V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m36s
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m36s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
170
.archive/kb/DISK_SETUP.md
Normal file
170
.archive/kb/DISK_SETUP.md
Normal file
@@ -0,0 +1,170 @@
|
||||
|
||||
---
|
||||
|
||||
## 🚀 **1. Btrfs RAID6 auf dm-integrity**
|
||||
|
||||
### **Technische Übersicht:**
|
||||
|
||||
```
|
||||
Physische Disks → dm-integrity → btrfs (RAID6-Modus)
|
||||
```
|
||||
|
||||
### **✅ Vorteile:**
|
||||
|
||||
* **Redundanz:** toleriert zwei gleichzeitige Plattenausfälle.
|
||||
* **Integrität:** Prüfsummen von dm-integrity + btrfs-Prüfsummen (z.B. SHA256) → doppelte Sicherheit gegen Silent Corruption.
|
||||
* **Integriert:** Weniger Komplexität als LVM+mdadm.
|
||||
* **Features:** Snapshots, Kompression, CoW integriert in btrfs.
|
||||
|
||||
### **❌ Nachteile:**
|
||||
|
||||
* RAID6-Modus von btrfs ist **2025 weiterhin experimentell** und **nicht produktiv empfohlen**.
|
||||
* Recovery-Werkzeuge bei Fehlerfällen sind limitiert.
|
||||
* Performance: dm-integrity + RAID6 in btrfs erzeugen Write-Overhead.
|
||||
|
||||
### **Fazit (Stand 2025):**
|
||||
|
||||
➡️ **nicht produktiv empfohlen**, nur experimentell und für Testumgebungen.
|
||||
|
||||
---
|
||||
|
||||
## 🌊 **2. ZFS RAIDZ2**
|
||||
|
||||
### **Technische Übersicht:**
|
||||
|
||||
```
|
||||
Physische Disks → ZFS RAIDZ2
|
||||
```
|
||||
|
||||
### **✅ Vorteile:**
|
||||
|
||||
* **Integriert:** RAIDZ2 (ähnlich RAID6) + Prüfsummen + CoW + Kompression + Snapshots in einem System.
|
||||
* **Hohe Stabilität:** RAIDZ2 extrem robust, vielfach produktiv bewährt.
|
||||
* **Einfache Verwaltung:** Pools, Datasets, integrierte Wartung und Reparaturfunktionen.
|
||||
|
||||
### **❌ Nachteile:**
|
||||
|
||||
* **RAM-Bedarf:** mind. 8 GB RAM, besser ≥ 16 GB für großen ARC-Cache.
|
||||
* **Lizenz (wichtiger Punkt):**
|
||||
|
||||
* OpenZFS (ZFS on Linux) steht unter der **CDDL-Lizenz** (frei verfügbar, Open Source).
|
||||
* Du zahlst **keine Lizenzkosten** an Oracle oder andere Anbieter, wenn Du OpenZFS nutzt (meist genutzte Variante auf Linux).
|
||||
* Lizenzprobleme treten nur bei Kernel-Integration und Distributionen auf (keine technischen Lizenzkosten für Dich).
|
||||
* **Kernel-Updates:** Integration nicht immer reibungslos nach Kernel-Updates (DKMS-Module erforderlich).
|
||||
|
||||
### **Fazit:**
|
||||
|
||||
➡️ **Keine Lizenzkosten** bei typischer Nutzung (OpenZFS). Lizenzkosten entstehen nur bei kommerziellem Oracle-ZFS-Storage-System (Storage-Appliances). OpenZFS auf Linux ist lizenzkostenfrei, nur eventuell integrationsaufwendig.
|
||||
|
||||
---
|
||||
|
||||
## 🗃️ **3. Btrfs RAID1C3 auf LUKS (reines Software-Setup)**
|
||||
|
||||
### **Technische Übersicht:**
|
||||
|
||||
```
|
||||
Physische Disks → LUKS → btrfs RAID1C3
|
||||
```
|
||||
|
||||
*(RAID1C3 = Drei vollständige Datenkopien)*
|
||||
|
||||
### **✅ Vorteile:**
|
||||
|
||||
* **Maximale Fehlertoleranz** (besser als RAID6 hinsichtlich Datenintegrität).
|
||||
* Sehr gute Integrität durch btrfs-eigene Checksums.
|
||||
* Keine dm-integrity notwendig (da drei echte Kopien automatisch bitrot erkennen/heilen können).
|
||||
* **Stabil und produktiv empfohlen** (2025).
|
||||
|
||||
### **❌ Nachteile:**
|
||||
|
||||
* **Kapazitätsverlust:** Nur 33 % nutzbarer Speicher (drei Kopien).
|
||||
* Performanz gut, aber hoher I/O-Overhead (3-fache Schreiblast).
|
||||
|
||||
### **Fazit:**
|
||||
|
||||
➡️ **Sehr gute und sichere Wahl** für wichtige Daten, aber hoher Speicher-Overhead.
|
||||
|
||||
---
|
||||
|
||||
## 🚧 **4. XFS oder btrfs (sha256) auf LVM auf mdadm RAID6 auf dm-integrity (Overkill?)**
|
||||
|
||||
### **Technische Übersicht:**
|
||||
|
||||
```
|
||||
Physische Disks → dm-integrity → mdadm RAID6 → LVM → (XFS oder btrfs sha256)
|
||||
```
|
||||
|
||||
### **Überlegung:**
|
||||
|
||||
* Prüfsummen mehrfach (dm-integrity + btrfs SHA256) → **redundant**.
|
||||
* RAID6 Redundanz via mdadm robust und etabliert.
|
||||
* btrfs-Funktionalitäten (CoW, Snapshots) sind oben noch verfügbar, aber nicht integriert mit darunterliegenden Schichten.
|
||||
|
||||
### **✅ Sinnvoll wenn:**
|
||||
|
||||
* Du extrem hohen Integritätsschutz willst (z. B. Langzeitarchiv, Bankensysteme).
|
||||
* Dir bewusst bist, dass Performance darunter leiden wird.
|
||||
|
||||
### **❌ Sonst Overkill:**
|
||||
|
||||
* Performance wird stark reduziert (doppelte Prüfsummenberechnung, RAID6 Write-Penalty).
|
||||
* Komplexität erschwert Wartung, Debugging und Recovery.
|
||||
|
||||
### **Fazit:**
|
||||
|
||||
➡️ **Technisch machbar**, aber meistens **Overkill** und praktisch nicht empfohlen.
|
||||
|
||||
---
|
||||
|
||||
## 💻 **5. Hardware RAID6 (mit Spare-Disk + Ersatzcontroller) + dm-integrity + btrfs sha256**
|
||||
|
||||
### **Technische Übersicht:**
|
||||
|
||||
```
|
||||
Physische Disks → Hardware RAID6 Controller → dm-integrity → LUKS → btrfs (sha256)
|
||||
```
|
||||
|
||||
### **✅ Vorteile:**
|
||||
|
||||
* RAID-Berechnung im HW-Controller: weniger CPU-Belastung.
|
||||
* Spare-Disk ermöglicht schnellen Rebuild.
|
||||
* dm-integrity: zusätzlicher Integritätsschutz vor Silent Corruption.
|
||||
* btrfs sha256: noch mehr Integritätsprüfungen auf Dateiebene.
|
||||
|
||||
### **❌ Nachteile:**
|
||||
|
||||
* Komplexität steigt weiterhin (HW-RAID-Controller Firmware als „Single Point of Failure“).
|
||||
* RAID-Controller oft proprietär (Firmware, Ersatzteile, Updates).
|
||||
* dm-integrity weiterhin teuer bezüglich I/O.
|
||||
|
||||
### **Alternativ (schlanker):**
|
||||
|
||||
* Nur Hardware RAID6 + LUKS + btrfs (ohne dm-integrity), da HW-RAID-Controller oft ECC/Integritätsschutz selbst bietet.
|
||||
|
||||
### **Fazit:**
|
||||
|
||||
➡️ **Performanter als reines Software-Setup**, aber immer noch hohe Komplexität.
|
||||
➡️ Wenn Dein RAID-Controller ECC, Patrol-Reads, BBU, o. ä. bietet, **ist dm-integrity meist redundant**.
|
||||
|
||||
---
|
||||
|
||||
## 💡 **Empfohlene Praxis (2025):**
|
||||
|
||||
| Anwendungsfall | Empfohlenes Setup |
|
||||
| ------------------------------- | -------------------------------------------------- |
|
||||
| Maximale Stabilität (Produktiv) | ZFS RAIDZ2 **oder** btrfs RAID1C3 (LUKS) |
|
||||
| Einfach & performant (HW-RAID) | HW RAID6 + LUKS + btrfs (sha256) ohne dm-integrity |
|
||||
| Hohe Integrität & Experimentell | btrfs RAID6 + dm-integrity (nur Testsysteme!) |
|
||||
| Langzeitarchiv/Cold Storage | LVM on mdadm RAID6 + dm-integrity + XFS/btrfs |
|
||||
|
||||
---
|
||||
|
||||
## 📌 **Abschließende Zusammenfassung:**
|
||||
|
||||
* **ZFS RAIDZ2** ist stabil, Open-Source, keine Lizenzkosten.
|
||||
* **Btrfs RAID6** ist weiterhin experimentell (nicht empfohlen).
|
||||
* **btrfs RAID1C3 + LUKS** ist sehr stabil, integritätsstark, hoher Speicherbedarf.
|
||||
* **XFS/btrfs auf LVM+RAID6+dm-integrity** meist zu komplex und Overkill.
|
||||
* **Hardware RAID6 mit LUKS + btrfs (ohne dm-integrity)**: sinnvoller Kompromiss aus Performance, Komplexität und Sicherheit.
|
||||
|
||||
---
|
||||
@@ -106,7 +106,7 @@ recipe:
|
||||
btrfs:
|
||||
checksum: "sha256"
|
||||
compress: "zstd"
|
||||
level: "7"
|
||||
level: "0"
|
||||
dedup: true
|
||||
subvolume: "@boot"
|
||||
snapshot: ""
|
||||
@@ -269,7 +269,7 @@ recipe:
|
||||
version: "btrfs"
|
||||
mount:
|
||||
enable: true
|
||||
options: "defaults,errors=remount-ro,noatime,compress=zstd:7,discard=async,autodefrag,subvol=@"
|
||||
options: "defaults,errors=remount-ro,noatime,discard=async,autodefrag,subvol=@root"
|
||||
optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@root_snap"
|
||||
path: "/"
|
||||
primary: primary
|
||||
@@ -304,7 +304,7 @@ recipe:
|
||||
version: "btrfs"
|
||||
mount:
|
||||
enable: true
|
||||
options: "defaults,nodev,nosuid,relatime,compress=zstd:7,discard=async,autodefrag,subvol=@home"
|
||||
options: "defaults,nodev,nosuid,relatime,discard=async,autodefrag,subvol=@home"
|
||||
optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@home_snap"
|
||||
path: "/home"
|
||||
primary: primary
|
||||
@@ -339,7 +339,7 @@ recipe:
|
||||
version: "btrfs"
|
||||
mount:
|
||||
enable: true
|
||||
options: "defaults,nodev,relatime,compress=zstd:7,discard=async,subvol=@usr"
|
||||
options: "defaults,nodev,relatime,discard=async,subvol=@usr"
|
||||
optsnap: ""
|
||||
path: "/usr"
|
||||
primary: primary
|
||||
@@ -374,7 +374,7 @@ recipe:
|
||||
version: "btrfs"
|
||||
mount:
|
||||
enable: true
|
||||
options: "defaults,nodev,nosuid,relatime,compress=zstd:7,discard=async,subvol=@var"
|
||||
options: "defaults,nodev,nosuid,relatime,discard=async,subvol=@var"
|
||||
optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@var_snap"
|
||||
path: "/var"
|
||||
primary: primary
|
||||
@@ -409,7 +409,7 @@ recipe:
|
||||
version: "btrfs"
|
||||
mount:
|
||||
enable: true
|
||||
options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,compress=zstd:7,discard=async,subvol=@var_log"
|
||||
options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async,subvol=@var_log"
|
||||
optsnap: ""
|
||||
path: "/var/log"
|
||||
primary: primary
|
||||
@@ -444,7 +444,7 @@ recipe:
|
||||
version: "btrfs"
|
||||
mount:
|
||||
enable: true
|
||||
options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,compress=zstd:7,discard=async,subvol=@var_log_audit"
|
||||
options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async,subvol=@var_log_audit"
|
||||
optsnap: ""
|
||||
path: "/var/log/audit"
|
||||
primary: primary
|
||||
@@ -479,7 +479,7 @@ recipe:
|
||||
version: "btrfs"
|
||||
mount:
|
||||
enable: true
|
||||
options: "defaults,nodev,nosuid,noatime,compress=zstd:7,nodatacow,discard=async,subvol=@var_tmp"
|
||||
options: "defaults,nodev,nosuid,noatime,nodatacow,discard=async,subvol=@var_tmp"
|
||||
optsnap: ""
|
||||
path: "/var/tmp"
|
||||
primary: primary
|
||||
@@ -514,9 +514,9 @@ recipe:
|
||||
version: "btrfs"
|
||||
mount:
|
||||
enable: true
|
||||
options: "defaults,nodev,nosuid,relatime,compress=zstd:7,discard=async,subvol=@opt"
|
||||
options: "defaults,nodev,nosuid,relatime,discard=async,subvol=@opt"
|
||||
optsnap: ""
|
||||
path: "/opt"
|
||||
primary: primary
|
||||
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml:
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml
|
||||
|
||||
@@ -38,16 +38,16 @@
|
||||
[[ ${BASH_VERSINFO[0]} -le 5 ]] && [[ ${BASH_VERSINFO[1]} -le 1 ]] && {
|
||||
. ./var/errors.var.sh; printf "\e[91m❌ Minimum requirement is bash 5.1. You are using '%s'! Bye... \e[0m\n" "${BASH_VERSION}" >&2; exit "${ERR_UNSUPPORTED_BASH}"; }
|
||||
[[ ${#} -eq 0 ]] && {
|
||||
. ./lib/1000_usage.sh; usage >&2; exit 1; }
|
||||
. ./lib/0000_usage.sh; usage >&2; exit 1; }
|
||||
|
||||
### SOURCING MUST SET EARLY VARIABLES AND GUARD_SOURCING()
|
||||
. ./var/early.var.sh
|
||||
. ./lib/1007_guard_sourcing.sh
|
||||
. ./lib/0010_guard_sourcing.sh
|
||||
|
||||
### CHECK FOR CONTACT, HELP, AND VERSION STRING
|
||||
for arg in "$@"; do case "${arg,,}" in -c|--contact) . ./lib/1001_contact.sh; contact; exit 0;; esac; done
|
||||
for arg in "$@"; do case "${arg,,}" in -h|--help) . ./lib/1000_usage.sh; usage; exit 0;; esac; done
|
||||
for arg in "$@"; do case "${arg,,}" in -v|--version) . ./lib/1002_version.sh; version; exit 0;; esac; done
|
||||
for arg in "$@"; do case "${arg,,}" in -c|--contact) . ./lib/0001_contact.sh; contact; exit 0;; esac; done
|
||||
for arg in "$@"; do case "${arg,,}" in -h|--help) . ./lib/0000_usage.sh; usage; exit 0;; esac; done
|
||||
for arg in "$@"; do case "${arg,,}" in -v|--version) . ./lib/0002_version.sh; version; exit 0;; esac; done
|
||||
|
||||
### ALL CHECKS DONE. READY TO START THE SCRIPT
|
||||
declare -grx VAR_SETUP="true"
|
||||
@@ -56,13 +56,13 @@ declare -grx VAR_SETUP="true"
|
||||
for arg in "$@"; do case "${arg,,}" in -a|--autoinstall) declare -gx VAR_AUTO_INSTALL="true";; esac; done; unset arg
|
||||
|
||||
### CHECKING REQUIRED PACKAGES
|
||||
. ./lib/1010_check_pkgs.sh
|
||||
. ./lib/1011_check_git.sh
|
||||
. ./lib/0030_check_pkgs.sh
|
||||
. ./lib/0031_check_git.sh
|
||||
check_pkgs
|
||||
check_git
|
||||
|
||||
### PRE SCAN FOR DEBUG MODE
|
||||
. ./lib/1015_debug_pre_scan.sh
|
||||
. ./lib/0050_debug_pre_scan.sh
|
||||
pre_scan_debug "$@"
|
||||
|
||||
### ADVISORY LOCK
|
||||
@@ -99,7 +99,7 @@ gen_dir_files
|
||||
|
||||
|
||||
### Dialog Output for Initialization
|
||||
if ! $VAR_AUTO_INSTALL; then . ./lib/1050_dialog_helper.sh && dialog_gauge; fi
|
||||
if ! $VAR_AUTO_INSTALL; then . ./lib/0200_dialog_helper.sh && dialog_gauge; fi
|
||||
|
||||
|
||||
|
||||
|
||||
34
func/1220_validation_element.sh
Normal file
34
func/1220_validation_element.sh
Normal file
@@ -0,0 +1,34 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Checks if a search pattern / string / value is present in an array.
|
||||
# Arguments:
|
||||
# 1: String to check against:
|
||||
# 2: "$@" Array
|
||||
# Returns:
|
||||
# 0: If String is present in Array.
|
||||
# 1: If String is NOT present in Array.
|
||||
#######################################
|
||||
validation_array() {
|
||||
declare var_element
|
||||
declare var_string=$1; shift
|
||||
for var_element in "$@"; do
|
||||
if [[ "${var_element}" == "${var_string}" ]]; then
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
return 1
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -60,4 +60,4 @@ validation_preseed() {
|
||||
|
||||
return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -15,19 +15,23 @@ guard_sourcing
|
||||
#######################################
|
||||
# Function that generates each partition on each device according to the chosen recipe string.
|
||||
# Globals:
|
||||
# ERR_PARTITIONTBL
|
||||
# ERR_READ_PARTTBL
|
||||
# HMP_UUID_PARTITION
|
||||
# RECIPE_STRING
|
||||
# HMP_PATH_PARTUUID
|
||||
# VAR_RECIPE_STRING
|
||||
# VAR_RECIPE_TABLE
|
||||
# VAR_SETUP_PART
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# "${ERR_PARTITIONTBL}"
|
||||
# "${ERR_PART_CREATE}"
|
||||
# "${ERR_PART_READ}"
|
||||
# "${ERR_TABLE_CREATE}"
|
||||
# "${ERR_TABLE_DELETE}"
|
||||
#######################################
|
||||
partitioning() {
|
||||
### Declare Arrays and Variables.
|
||||
declare -Ag HMP_UUID_PARTITION
|
||||
declare var_dev var_part var_end_arg var_begin var_end var_fs var_boot var_pri var_uuid
|
||||
declare -Ag HMP_PATH_PARTUUID
|
||||
declare var_dev var_part var_end_arg var_begin var_end var_fs var_boot var_pri var_uuid var_mount_path
|
||||
declare -a ary_devs ary_parts
|
||||
|
||||
### Iterate over all devices in the recipe.
|
||||
@@ -68,6 +72,7 @@ partitioning() {
|
||||
var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
|
||||
var_boot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.bootable" "${VAR_SETUP_PART}")
|
||||
var_pri=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.primary" "${VAR_SETUP_PART}")
|
||||
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
|
||||
|
||||
### Generate partition.
|
||||
if [[ "${var_end}" == "-1" ]]; then
|
||||
@@ -89,15 +94,13 @@ partitioning() {
|
||||
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' marked as bootable."
|
||||
fi
|
||||
|
||||
### Read UUID of the newly created partition
|
||||
### Store UUID of the partition.
|
||||
var_uuid=$(blkid -s UUID -o value "/dev/${var_dev}${var_part}")
|
||||
if [[ -z "${var_uuid}" ]]; then
|
||||
do_log "fatal" "false" "WARNING: could not read UUID for '/dev/${var_dev}${var_part}'."
|
||||
return "${ERR_PART_READ}"
|
||||
else
|
||||
### Store UUID in an associative array.
|
||||
HMP_UUID_PARTITION["UUID_${var_dev}${var_part}"]="${var_uuid}"
|
||||
do_log "info" "false" "Saved in HashMap HMP_UUID_PARTITION: 'UUID_${var_dev}${var_part}' -> '${var_uuid}'."
|
||||
HMP_PATH_PARTUUID["UUID_${var_mount_path}"]="${var_uuid}"
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
@@ -17,20 +17,20 @@ guard_sourcing
|
||||
# Globals:
|
||||
# DIR_BAK
|
||||
# DIR_CNF
|
||||
# HMP_ENCRYPTIONLABEL_UUID
|
||||
# HMP_EPHEMERAL_DEV
|
||||
# HMP_EPHEMERAL_ENCLABEL
|
||||
# HMP_MOUNTPATH_ENCRYPTIONLABEL
|
||||
# HMP_PATH_LUKSUUID
|
||||
# VAR_CRYPT_ROOT
|
||||
# VAR_RECIPE_STRING
|
||||
# VAR_SETUP_PART
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: Successful
|
||||
#######################################
|
||||
partition_encryption() {
|
||||
### Declare Arrays and Variables.
|
||||
declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL
|
||||
declare -Ag HMP_ENCRYPTIONLABEL_UUID HMP_MOUNTPATH_ENCRYPTIONLABEL
|
||||
declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_PATH_LUKSUUID
|
||||
declare var_dev var_part \
|
||||
var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_nuke var_encryption_cipher \
|
||||
var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta \
|
||||
@@ -134,22 +134,18 @@ partition_encryption() {
|
||||
cryptsetup luksHeaderBackup --header-backup-file="${DIR_BAK}/luks_header_${var_dev}${var_part}.bak" "/dev/${var_dev}${var_part}"
|
||||
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
|
||||
|
||||
### Opening encrypted partition.
|
||||
### Opening encrypted container.
|
||||
cryptsetup luksOpen "/dev/${var_dev}${var_part}" \
|
||||
--key-file="${DIR_CNF}/password.txt" \
|
||||
"${var_encryption_label}"
|
||||
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."
|
||||
|
||||
### Store UUID of the encrypted partition
|
||||
### Store UUID of the LUKS container.
|
||||
# shellcheck disable=SC2155
|
||||
declare var_uuid=$(blkid -s UUID -o value "/dev/mapper/${var_encryption_label}")
|
||||
# shellcheck disable=SC2155
|
||||
[[ "${var_mount_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
|
||||
|
||||
HMP_ENCRYPTIONLABEL_UUID["${var_encryption_label}"]="${var_uuid}"
|
||||
HMP_MOUNTPATH_ENCRYPTIONLABEL["${var_mount_path}"]="${var_encryption_label}"
|
||||
do_log "info" "false" "Saved in HashMap [HMP_ENCRYPTIONLABEL_UUID] : '${var_encryption_label}' -> '${HMP_ENCRYPTIONLABEL_UUID["${var_encryption_label}"]}'"
|
||||
do_log "info" "false" "Saved in HashMap [HMP_MOUNTPATH_ENCRYPTIONLABEL] : '${var_mount_path}' -> '${HMP_MOUNTPATH_ENCRYPTIONLABEL["${var_mount_path}"]}'"
|
||||
HMP_PATH_LUKSUUID["UUID_${var_mount_path}"]="${var_uuid}"
|
||||
|
||||
done
|
||||
|
||||
|
||||
@@ -16,16 +16,20 @@ guard_sourcing
|
||||
# Function to format the respective partition on each device according to the recipe string chosen.
|
||||
# Globals:
|
||||
# DIR_LOG
|
||||
# HMP_PATH_FSUUID
|
||||
# VAR_RECIPE_STRING
|
||||
# VAR_SETUP_PART
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: Successful
|
||||
#######################################
|
||||
partition_formatting() {
|
||||
### Declare Arrays and Variables.
|
||||
declare -Ag HMP_PATH_FSUUID
|
||||
declare var_dev var_part \
|
||||
var_encryption_enable var_encryption_label var_fs_btrfs_checksum var_fs_btrfs_compress var_fs_btrfs_dedup \
|
||||
var_fs_format var_fs_label var_fs_options var_fs_version var_mount_path var_node
|
||||
var_fs_format var_fs_label var_fs_options var_fs_version var_mount_path var_node var_fs_uuid
|
||||
declare -a ary_devs ary_parts ary_opts ary_fmt_opts
|
||||
|
||||
### Iterate over all devices in the recipe.
|
||||
@@ -74,6 +78,8 @@ partition_formatting() {
|
||||
do_log "info" "false" "Partition: '${var_node}' formatted: btrfs."
|
||||
echo "Partition: '${var_node}':" >> "${DIR_LOG}/btrfs.log"
|
||||
btrfs filesystem show "${var_node}" >> "${DIR_LOG}/btrfs.log"
|
||||
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
|
||||
HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"
|
||||
;;
|
||||
|
||||
ext4)
|
||||
|
||||
@@ -62,7 +62,7 @@ setup_filesystem() {
|
||||
|
||||
fi
|
||||
|
||||
HMP_MOUNTPATH_DEV["$var_mount_path"]="${var_node}"
|
||||
HMP_MOUNTPATH_DEV["${var_mount_path}"]="${var_node}"
|
||||
do_log "info" "false" "Saved in HashMap HMP_MOUNTPATH_DEV: '${var_mount_path}' -> '${HMP_MOUNTPATH_DEV["${var_mount_path}"]}'"
|
||||
|
||||
done
|
||||
|
||||
@@ -176,17 +176,8 @@ mount_partition() {
|
||||
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
|
||||
--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
|
||||
mkdir -p "${TARGET}/tmp"
|
||||
|
||||
if [[ -n "${var_fs_options}" ]]; then
|
||||
|
||||
mkfs.ext4 -O "${var_fs_options}" "/dev/mapper/${var_encryption_label}"
|
||||
|
||||
else
|
||||
|
||||
mkfs.ext4 "/dev/mapper/${var_encryption_label}"
|
||||
|
||||
fi
|
||||
|
||||
### Build the command in an array to keep word boundaries intact
|
||||
declare -a ary_cmd2=(mount)
|
||||
[[ -n "${var_mount_options}" ]] && ary_cmd2+=("-o" "${var_mount_options}")
|
||||
|
||||
@@ -43,330 +43,173 @@ generate_fstab() {
|
||||
#
|
||||
# <file system> <mount point> <type> <options> <dump> <pass>
|
||||
|
||||
# Secure tmpfs mounts for a hardened system
|
||||
# Mount the proc filesystem to provide process and kernel information
|
||||
proc /proc proc nodev,nosuid,noexec,hidepid=2 0 0
|
||||
# Mount sysfs to expose kernel device information to user space
|
||||
sysfs /sys sysfs defaults 0 0
|
||||
# Mount the devpts filesystem to enable pseudo-terminal support for user sessions
|
||||
devpts /dev/pts devpts gid=5,mode=620 0 0
|
||||
# Restrict /dev/shm to shared memory, limit size, prevent code execution
|
||||
tmpfs /dev/shm tmpfs rw,nodev,noexec,nosuid,relatime,size=1G 0 0
|
||||
# System runtime directory in RAM; do not set noexec here for compatibility
|
||||
tmpfs /run tmpfs mode=0755,nodev,nosuid 0 0
|
||||
|
||||
EOF
|
||||
|
||||
### Generate '${TARGET}/etc/fstab' special entries '/' '/boot' '/boot/efi'.
|
||||
### Define the order of the special paths.
|
||||
declare -a var_path_order ary_devs ary_parts
|
||||
declare var_dev var_part
|
||||
declare -a ary_path_order; ary_path_order=("/" "/boot" "/boot/efi")
|
||||
declare -a ary_skip=("/" "/boot" "/boot/efi" "/recovery")
|
||||
declare var_path var_entry var_part var_dev var_key var_uuid var_fs_btrfs_compress var_fs_btrfs_level var_fs_btrfs_subvolume \
|
||||
var_fs_version var_mount_options var_mount_optsnap var_btrfs_compression
|
||||
|
||||
var_path_order=("/" "/boot" "/boot/efi")
|
||||
for var_path in "${ary_path_order[@]}"; do
|
||||
|
||||
### Iterate over all devices in the recipe.
|
||||
readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
|
||||
for var_dev in "${ary_devs[@]}"; do
|
||||
var_entry=$(yq e -r '.recipe.*.dev.* | select(.mount.path == "'"${var_path}"'")' "${VAR_SETUP_PART}")
|
||||
|
||||
### Iterate over all partitions for this device.
|
||||
readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
|
||||
for var_part in "${ary_parts[@]}"; do
|
||||
|
||||
### Extract parameters from YAML.
|
||||
var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
|
||||
var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level" "${VAR_SETUP_PART}")
|
||||
var_fs_btrfs_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.subvolume" "${VAR_SETUP_PART}")
|
||||
var_fs_btrfs_snapshot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.snapshot" "${VAR_SETUP_PART}")
|
||||
var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
|
||||
var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label" "${VAR_SETUP_PART}")
|
||||
var_fs_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label" "${VAR_SETUP_PART}")
|
||||
var_fs_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.options" "${VAR_SETUP_PART}")
|
||||
var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
|
||||
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
|
||||
var_mount_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options" "${VAR_SETUP_PART}")
|
||||
var_mount_optsnap=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.optsnap" "${VAR_SETUP_PART}")
|
||||
|
||||
case "${var_mount_path,,}" in
|
||||
|
||||
/)
|
||||
|
||||
case "${var_fs_version,,}" in
|
||||
|
||||
btrfs)
|
||||
|
||||
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
|
||||
# shellcheck disable=2129
|
||||
echo "# ${var_mount_path} was on ${MAP_MOUNTPATH_DEV[${var_mount_path}]} during installation" >> "${TARGET}/etc/fstab"
|
||||
echo "# ${var_mount_path} was on ${var_device_uuid} during installation" >> "${TARGET}/etc/fstab"
|
||||
echo "${HMP_MOUNTPATH_DEV[${var_mount_path}]} ${var_mount_path} ${var_fs_version} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 1" >> "${TARGET}/etc/fstab"
|
||||
echo "" >> "${TARGET}/etc/fstab"
|
||||
do_log "info" "false" "fstab entry generated: '${MAP_MOUNTPATH_DEV[${var_path}]} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 1'."
|
||||
;;
|
||||
|
||||
esac
|
||||
|
||||
esac
|
||||
|
||||
done
|
||||
|
||||
done
|
||||
|
||||
|
||||
|
||||
|
||||
### Reminder ###
|
||||
# HMP_MOUNTPATH_DEV["${MOUNT_PATH}"]="/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
# HMP_MOUNTPATH_DEV["${MOUNT_PATH}"]="/dev/${DEV}${PARTITION}"
|
||||
|
||||
### Generate '${TARGET}/etc/fstab' special entries '/' '/boot' '/boot/efi'.
|
||||
### Define the order of the special paths.
|
||||
declare -a var_path_order
|
||||
var_path_order=("/" "/boot" "/boot/efi")
|
||||
|
||||
declare var_device_path var_device_uuid var_encryption_label var_path
|
||||
declare MATCHING_VAR
|
||||
declare TRANSFORMED_STRING
|
||||
|
||||
for var_path in "${var_path_order[@]}"; do
|
||||
# Initialize variables
|
||||
var_device_path="${HMP_MOUNTPATH_DEV[${var_path}]}"
|
||||
var_device_uuid=$(blkid -s UUID -o value "${var_device_path}")
|
||||
|
||||
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
|
||||
if [[ ${var_device_path} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
|
||||
|
||||
TRANSFORMED_STRING=$(echo "${var_device_path}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
|
||||
|
||||
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
elif [[ ${var_device_path} =~ ^/dev/mapper/ ]]; then
|
||||
|
||||
# Extract ENCRYPTION_LABEL
|
||||
var_encryption_label="${var_device_path#/dev/mapper/}"
|
||||
|
||||
# Search matching variable of a sourced "${PRESEED}" variable file
|
||||
MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${var_encryption_label}")
|
||||
|
||||
if [[ -n ${MATCHING_VAR} ]]; then
|
||||
|
||||
# Extract third, fourth and fifth part of the respective variable
|
||||
TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${var_encryption_label}'."
|
||||
exit "${ERR_NO_ENCR_LABEL}"
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${var_device_path}'."
|
||||
exit "${ERR_NO_DEVIC_PATH}"
|
||||
|
||||
fi
|
||||
|
||||
declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
|
||||
declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
|
||||
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
|
||||
declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
|
||||
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
|
||||
declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"
|
||||
|
||||
declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
|
||||
declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
|
||||
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
|
||||
declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
|
||||
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
|
||||
declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
|
||||
|
||||
if [[ ${var_path} == "/" ]]; then
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
|
||||
|
||||
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
|
||||
# shellcheck disable=2129
|
||||
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "${MAP_MOUNTPATH_DEV[${var_path}]} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 1" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: '${MAP_MOUNTPATH_DEV[${var_path}]} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 1'."
|
||||
|
||||
elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "${MAP_MOUNTPATH_DEV[${var_path}]} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 1" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: '${MAP_MOUNTPATH_DEV[${var_path}]} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 1'."
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${var_path}'."
|
||||
|
||||
fi
|
||||
|
||||
elif [[ ${var_path} == "/boot" ]]; then
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
|
||||
|
||||
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
|
||||
# shellcheck disable=2129
|
||||
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2'."
|
||||
|
||||
elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2'."
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${var_path}'."
|
||||
|
||||
fi
|
||||
|
||||
elif [[ ${var_path} == "/boot/efi" ]]; then
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION} == "fat32" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${var_device_uuid} ${var_path} vfat umask=0077 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid} ${var_path} vfat umask=0077 0 2'."
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${var_path}'."
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid '${var_path}' for '/', '/boot', '/boot/efi' found."
|
||||
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
# Generate '${TARGET}/etc/fstab' remaining entries
|
||||
for var_path in "${!MAP_MOUNTPATH_DEV[@]}"; do
|
||||
|
||||
# Initialize variables
|
||||
var_device_path="${MAP_MOUNTPATH_DEV[${var_path}]}"
|
||||
var_device_uuid=$(blkid -s UUID -o value "${var_device_path}")
|
||||
|
||||
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
|
||||
if [[ ${var_device_path} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
|
||||
|
||||
TRANSFORMED_STRING=$(echo "${var_device_path}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
|
||||
|
||||
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
elif [[ ${var_device_path} =~ ^/dev/mapper/ ]]; then
|
||||
|
||||
# Extract ENCRYPTION_LABEL
|
||||
var_encryption_label="${var_device_path#/dev/mapper/}"
|
||||
|
||||
# Search matching variable of a sourced "${PRESEED}" variable file
|
||||
MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${var_encryption_label}")
|
||||
|
||||
if [[ -n ${MATCHING_VAR} ]]; then
|
||||
|
||||
# Extract third, fourth and fifth part of the respective variable
|
||||
TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${var_encryption_label}'."
|
||||
exit "${ERR_NO_ENCR_LABEL}"
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${var_device_path}'."
|
||||
exit "${ERR_NO_DEVIC_PATH}"
|
||||
|
||||
fi
|
||||
|
||||
declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
|
||||
declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
|
||||
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
|
||||
declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
|
||||
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
|
||||
declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"
|
||||
|
||||
declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
|
||||
declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
|
||||
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
|
||||
declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
|
||||
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
|
||||
declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
|
||||
|
||||
# Skip already mounted paths ("/", "/boot", "/boot/efi")
|
||||
if [[ " ${var_path_order[*]} " == *" ${var_path} "* ]]; then
|
||||
if [[ -z "${var_entry}" ]]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
|
||||
var_part=$(echo "${var_entry}" | yq e 'path | .[-2]' -)
|
||||
var_dev=$(yq e '.recipe.*.dev | keys[0]' "${VAR_SETUP_PART}")
|
||||
var_key="UUID_${var_path}"
|
||||
var_uuid="${HMP_PATH_FSUUID[${var_key}]}"
|
||||
var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
|
||||
var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level" "${VAR_SETUP_PART}")
|
||||
var_fs_btrfs_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.subvolume" "${VAR_SETUP_PART}")
|
||||
var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
|
||||
var_mount_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options" "${VAR_SETUP_PART}")
|
||||
var_mount_optsnap=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.optsnap" "${VAR_SETUP_PART}")
|
||||
|
||||
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
|
||||
# shellcheck disable=2129
|
||||
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2'."
|
||||
if [[ "${var_fs_version,,}" == btrfs ]]; then
|
||||
|
||||
elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
|
||||
if [[ "${var_fs_btrfs_level}" -eq 0 ]]; then
|
||||
var_btrfs_compression="compress=no"
|
||||
else
|
||||
var_btrfs_compression="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
|
||||
fi
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid} ${var_path} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2'."
|
||||
echo "UUID=${var_uuid} ${var_path} ${var_fs_version} ${var_mount_options},${var_btrfs_compression} 0 1" >> "${TARGET}/etc/fstab"
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid} ${var_path} ${var_fs_version} ${var_mount_options},${var_btrfs_compression} 0 1'."
|
||||
|
||||
if [[ -n "${var_fs_btrfs_subvolume}" ]]; then
|
||||
|
||||
if [[ "${var_path}" == "/" ]]; then
|
||||
|
||||
echo "UUID=${var_uuid} /.snapshots ${var_fs_version} ${var_mount_optsnap} 0 0" >> "${TARGET}/etc/fstab"
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid} /.snapshots ${var_fs_version} ${var_mount_optsnap} 0 0'."
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${var_path}'."
|
||||
echo "UUID=${var_uuid} ${var_path}/.snapshots ${var_fs_version} ${var_mount_optsnap} 0 0" >> "${TARGET}/etc/fstab"
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid} ${var_path}/.snapshots ${var_fs_version} ${var_mount_optsnap} 0 0'."
|
||||
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
echo "" >> "${TARGET}/etc/fstab"
|
||||
continue
|
||||
|
||||
elif [[ "${var_fs_version,,}" == ext4 ]]; then
|
||||
|
||||
echo "UUID=${var_uuid} ${var_path} ${var_fs_version} ${var_mount_options} 0 1" >> "${TARGET}/etc/fstab"
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid} ${var_path} ${var_fs_version} ${var_mount_options} 0 1'."
|
||||
echo "" >> "${TARGET}/etc/fstab"
|
||||
continue
|
||||
|
||||
elif [[ "${var_fs_version,,}" == fat32 ]]; then
|
||||
|
||||
echo "UUID=${var_uuid} ${var_path} vfat ${var_mount_options} 0 2" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid} ${var_path} vfat ${var_mount_options} 0 2'."
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
continue
|
||||
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
# TODO: flexible entries for more than one CD-ROM drives.
|
||||
# Add entry for CD-ROM device
|
||||
# shellcheck disable=2129
|
||||
echo "# /media/cdrom0 was on /dev/sr0 during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0" >> "${TARGET}"/etc/fstab
|
||||
### Generate '${TARGET}/etc/fstab' remaining entries
|
||||
for var_path in "${!MAP_MOUNTPATH_DEV[@]}"; do
|
||||
|
||||
if validation_array "${var_path}" "${ary_skip[@]}"; then
|
||||
continue
|
||||
fi
|
||||
|
||||
var_entry=$(yq e -r '.recipe.*.dev.* | select(.mount.path == "'"${var_path}"'")' "${VAR_SETUP_PART}")
|
||||
|
||||
if [[ -z "${var_entry}" ]]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
var_part=$(echo "${var_entry}" | yq e 'path | .[-2]' -)
|
||||
var_dev=$(yq e '.recipe.*.dev | keys[0]' "${VAR_SETUP_PART}")
|
||||
var_key="UUID_${var_path}"
|
||||
var_uuid="${HMP_PATH_FSUUID[${var_key}]}"
|
||||
var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
|
||||
var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level" "${VAR_SETUP_PART}")
|
||||
var_fs_btrfs_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.subvolume" "${VAR_SETUP_PART}")
|
||||
var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
|
||||
var_mount_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options" "${VAR_SETUP_PART}")
|
||||
var_mount_optsnap=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.optsnap" "${VAR_SETUP_PART}")
|
||||
|
||||
if [[ "${var_fs_version,,}" == btrfs ]]; then
|
||||
|
||||
if [[ "${var_fs_btrfs_level}" -eq 0 ]]; then
|
||||
var_btrfs_compression="compress=no"
|
||||
else
|
||||
var_btrfs_compression="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
|
||||
fi
|
||||
|
||||
echo "UUID=${var_uuid} ${var_path} ${var_fs_version} ${var_mount_options},${var_btrfs_compression} 0 2" >> "${TARGET}/etc/fstab"
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid} ${var_path} ${var_fs_version} ${var_mount_options},${var_btrfs_compression} 0 2'."
|
||||
|
||||
if [[ -n "${var_fs_btrfs_subvolume}" ]]; then
|
||||
|
||||
echo "UUID=${var_uuid} ${var_path}/.snapshots ${var_fs_version} ${var_mount_optsnap} 0 0" >> "${TARGET}/etc/fstab"
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid} ${var_path}/.snapshots ${var_fs_version} ${var_mount_optsnap} 0 0'."
|
||||
|
||||
fi
|
||||
|
||||
echo "" >> "${TARGET}/etc/fstab"
|
||||
continue
|
||||
|
||||
elif [[ "${var_fs_version,,}" == ext4 ]]; then
|
||||
|
||||
echo "UUID=${var_uuid} ${var_path} ${var_fs_version} ${var_mount_options} 0 2" >> "${TARGET}/etc/fstab"
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid} ${var_path} ${var_fs_version} ${var_mount_options} 0 2'."
|
||||
echo "" >> "${TARGET}/etc/fstab"
|
||||
continue
|
||||
|
||||
elif [[ "${var_fs_version,,}" == fat32 ]]; then
|
||||
|
||||
echo "UUID=${var_uuid} ${var_path} vfat ${var_mount_options} 0 2" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid} ${var_path} vfat ${var_mount_options} 0 2'."
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
continue
|
||||
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
cat << 'EOF' >> "${TARGET}/etc/fstab"
|
||||
/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0
|
||||
|
||||
EOF
|
||||
do_log "info" "false" "fstab entry generated: '/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0'."
|
||||
|
||||
# Add entry for proc and tmpfs device
|
||||
# shellcheck disable=2129
|
||||
echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
|
||||
echo "proc /proc proc nodev,nosuid,noexec,hidepid=2 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,relatime,size=1G 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'proc /proc proc nodev,nosuid,noexec,hidepid=2 0 0'."
|
||||
do_log "info" "false" "fstab entry generated: 'tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,relatime,size=1G 0 0'."
|
||||
### Add entry for SWAP device.
|
||||
var_path="SWAP"
|
||||
echo "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]} none swap defaults 0 0" >> "${TARGET}/etc/fstab"
|
||||
echo "" >> "${TARGET}/etc/fstab"
|
||||
do_log "info" "false" "fstab entry generated: '/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]} none swap defaults 0 0'."
|
||||
|
||||
# TODO: flexible 'SWAP' entry, not only ephemeral SWAP.
|
||||
# Add entry for SWAP device
|
||||
declare MOUNT_PATH="SWAP"
|
||||
# shellcheck disable=2129
|
||||
echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
|
||||
echo "${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} none swap defaults 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: '${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} none swap defaults 0 0'."
|
||||
|
||||
# TODO: flexible '/tmp' entry, not only ephemeral SWAP.
|
||||
# Add entry for '/tmp' device
|
||||
declare MOUNT_PATH="/tmp"
|
||||
# shellcheck disable=2129
|
||||
echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
|
||||
echo "${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} /tmp ext4 defaults,rw,nodev,nosuid,relatime 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: '${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} /tmp ext4 defaults,rw,nodev,nosuid,relatime 0 0'."
|
||||
|
||||
do_show_footer "${MODULE_TXT}"
|
||||
### Add entry for '/tmp' device.
|
||||
var_path="/tmp"
|
||||
echo "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]} /tmp ext4 defaults,rw,nodev,nosuid,relatime 0 0" >> "${TARGET}/etc/fstab"
|
||||
echo "" >> "${TARGET}/etc/fstab"
|
||||
do_log "info" "false" "fstab entry generated: '/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]} /tmp ext4 defaults,rw,nodev,nosuid,relatime 0 0'."
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
|
||||
@@ -20,7 +20,7 @@ guard_sourcing
|
||||
pre_scan_debug() {
|
||||
# shellcheck disable=SC2155
|
||||
declare script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
. "${script_dir}/1040_arg_mismatch.sh"
|
||||
. "${script_dir}/0100_arg_mismatch.sh"
|
||||
declare args=("$@")
|
||||
declare dbg_index=-1
|
||||
declare dbg_count=0
|
||||
@@ -29,7 +29,7 @@ pre_scan_debug() {
|
||||
for i in "${!args[@]}"; do
|
||||
if [[ "${args[i]}" == "-d" || "${args[i]}" == "--debug" ]]; then
|
||||
dbg_index=$i
|
||||
. "${script_dir}/1016_debug_var_dump.sh"
|
||||
. "${script_dir}/0051_debug_var_dump.sh"
|
||||
declare -grx LOG_VAR="/tmp/ciss_debian_installer_$$_var.log"
|
||||
touch "${LOG_VAR}" && chmod 0600 "${LOG_VAR}"
|
||||
dump_vars_initial
|
||||
@@ -43,14 +43,14 @@ pre_scan_debug() {
|
||||
case "${args[j],,}" in
|
||||
xtrace)
|
||||
declare -gx VAR_DEBUG_TRACE="true"
|
||||
. "${script_dir}/1020_debug_trace.sh"
|
||||
. "${script_dir}/1021_debug_trace_header.sh"
|
||||
. "${script_dir}/0052_debug_trace.sh"
|
||||
. "${script_dir}/0053_debug_trace_header.sh"
|
||||
debug_trace "$@"
|
||||
;;
|
||||
trap)
|
||||
declare -gx VAR_DEBUG_TRAP="true"
|
||||
. "${script_dir}/1025_debug_trap.sh"
|
||||
. "${script_dir}/1026_debug_trap_header.sh"
|
||||
. "${script_dir}/0054_debug_trap.sh"
|
||||
. "${script_dir}/0055_debug_trap_header.sh"
|
||||
trap 'debug_trap' DEBUG
|
||||
;;
|
||||
*)
|
||||
@@ -11,12 +11,12 @@
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
. ./func/
|
||||
. ./func/
|
||||
. ./func/2015_helper_modules.sh
|
||||
. ./func/2020_logging_modules.sh
|
||||
. ./func/2030_check_nic.sh
|
||||
. ./func/2040_grub_helper.sh
|
||||
. ./func/2050_yaml_parser.sh
|
||||
. ./func/2051_yaml_reader.sh
|
||||
. ./func/1082_helper_modules.sh
|
||||
. ./func/1120_logging_modules.sh
|
||||
. ./func/1030_check_nic.sh
|
||||
. ./func/1081_helper_grub.sh
|
||||
. ./func/1250_yaml_parser.sh
|
||||
. ./func/1251_yaml_reader.sh
|
||||
. ./func/
|
||||
. ./func/
|
||||
. ./func/
|
||||
|
||||
@@ -9,19 +9,19 @@
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
. ./lib/1000_usage.sh
|
||||
. ./lib/1001_contact.sh
|
||||
. ./lib/1003_gen_dir_files.sh
|
||||
. ./lib/1010_check_pkgs.sh
|
||||
. ./lib/1030_trap_err.sh
|
||||
. ./lib/1031_trap_exit.sh
|
||||
. ./lib/1032_trap_int.sh
|
||||
. ./lib/1035_clean_up.sh
|
||||
. ./lib/1040_arg_mismatch.sh
|
||||
. ./lib/1041_arg_sanitizer.sh
|
||||
. ./lib/1042_arg_parser.sh
|
||||
. ./lib/1043_arg_priority_check.sh
|
||||
. ./lib/1050_dialog_helper.sh
|
||||
. ./lib/0000_usage.sh
|
||||
. ./lib/0001_contact.sh
|
||||
. ./lib/0020_gen_dir_files.sh
|
||||
. ./lib/0030_check_pkgs.sh
|
||||
. ./lib/0060_trap_err.sh
|
||||
. ./lib/0070_trap_exit.sh
|
||||
. ./lib/0080_trap_int.sh
|
||||
. ./lib/0090_clean_up.sh
|
||||
. ./lib/0100_arg_mismatch.sh
|
||||
. ./lib/0101_arg_sanitizer.sh
|
||||
. ./lib/0102_arg_parser.sh
|
||||
. ./lib/0103_arg_priority_check.sh
|
||||
. ./lib/0200_dialog_helper.sh
|
||||
. ./lib/
|
||||
. ./lib/
|
||||
. ./lib/
|
||||
|
||||
@@ -47,16 +47,16 @@ declare -grx VAR_SAFE_MNT_BASE="/run/ciss/bootstrap"
|
||||
### Default log level.
|
||||
declare -gx DEFAULT_LOG_LEVEL="info"
|
||||
|
||||
### 2040_grub_helper.sh:
|
||||
### 1081_helper_grub.sh:
|
||||
### Variable to finish GRUB CMDLINE strings.
|
||||
declare -grx VAR_H='"'
|
||||
|
||||
### 2050_yaml_parser.sh:
|
||||
### 1250_yaml_parser.sh:
|
||||
### Indexed Arrays for 'Debian Packages' to install and 'NTPSec Server' to use.
|
||||
declare -agx ARY_PACKAGES=()
|
||||
declare -agx ARY_NTPSRVR=()
|
||||
|
||||
### 2051_yaml_reader.sh:
|
||||
### 1251_yaml_reader.sh:
|
||||
### Variable for highest device count e.g., /dev/sdf = "f"
|
||||
declare -gx VAR_RECIPE_DEV_COUNTER=""
|
||||
### Variable for firmware ("UEFI" || "BIOS")
|
||||
|
||||
Reference in New Issue
Block a user