msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m30s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-07-07 22:21:40 +02:00
parent 0b806e2234
commit 52d72c159d
5 changed files with 121 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
.editorconfig
View File

@@ -18,15 +18,14 @@ indent_style = space
indent_size = 2 indent_size = 2
tab_width = 2 tab_width = 2
max_line_length = 128 max_line_length = 128
[*.conf]
end_of_line = lf end_of_line = lf
charset = utf-8
insert_final_newline = true #[*.conf]
trim_trailing_whitespace = true #charset = utf-8
#insert_final_newline = true
#trim_trailing_whitespace = true
[*.md] [*.md]
end_of_line = lf
# Markdown benefits from a final newline for POSIX tools # Markdown benefits from a final newline for POSIX tools
insert_final_newline = true insert_final_newline = true
# Do not trim trailing whitespace: two spaces at end-of-line signal a hard line break in Markdown # Do not trim trailing whitespace: two spaces at end-of-line signal a hard line break in Markdown
@@ -40,13 +39,11 @@ trim_trailing_whitespace = false
#charset = utf-8 #charset = utf-8
[*.{yaml,yml}] [*.{yaml,yml}]
end_of_line = lf
insert_final_newline = true insert_final_newline = true
# Trim trailing whitespace (safe, since YAML does not rely on trailing spaces) # Trim trailing whitespace (safe, since YAML does not rely on trailing spaces)
trim_trailing_whitespace = true trim_trailing_whitespace = true
[*.{sh,bash,zsh}] [*.{sh,bash,zsh}]
end_of_line = lf
charset = utf-8 charset = utf-8
insert_final_newline = true insert_final_newline = true
trim_trailing_whitespace = true trim_trailing_whitespace = true

13
.gitattributes vendored Normal file
View File

@@ -0,0 +1,13 @@
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
* text eol=lf
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf

17
func/3220_partition_encryption.sh
View File

@@ -30,11 +30,11 @@ guard_sourcing
####################################### #######################################
partition_encryption() { partition_encryption() {
### Declare Arrays and Variables. ### Declare Arrays and Variables.
declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_PATH_LUKSUUID declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_EPHEMERAL_FS_LABEL HMP_PATH_LUKSUUID HMP_PATH_ENCLABEL
declare var_dev var_part \ declare var_dev var_part \
var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_nuke var_encryption_cipher \ var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_nuke var_encryption_cipher \
var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta \ var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta \
var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path var_uuid
declare -a ary_devs ary_parts declare -a ary_devs ary_parts
### Iterate over all devices in the recipe. ### Iterate over all devices in the recipe.
@@ -88,17 +88,18 @@ partition_encryption() {
SWAP|/tmp) SWAP|/tmp)
mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
do_log "info" "false" "Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'." do_log "info" "true" "Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."
HMP_EPHEMERAL_DEV["${var_mount_path}"]="/dev/${var_dev}${var_part}" HMP_EPHEMERAL_DEV["${var_mount_path}"]="/dev/${var_dev}${var_part}"
HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}" HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
do_log "info" "false" "Stored in HashMap [HMP_EPHEMERAL_DEV] : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'" HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]="${var_filesystem_label}"
do_log "info" "false" "Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'" do_log "info" "true" "Stored in HashMap [HMP_EPHEMERAL_DEV] : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
do_log "info" "true" "Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
continue continue
;; ;;
*) *)
do_log "error" "false" "Invalid mount path: '${var_mount_path}' for partition: '/dev/${var_dev}${var_part}'." do_log "error" "true" "Invalid mount path: '${var_mount_path}' for partition: '/dev/${var_dev}${var_part}'."
continue continue
;; ;;
@@ -141,11 +142,11 @@ partition_encryption() {
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'." do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."
### Store UUID of the LUKS container. ### Store UUID of the LUKS container.
# shellcheck disable=SC2155 var_uuid=$(blkid -s UUID -o value "/dev/mapper/${var_encryption_label}")
declare var_uuid=$(blkid -s UUID -o value "/dev/mapper/${var_encryption_label}")
# shellcheck disable=SC2155 # shellcheck disable=SC2155
[[ "${var_mount_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}" [[ "${var_mount_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
HMP_PATH_LUKSUUID["UUID_${var_mount_path}"]="${var_uuid}" HMP_PATH_LUKSUUID["UUID_${var_mount_path}"]="${var_uuid}"
HMP_PATH_ENCLABEL["UUID_${var_mount_path}"]="${var_encryption_label}"
done done

32
func/4040_generate_fstab.sh
View File

@@ -13,7 +13,7 @@
guard_sourcing guard_sourcing
####################################### #######################################
# /etc/fstab entry writer and logger. # '/etc/fstab' entry writer and logger.
# Globals: # Globals:
# TARGET # TARGET
# Arguments: # Arguments:
@@ -21,14 +21,14 @@ guard_sourcing
# 2: Mount Path # 2: Mount Path
# 3: Filesystem # 3: Filesystem
# 4: Mount Options # 4: Mount Options
# 5: Dump and Pass Value combined by one <space>, e.g., "0 1" # 5: Pass value, while Dump value is hardcoded always "0", e.g., "1"
# Returns: # Returns:
# 0: Successfully executed commands. # 0: Successfully executed commands.
####################################### #######################################
write_fstab() { write_fstab() {
declare _uuid="$1" _path="$2" _fs="$3" _opts="$4" _dp="$5" declare _uuid="$1" _path="$2" _fs="$3" _opts="$4" _pass="$5"
printf "UUID=%s %s %s %s %s\n" "${_uuid}" "${_path}" "${_fs}" "${_opts}" "${_dp}" >> "${TARGET}/etc/fstab" printf "UUID=%s %s %s %s 0 %s\n" "${_uuid}" "${_path}" "${_fs}" "${_opts}" "${_pass}" >> "${TARGET}/etc/fstab"
do_log "info" "true" "fstab entry generated: 'UUID=${_uuid} ${_path} ${_fs} ${_opts} ${_dp}'." do_log "info" "true" "fstab entry generated: 'UUID=${_uuid} ${_path} ${_fs} ${_opts} 0 ${_pass}'."
return 0 return 0
} }
@@ -111,17 +111,17 @@ EOF
var_btrfs_compression="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}" var_btrfs_compression="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
fi fi
write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options},${var_btrfs_compression}" "0 1" write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options},${var_btrfs_compression}" "1"
if [[ -n "${var_fs_btrfs_subvolume}" ]]; then if [[ -n "${var_fs_btrfs_subvolume}" ]]; then
if [[ "${var_path}" == "/" ]]; then if [[ "${var_path}" == "/" ]]; then
write_fstab "${var_uuid}" "/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0 0" write_fstab "${var_uuid}" "/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0"
else else
write_fstab "${var_uuid}" "${var_path}/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0 0" write_fstab "${var_uuid}" "${var_path}/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0"
fi fi
@@ -130,12 +130,12 @@ EOF
elif [[ "${var_fs_version,,}" == ext4 ]]; then elif [[ "${var_fs_version,,}" == ext4 ]]; then
write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options}" "0 1" write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options}" "1"
continue continue
elif [[ "${var_fs_version,,}" == fat32 ]]; then elif [[ "${var_fs_version,,}" == fat32 ]]; then
write_fstab "${var_uuid}" "${var_path}" "vfat" "${var_mount_options}" "0 2" write_fstab "${var_uuid}" "${var_path}" "vfat" "${var_mount_options}" "2"
continue continue
fi fi
@@ -174,21 +174,21 @@ EOF
var_btrfs_compression="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}" var_btrfs_compression="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
fi fi
write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options},${var_btrfs_compression}" "0 2" write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options},${var_btrfs_compression}" "2"
if [[ -n "${var_fs_btrfs_subvolume}" ]]; then if [[ -n "${var_fs_btrfs_subvolume}" ]]; then
write_fstab "${var_uuid}" "${var_path}/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0 0" write_fstab "${var_uuid}" "${var_path}/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0"
fi fi
continue continue
elif [[ "${var_fs_version,,}" == ext4 ]]; then elif [[ "${var_fs_version,,}" == ext4 ]]; then
write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options}" "0 2" write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options}" "2"
continue continue
elif [[ "${var_fs_version,,}" == fat32 ]]; then elif [[ "${var_fs_version,,}" == fat32 ]]; then
write_fstab "${var_uuid}" "${var_path}" "vfat" "${var_mount_options}" "0 2" write_fstab "${var_uuid}" "${var_path}" "vfat" "${var_mount_options}" "2"
continue continue
fi fi
@@ -204,11 +204,11 @@ EOF
### Add entry for 'SWAP' device. ### Add entry for 'SWAP' device.
var_path="SWAP" var_path="SWAP"
write_fstab "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}" "none" "swap" "defaults" "0 0" write_fstab "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}" "none" "swap" "defaults" "0"
### Add entry for '/tmp' device. ### Add entry for '/tmp' device.
var_path="/tmp" var_path="/tmp"
write_fstab "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}" "/tmp" "ext4" "defaults,rw,nodev,nosuid,relatime" "0 0" write_fstab "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}" "/tmp" "ext4" "defaults,rw,nodev,nosuid,relatime" "0"
return 0 return 0
} }

156
func/4060_generate_crypttab.sh
View File

@@ -12,102 +12,102 @@
guard_sourcing guard_sourcing
########################################################################################### #######################################
# Generate "${TARGET}" /etc/crypttab entries. # '/etc/crypttab' entry writer and logger.
# Globals: # Globals:
# MAP_PATH_CRYPT
# MAP_UUID_CRYPT
# MODULE_ERR
# MODULE_TXT
# TARGET # TARGET
# Arguments: # Arguments:
# 1: Encryption Label
# 2: LUKS Container UUID
# 3: Keyfile or none
# 4: LUKS Options
# Returns:
# 0: Successfully executed commands.
#######################################
write_crypttab() {
declare _label="$1" _device="$2" _key_file="$3" _opts="$4"
printf "%s %s %s %s \n" "${_label}" "${_device}" "${_key_file}" "${_opts}" >> "${TARGET}/etc/crypttab"
do_log "info" "true" "crypttab entry generated: '${_label} ${_device} ${_key_file} ${_opts}'."
return 0
}
#######################################
# Generate target '/etc/crypttab' entries.
# Globals:
# HMP_EPHEMERAL_ENCLABEL
# HMP_EPHEMERAL_FS_LABEL
# HMP_PATH_ENCLABEL
# HMP_PATH_LUKSUUID
# TARGET
# accounts_dropbear_unlock
# Arguments:
# None # None
########################################################################################### # Returns:
3_7_3_functions_installation_generate_crypttab() { # 0: Successfully executed commands.
declare -g -x MODULE_ERR="3_7_3_functions_installation_generate_crypttab" #######################################
declare -g -x MODULE_TXT="Generating '${TARGET}/etc/crypttab' entries" generate_crypttab() {
do_show_header "${MODULE_TXT}" declare var_key var_encryption_label var_luks_uuid var_ephemeral_enclabel var_ephemeral_fs_label
# Generate '${TARGET}/etc/crypttab'. ### Generate '${TARGET}/etc/crypttab' header.
touch "${TARGET}"/etc/crypttab : >| "${TARGET}/etc/crypttab"
chmod 0644 "${TARGET}"/etc/crypttab chmod 0644 "${TARGET}/etc/crypttab"
# Generate '${TARGET}/etc/crypttab' header. cat << 'EOF' >> "${TARGET}/etc/crypttab"
# shellcheck disable=SC2129 # /etc/crypttab: static file system information.
cat << 'EOF' >> "${TARGET}"/etc/crypttab #
# <name> <device> <password-file-or-none> <options> # Basic rule: 'discard' / 'nodiscard' are normally only set in '/etc/crypttab' when LUKS/dm-crypt is in use.
# Options like 'discard=async' or similar are typically only set in '/etc/fstab' (at the file system level).
# The crypttab determines whether the underlying encrypted device (LUKS/dm-crypt) passes TRIM commands to the
# physical drive or not. The fstab determines whether and how the file system itself generates the discard
# operations and sends them down through the LUKS layer.
#
# RECOMMENDED: 'discard' enables the TRIM commands to be forwarded by the dm-crypt layer to the SSD/physical
# device. If you do not specify discard in the crypttab, dm-crypt blocks TRIM by default. This would render a
# discard in the fstab ineffective.
#
# <name> <device> <password-file-or-none> <options>
EOF EOF
### Reminder ### ### Generate '${TARGET}/etc/crypttab' entries.
# MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]="${UUID}" for var_key in "${HMP_PATH_LUKSUUID[@]}"; do
# MAP_PATH_CRYPT["${MOUNT_PATH}"]="${ENCRYPTION_LABEL}"
# do_log "info" "false" "Saved in HashMap MAP_UUID_CRYPT: '${ENCRYPTION_LABEL}' -> '${MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]}'"
# do_log "info" "false" "Saved in HashMap MAP_PATH_CRYPT: '${MOUNT_PATH}' -> '${MAP_PATH_CRYPT["${MOUNT_PATH}"]}'"
# Generate '${TARGET}/etc/crypttab' entries. var_encryption_label="${HMP_PATH_ENCLABEL["${var_key}"]}"
declare KEY="" var_luks_uuid="${HMP_PATH_LUKSUUID["${var_key}"]}"
declare ENCRYPTION_LABEL=""
for KEY in "${MAP_PATH_CRYPT[@]}"; do if [[ "${accounts_dropbear_unlock,,}" == "true" ]]; then
ENCRYPTION_LABEL="${MAP_PATH_CRYPT["${KEY}"]}" write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs"
contine
if [[ ${accounts_dropbear_unlock,,} == "true" ]]; then
# shellcheck disable=2129
echo "# ${KEY} was on /dev/mapper/${MAP_PATH_CRYPT["${KEY}"]} during installation" >> "${TARGET}"/etc/crypttab
echo "${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]} none luks,initramfs" >> "${TARGET}"/etc/crypttab
echo "" >> "${TARGET}"/etc/crypttab
do_log "info" "false" "'${TARGET}/etc/crypttab' entry generated: '${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT[${ENCRYPTION_LABEL}]} none luks,discard,initramfs'."
elif [[ ${accounts_dropbear_unlock,,} == "false" ]]; then
# shellcheck disable=2129
echo "# ${KEY} was on /dev/mapper/${MAP_PATH_CRYPT["${KEY}"]} during installation" >> "${TARGET}"/etc/crypttab
echo "${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]} none luks" >> "${TARGET}"/etc/crypttab
echo "" >> "${TARGET}"/etc/crypttab
do_log "info" "false" "'${TARGET}/etc/crypttab' entry generated: '${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT[${ENCRYPTION_LABEL}]} none luks,discard'."
fi
done
# TODO: Update loop to iterate thru dynamic number of ephemeral drives.
# Generate '${TARGET}/etc/crypttab' special ephemeral entries.
declare -a EPHEMERAL_MOUNT_PATH=("SWAP" "/tmp")
declare KEY=""
# MAP_EPHEMERAL_DEV["${MOUNT_PATH}"]="/dev/${DEV}${PARTITION}"
# MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]="${ENCRYPTION_LABEL}"
for KEY in "${EPHEMERAL_MOUNT_PATH[@]}"; do
if [[ ${KEY} == "SWAP" ]]; then
# shellcheck disable=2129
echo "# ${KEY} was on ${MAP_EPHEMERAL_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/crypttab
# TODO: Change static 'LABEL=' to dynamic extraction of partitioning.yaml 'recipe_..._filesystem_label' recipe string.
echo "${MAP_EPHEMERAL_ENCLABEL[${KEY}]} LABEL=SWAP /dev/random swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096" >> "${TARGET}"/etc/crypttab
echo "" >> "${TARGET}"/etc/crypttab
do_log "info" "false" "'${TARGET}/etc/crypttab' entry generated: '${MAP_EPHEMERAL_ENCLABEL[${KEY}]} LABEL=SWAP /dev/random swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096'."
elif [[ ${KEY} == "/tmp" ]]; then
# shellcheck disable=2129
echo "# ${KEY} was on ${MAP_EPHEMERAL_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/crypttab
# TODO: Change static 'LABEL=' to dynamic extraction of partitioning.yaml 'recipe_..._filesystem_label' recipe string.
echo "${MAP_EPHEMERAL_ENCLABEL[${KEY}]} LABEL=ext4_tmp /dev/random offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4" >> "${TARGET}"/etc/crypttab
echo "" >> "${TARGET}"/etc/crypttab
do_log "info" "false" "'${TARGET}/etc/crypttab' entry generated: '${MAP_EPHEMERAL_ENCLABEL[${KEY}]} LABEL=ext4_tmp /dev/random offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4'."
else else
do_log "info" "true" "${TARGET}/etc/crypttab entries written." write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard"
contine
fi fi
done done
do_show_footer "${MODULE_TXT}" ### Generate '${TARGET}/etc/crypttab' ephemeral entries.
for var_key in "${HMP_EPHEMERAL_ENCLABEL[@]}"; do
var_ephemeral_enclabel="${HMP_EPHEMERAL_ENCLABEL["${var_key}"]}"
var_ephemeral_fs_label="${HMP_EPHEMERAL_FS_LABEL["${var_key}"]}"
case "${var_key}" in
SWAP)
write_crypttab "${var_ephemeral_enclabel}" "LABEL=${var_ephemeral_fs_label}" "/dev/random" "swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096"
continue
;;
/tmp)
write_crypttab "${var_ephemeral_enclabel}" "LABEL=${var_ephemeral_fs_label}" "/dev/random" "offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4"
continue
;;
esac
done
return 0
} }
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh: # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh