${TARGET}"/etc/crypttab
-      do_log "info" "false" "'${TARGET}/etc/crypttab' entry generated: '${MAP_EPHEMERAL_ENCLABEL[${KEY}]}  LABEL=ext4_tmp  /dev/random  offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4'."
+      write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs"
+      contine
 
     else
 
-      do_log "info" "true" "${TARGET}/etc/crypttab entries written."
+      write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard"
+      contine
 
     fi
 
   done
 
-  do_show_footer "${MODULE_TXT}"
+  ### Generate '${TARGET}/etc/crypttab' ephemeral entries.
+  for var_key in "${HMP_EPHEMERAL_ENCLABEL[@]}"; do
+
+    var_ephemeral_enclabel="${HMP_EPHEMERAL_ENCLABEL["${var_key}"]}"
+    var_ephemeral_fs_label="${HMP_EPHEMERAL_FS_LABEL["${var_key}"]}"
+
+    case "${var_key}" in
+      SWAP)
+        write_crypttab "${var_ephemeral_enclabel}" "LABEL=${var_ephemeral_fs_label}" "/dev/random" "swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096"
+        continue
+        ;;
+      /tmp)
+        write_crypttab "${var_ephemeral_enclabel}" "LABEL=${var_ephemeral_fs_label}" "/dev/random" "offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4"
+        continue
+        ;;
+    esac
+
+  done
+
+  return 0
 }
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh