V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/1220_validation_element.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Checks if a search pattern / string / value is present in an array.
+# Arguments:
+#   1: String to check against:
+#   2: "$@" Array
+# Returns:
+#   0: If String is present in Array.
+#   1: If String is NOT present in Array.
+#######################################
+validation_array() {
+  declare var_element
+  declare var_string=$1; shift
+  for var_element in "$@"; do
+    if [[ "${var_element}" == "${var_string}" ]]; then
+      return 0
+    fi
+  done
+  return 1
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/1222_validation_preseed.sh

@@ -60,4 +60,4 @@ validation_preseed() {
 
   return 0
 }
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/3200_partitioning.sh

@@ -15,19 +15,23 @@ guard_sourcing
 #######################################
 # Function that generates each partition on each device according to the chosen recipe string.
 # Globals:
-#   ERR_PARTITIONTBL
-#   ERR_READ_PARTTBL
-#   HMP_UUID_PARTITION
-#   RECIPE_STRING
+#   HMP_PATH_PARTUUID
+#   VAR_RECIPE_STRING
 #   VAR_RECIPE_TABLE
 #   VAR_SETUP_PART
 # Arguments:
-#  None
+#   None
+# Returns:
+#   "${ERR_PARTITIONTBL}"
+#   "${ERR_PART_CREATE}"
+#   "${ERR_PART_READ}"
+#   "${ERR_TABLE_CREATE}"
+#   "${ERR_TABLE_DELETE}"
 #######################################
 partitioning() {
   ### Declare Arrays and Variables.
-  declare -Ag HMP_UUID_PARTITION
-  declare var_dev var_part var_end_arg var_begin var_end var_fs var_boot var_pri var_uuid
+  declare -Ag HMP_PATH_PARTUUID
+  declare var_dev var_part var_end_arg var_begin var_end var_fs var_boot var_pri var_uuid var_mount_path
   declare -a ary_devs ary_parts
 
   ### Iterate over all devices in the recipe.
@@ -68,6 +72,7 @@ partitioning() {
       var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
       var_boot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.bootable"         "${VAR_SETUP_PART}")
       var_pri=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.primary"           "${VAR_SETUP_PART}")
+      var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
 
       ### Generate partition.
       if [[ "${var_end}" == "-1" ]]; then
@@ -89,15 +94,13 @@ partitioning() {
         do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' marked as bootable."
       fi
 
-      ### Read UUID of the newly created partition
+      ### Store UUID of the partition.
       var_uuid=$(blkid -s UUID -o value "/dev/${var_dev}${var_part}")
       if [[ -z "${var_uuid}" ]]; then
         do_log "fatal" "false" "WARNING: could not read UUID for '/dev/${var_dev}${var_part}'."
         return "${ERR_PART_READ}"
       else
-        ### Store UUID in an associative array.
-        HMP_UUID_PARTITION["UUID_${var_dev}${var_part}"]="${var_uuid}"
-        do_log "info" "false" "Saved in HashMap HMP_UUID_PARTITION: 'UUID_${var_dev}${var_part}' -> '${var_uuid}'."
+        HMP_PATH_PARTUUID["UUID_${var_mount_path}"]="${var_uuid}"
       fi
 
     done

func/3220_partition_encryption.sh

@@ -17,20 +17,20 @@ guard_sourcing
 # Globals:
 #   DIR_BAK
 #   DIR_CNF
-#   HMP_ENCRYPTIONLABEL_UUID
 #   HMP_EPHEMERAL_DEV
 #   HMP_EPHEMERAL_ENCLABEL
-#   HMP_MOUNTPATH_ENCRYPTIONLABEL
+#   HMP_PATH_LUKSUUID
 #   VAR_CRYPT_ROOT
 #   VAR_RECIPE_STRING
 #   VAR_SETUP_PART
 # Arguments:
 #  None
+# Returns:
+#   0: Successful
 #######################################
 partition_encryption() {
   ### Declare Arrays and Variables.
-  declare -Ag HMP_EPHEMERAL_DEV           HMP_EPHEMERAL_ENCLABEL
-  declare -Ag HMP_ENCRYPTIONLABEL_UUID    HMP_MOUNTPATH_ENCRYPTIONLABEL
+  declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_PATH_LUKSUUID
   declare var_dev var_part \
     var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_nuke var_encryption_cipher \
     var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta \
@@ -134,22 +134,18 @@ partition_encryption() {
       cryptsetup luksHeaderBackup --header-backup-file="${DIR_BAK}/luks_header_${var_dev}${var_part}.bak" "/dev/${var_dev}${var_part}"
       do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
 
-      ### Opening encrypted partition.
+      ### Opening encrypted container.
       cryptsetup luksOpen "/dev/${var_dev}${var_part}" \
         --key-file="${DIR_CNF}/password.txt" \
         "${var_encryption_label}"
       do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."
 
-      ### Store UUID of the encrypted partition
+      ### Store UUID of the LUKS container.
       # shellcheck disable=SC2155
       declare var_uuid=$(blkid -s UUID -o value "/dev/mapper/${var_encryption_label}")
       # shellcheck disable=SC2155
       [[ "${var_mount_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
-
-      HMP_ENCRYPTIONLABEL_UUID["${var_encryption_label}"]="${var_uuid}"
-      HMP_MOUNTPATH_ENCRYPTIONLABEL["${var_mount_path}"]="${var_encryption_label}"
-      do_log "info" "false" "Saved in HashMap [HMP_ENCRYPTIONLABEL_UUID]      : '${var_encryption_label}' -> '${HMP_ENCRYPTIONLABEL_UUID["${var_encryption_label}"]}'"
-      do_log "info" "false" "Saved in HashMap [HMP_MOUNTPATH_ENCRYPTIONLABEL] : '${var_mount_path}' -> '${HMP_MOUNTPATH_ENCRYPTIONLABEL["${var_mount_path}"]}'"
+      HMP_PATH_LUKSUUID["UUID_${var_mount_path}"]="${var_uuid}"
 
     done
 

func/3240_partition_formatting.sh

@@ -16,16 +16,20 @@ guard_sourcing
 # Function to format the respective partition on each device according to the recipe string chosen.
 # Globals:
 #   DIR_LOG
+#   HMP_PATH_FSUUID
 #   VAR_RECIPE_STRING
 #   VAR_SETUP_PART
 # Arguments:
 #   None
+# Returns:
+#   0: Successful
 #######################################
 partition_formatting() {
   ### Declare Arrays and Variables.
+  declare -Ag HMP_PATH_FSUUID
   declare var_dev var_part \
     var_encryption_enable var_encryption_label var_fs_btrfs_checksum var_fs_btrfs_compress var_fs_btrfs_dedup \
-    var_fs_format var_fs_label var_fs_options var_fs_version var_mount_path var_node
+    var_fs_format var_fs_label var_fs_options var_fs_version var_mount_path var_node var_fs_uuid
   declare -a ary_devs ary_parts ary_opts ary_fmt_opts
 
   ### Iterate over all devices in the recipe.
@@ -74,6 +78,8 @@ partition_formatting() {
           do_log "info" "false" "Partition: '${var_node}' formatted: btrfs."
           echo "Partition: '${var_node}':" >> "${DIR_LOG}/btrfs.log"
           btrfs filesystem show "${var_node}" >> "${DIR_LOG}/btrfs.log"
+          var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
+          HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"
           ;;
 
         ext4)

func/3260_setup_filesystem.sh

@@ -62,7 +62,7 @@ setup_filesystem() {
 
       fi
 
-      HMP_MOUNTPATH_DEV["$var_mount_path"]="${var_node}"
+      HMP_MOUNTPATH_DEV["${var_mount_path}"]="${var_node}"
       do_log "info" "false" "Saved in HashMap HMP_MOUNTPATH_DEV: '${var_mount_path}' -> '${HMP_MOUNTPATH_DEV["${var_mount_path}"]}'"
 
     done

func/3280_mount_partition.sh

@@ -176,16 +176,7 @@ mount_partition() {
           --offset 2048 --cipher aes-xts-plain64 --key-size 512 \
           --sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
         mkdir -p "${TARGET}/tmp"
-
-        if [[ -n "${var_fs_options}" ]]; then
-
-          mkfs.ext4 -O "${var_fs_options}" "/dev/mapper/${var_encryption_label}"
-
-        else
-
-          mkfs.ext4 "/dev/mapper/${var_encryption_label}"
-
-        fi
+        mkfs.ext4 "/dev/mapper/${var_encryption_label}"
 
         ### Build the command in an array to keep word boundaries intact
         declare -a ary_cmd2=(mount)

func/4040_generate_fstab.sh

@@ -41,332 +41,175 @@ generate_fstab() {
 # systemd generates mount units based on this file, see systemd.mount(5).
 # Please run 'systemctl daemon-reload' after making changes here.
 #
-# <file system> <mount point>   <type>  <options>       <dump>  <pass>
+# <file system>                            <mount point>  <type>       <options>                                  <dump>  <pass>
+
+# Secure tmpfs mounts for a hardened system
+# Mount the proc filesystem to provide process and kernel information
+proc                                       /proc          proc         nodev,nosuid,noexec,hidepid=2                         0 0
+# Mount sysfs to expose kernel device information to user space
+sysfs                                      /sys           sysfs        defaults                                              0 0
+# Mount the devpts filesystem to enable pseudo-terminal support for user sessions
+devpts                                     /dev/pts       devpts       gid=5,mode=620                                        0 0
+# Restrict /dev/shm to shared memory, limit size, prevent code execution
+tmpfs                                      /dev/shm       tmpfs        rw,nodev,noexec,nosuid,relatime,size=1G               0 0
+# System runtime directory in RAM; do not set noexec here for compatibility
+tmpfs                                      /run           tmpfs        mode=0755,nodev,nosuid                                0 0
 
 EOF
 
   ### Generate '${TARGET}/etc/fstab' special entries '/' '/boot' '/boot/efi'.
   ### Define the order of the special paths.
-  declare -a var_path_order ary_devs ary_parts
-  declare var_dev var_part
+  declare -a ary_path_order; ary_path_order=("/" "/boot" "/boot/efi")
+  declare -a ary_skip=("/" "/boot" "/boot/efi" "/recovery")
+  declare var_path var_entry var_part var_dev var_key var_uuid var_fs_btrfs_compress var_fs_btrfs_level var_fs_btrfs_subvolume \
+    var_fs_version var_mount_options var_mount_optsnap var_btrfs_compression
 
-  var_path_order=("/" "/boot" "/boot/efi")
+  for var_path in "${ary_path_order[@]}"; do
 
-  ### Iterate over all devices in the recipe.
-  readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
-  for var_dev in "${ary_devs[@]}"; do
+    var_entry=$(yq e -r '.recipe.*.dev.* | select(.mount.path == "'"${var_path}"'")' "${VAR_SETUP_PART}")
 
-    ### Iterate over all partitions for this device.
-    readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
-    for var_part in "${ary_parts[@]}"; do
-
-      ### Extract parameters from YAML.
-      var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress"   "${VAR_SETUP_PART}")
-      var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level"         "${VAR_SETUP_PART}")
-      var_fs_btrfs_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.subvolume" "${VAR_SETUP_PART}")
-      var_fs_btrfs_snapshot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.snapshot"   "${VAR_SETUP_PART}")
-      var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable"           "${VAR_SETUP_PART}")
-      var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label"             "${VAR_SETUP_PART}")
-      var_fs_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label"                     "${VAR_SETUP_PART}")
-      var_fs_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.options"                 "${VAR_SETUP_PART}")
-      var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"                 "${VAR_SETUP_PART}")
-      var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                         "${VAR_SETUP_PART}")
-      var_mount_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options"                   "${VAR_SETUP_PART}")
-      var_mount_optsnap=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.optsnap"                   "${VAR_SETUP_PART}")
-
-      case "${var_mount_path,,}" in
-
-        /)
-
-          case "${var_fs_version,,}" in
-
-            btrfs)
-
-              declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
-              # shellcheck disable=2129
-              echo "# ${var_mount_path} was on ${MAP_MOUNTPATH_DEV[${var_mount_path}]} during installation" >> "${TARGET}/etc/fstab"
-              echo "# ${var_mount_path} was on ${var_device_uuid} during installation" >> "${TARGET}/etc/fstab"
-              echo "${HMP_MOUNTPATH_DEV[${var_mount_path}]}  ${var_mount_path}  ${var_fs_version}  ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME}  0  1" >> "${TARGET}/etc/fstab"
-              echo "" >> "${TARGET}/etc/fstab"
-              do_log "info" "false" "fstab entry generated: '${MAP_MOUNTPATH_DEV[${var_path}]}  ${var_path}  ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME}  0  1'."
-              ;;
-
-          esac
-
-        esac
-
-    done
-
-  done
-
-
-
-
-  ### Reminder ###
-  # HMP_MOUNTPATH_DEV["${MOUNT_PATH}"]="/dev/mapper/${ENCRYPTION_LABEL}"
-  # HMP_MOUNTPATH_DEV["${MOUNT_PATH}"]="/dev/${DEV}${PARTITION}"
-
-  ### Generate '${TARGET}/etc/fstab' special entries '/' '/boot' '/boot/efi'.
-  ### Define the order of the special paths.
-  declare -a var_path_order
-  var_path_order=("/" "/boot" "/boot/efi")
-
-  declare var_device_path var_device_uuid var_encryption_label var_path
-  declare MATCHING_VAR
-  declare TRANSFORMED_STRING
-
-  for var_path in "${var_path_order[@]}"; do
-    # Initialize variables
-    var_device_path="${HMP_MOUNTPATH_DEV[${var_path}]}"
-    var_device_uuid=$(blkid -s UUID -o value "${var_device_path}")
-
-    # if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
-    if [[ ${var_device_path} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
-
-      TRANSFORMED_STRING=$(echo "${var_device_path}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
-
-    # if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
-    elif [[ ${var_device_path} =~ ^/dev/mapper/ ]]; then
-
-      # Extract ENCRYPTION_LABEL
-      var_encryption_label="${var_device_path#/dev/mapper/}"
-
-      # Search matching variable of a sourced "${PRESEED}" variable file
-      MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${var_encryption_label}")
-
-      if [[ -n ${MATCHING_VAR} ]]; then
-
-        # Extract third, fourth and fifth part of the respective variable
-        TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
-
-      else
-
-        do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${var_encryption_label}'."
-        exit "${ERR_NO_ENCR_LABEL}"
-
-      fi
-
-    else
-
-      do_log "error" "false" "Unknown DEVICE_PATH-Format: '${var_device_path}'."
-      exit "${ERR_NO_DEVIC_PATH}"
-
-    fi
-
-    declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
-    declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
-    declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
-    declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
-    declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
-    declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"
-
-    declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
-    declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
-    declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
-    declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
-    declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
-    declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
-
-    if [[ ${var_path} == "/" ]]; then
-
-      if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
-
-        declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
-        # shellcheck disable=2129
-        echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
-        echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
-        echo "${MAP_MOUNTPATH_DEV[${var_path}]}  ${var_path}  ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME}  0  1" >> "${TARGET}"/etc/fstab
-        echo "" >> "${TARGET}"/etc/fstab
-        do_log "info" "false" "fstab entry generated: '${MAP_MOUNTPATH_DEV[${var_path}]}  ${var_path}  ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME}  0  1'."
-
-      elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
-
-        # shellcheck disable=2129
-        echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
-        echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
-        echo "${MAP_MOUNTPATH_DEV[${var_path}]}  ${var_path}  ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS}  0  1" >> "${TARGET}"/etc/fstab
-        echo "" >> "${TARGET}"/etc/fstab
-        do_log "info" "false" "fstab entry generated: '${MAP_MOUNTPATH_DEV[${var_path}]}  ${var_path} ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS}  0  1'."
-
-      else
-
-        do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${var_path}'."
-
-      fi
-
-    elif [[ ${var_path} == "/boot" ]]; then
-
-      if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
-
-        declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
-        # shellcheck disable=2129
-        echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
-        echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
-        echo "UUID=${var_device_uuid}  ${var_path}  ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME}  0  2" >> "${TARGET}"/etc/fstab
-        echo "" >> "${TARGET}"/etc/fstab
-        do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid}  ${var_path}  ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME}  0  2'."
-
-      elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
-
-        # shellcheck disable=2129
-        echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
-        echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
-        echo "UUID=${var_device_uuid}  ${var_path}  ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS}  0  2" >> "${TARGET}"/etc/fstab
-        echo "" >> "${TARGET}"/etc/fstab
-        do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid}  ${var_path}  ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS}  0  2'."
-
-      else
-
-        do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${var_path}'."
-
-      fi
-
-    elif [[ ${var_path} == "/boot/efi" ]]; then
-
-      if [[ ${FILESYSTEM_VERSION} == "fat32" ]]; then
-
-        # shellcheck disable=2129
-        echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
-        echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
-        echo "UUID=${var_device_uuid}  ${var_path}  vfat  umask=0077  0  2" >> "${TARGET}"/etc/fstab
-        echo "" >> "${TARGET}"/etc/fstab
-        do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid}  ${var_path}  vfat umask=0077  0  2'."
-
-      else
-
-        do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${var_path}'."
-
-      fi
-
-    else
-
-      do_log "error" "false" "fstab entry - no valid '${var_path}' for '/', '/boot', '/boot/efi' found."
-
-    fi
-
-  done
-
-  # Generate '${TARGET}/etc/fstab' remaining entries
-  for var_path in "${!MAP_MOUNTPATH_DEV[@]}"; do
-
-    # Initialize variables
-    var_device_path="${MAP_MOUNTPATH_DEV[${var_path}]}"
-    var_device_uuid=$(blkid -s UUID -o value "${var_device_path}")
-
-    # if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
-    if [[ ${var_device_path} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
-
-      TRANSFORMED_STRING=$(echo "${var_device_path}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
-
-    # if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
-    elif [[ ${var_device_path} =~ ^/dev/mapper/ ]]; then
-
-      # Extract ENCRYPTION_LABEL
-      var_encryption_label="${var_device_path#/dev/mapper/}"
-
-      # Search matching variable of a sourced "${PRESEED}" variable file
-      MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${var_encryption_label}")
-
-      if [[ -n ${MATCHING_VAR} ]]; then
-
-        # Extract third, fourth and fifth part of the respective variable
-        TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
-
-      else
-
-        do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${var_encryption_label}'."
-        exit "${ERR_NO_ENCR_LABEL}"
-
-      fi
-
-    else
-
-      do_log "error" "false" "Unknown DEVICE_PATH-Format: '${var_device_path}'."
-      exit "${ERR_NO_DEVIC_PATH}"
-
-    fi
-
-    declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
-    declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
-    declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
-    declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
-    declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
-    declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"
-
-    declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
-    declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
-    declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
-    declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
-    declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
-    declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
-
-    # Skip already mounted paths ("/", "/boot", "/boot/efi")
-    if [[ " ${var_path_order[*]} " == *" ${var_path} "* ]]; then
+    if [[ -z "${var_entry}" ]]; then
       continue
     fi
 
-    if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
+    var_part=$(echo "${var_entry}" | yq e 'path | .[-2]' -)
+    var_dev=$(yq e '.recipe.*.dev | keys[0]' "${VAR_SETUP_PART}")
+    var_key="UUID_${var_path}"
+    var_uuid="${HMP_PATH_FSUUID[${var_key}]}"
+    var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress"   "${VAR_SETUP_PART}")
+    var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level"         "${VAR_SETUP_PART}")
+    var_fs_btrfs_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.subvolume" "${VAR_SETUP_PART}")
+    var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"                 "${VAR_SETUP_PART}")
+    var_mount_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options"                   "${VAR_SETUP_PART}")
+    var_mount_optsnap=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.optsnap"                   "${VAR_SETUP_PART}")
 
-      declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
-      # shellcheck disable=2129
-      echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
-      echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
-      echo "UUID=${var_device_uuid}  ${var_path}  ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME}  0  2" >> "${TARGET}"/etc/fstab
+    if [[ "${var_fs_version,,}" == btrfs ]]; then
+
+      if [[ "${var_fs_btrfs_level}" -eq 0 ]]; then
+        var_btrfs_compression="compress=no"
+      else
+        var_btrfs_compression="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
+      fi
+
+      echo "UUID=${var_uuid}    ${var_path}    ${var_fs_version}    ${var_mount_options},${var_btrfs_compression}    0 1" >> "${TARGET}/etc/fstab"
+      do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid}    ${var_path}    ${var_fs_version}    ${var_mount_options},${var_btrfs_compression}    0 1'."
+
+      if [[ -n "${var_fs_btrfs_subvolume}" ]]; then
+
+        if [[ "${var_path}" == "/" ]]; then
+
+          echo "UUID=${var_uuid}    /.snapshots    ${var_fs_version}    ${var_mount_optsnap}    0 0" >> "${TARGET}/etc/fstab"
+          do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid}    /.snapshots    ${var_fs_version}    ${var_mount_optsnap}    0 0'."
+
+        else
+
+          echo "UUID=${var_uuid}    ${var_path}/.snapshots    ${var_fs_version}    ${var_mount_optsnap}    0 0" >> "${TARGET}/etc/fstab"
+          do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid}    ${var_path}/.snapshots    ${var_fs_version}    ${var_mount_optsnap}    0 0'."
+
+        fi
+
+      fi
+
+      echo "" >> "${TARGET}/etc/fstab"
+      continue
+
+    elif [[ "${var_fs_version,,}" == ext4 ]]; then
+
+      echo "UUID=${var_uuid}    ${var_path}    ${var_fs_version}    ${var_mount_options}    0 1" >> "${TARGET}/etc/fstab"
+      do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid}    ${var_path}    ${var_fs_version}    ${var_mount_options}    0 1'."
+      echo "" >> "${TARGET}/etc/fstab"
+      continue
+
+    elif [[ "${var_fs_version,,}" == fat32 ]]; then
+
+      echo "UUID=${var_uuid}    ${var_path}    vfat    ${var_mount_options}    0 2" >> "${TARGET}"/etc/fstab
+      do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid}    ${var_path}    vfat    ${var_mount_options}    0 2'."
       echo "" >> "${TARGET}"/etc/fstab
-      do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid}  ${var_path}  ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME}  0  2'."
-
-    elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
-
-      # shellcheck disable=2129
-      echo "# ${var_path} was on ${MAP_MOUNTPATH_DEV[${var_path}]} during installation" >> "${TARGET}"/etc/fstab
-      echo "# ${var_path} was on ${var_device_uuid} during installation" >> "${TARGET}"/etc/fstab
-      echo "UUID=${var_device_uuid}  ${var_path}  ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS}  0  2" >> "${TARGET}"/etc/fstab
-      echo "" >> "${TARGET}"/etc/fstab
-      do_log "info" "false" "fstab entry generated: 'UUID=${var_device_uuid}  ${var_path}  ${FILESYSTEM_VERSION}  ${MOUNT_OPTIONS}  0  2'."
-
-    else
-
-      do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${var_path}'."
+      continue
 
     fi
 
   done
 
-  # TODO: flexible entries for more than one CD-ROM drives.
-  # Add entry for CD-ROM device
-  # shellcheck disable=2129
-  echo "# /media/cdrom0 was on /dev/sr0 during installation" >> "${TARGET}"/etc/fstab
-  echo "/dev/sr0  /media/cdrom0  udf,iso9660  user,noauto  0  0" >> "${TARGET}"/etc/fstab
-  echo "" >> "${TARGET}"/etc/fstab
-  do_log "info" "false" "fstab entry generated: '/dev/sr0  /media/cdrom0  udf,iso9660  user,noauto  0  0'."
+  ### Generate '${TARGET}/etc/fstab' remaining entries
+  for var_path in "${!MAP_MOUNTPATH_DEV[@]}"; do
 
-  # Add entry for proc and tmpfs device
-  # shellcheck disable=2129
-  echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
-  echo "proc  /proc  proc  nodev,nosuid,noexec,hidepid=2  0  0" >> "${TARGET}"/etc/fstab
-  echo "tmpfs  /dev/shm  tmpfs  rw,nodev,nosuid,noexec,relatime,size=1G  0  0" >> "${TARGET}"/etc/fstab
-  echo "" >> "${TARGET}"/etc/fstab
-  do_log "info" "false" "fstab entry generated: 'proc  /proc  proc  nodev,nosuid,noexec,hidepid=2  0  0'."
-  do_log "info" "false" "fstab entry generated: 'tmpfs  /dev/shm  tmpfs  rw,nodev,nosuid,noexec,relatime,size=1G  0  0'."
+    if validation_array "${var_path}" "${ary_skip[@]}"; then
+      continue
+    fi
 
-  # TODO: flexible 'SWAP' entry, not only ephemeral SWAP.
-  # Add entry for SWAP device
-  declare MOUNT_PATH="SWAP"
-  # shellcheck disable=2129
-  echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
-  echo "${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]}  none  swap  defaults  0  0" >> "${TARGET}"/etc/fstab
-  echo "" >> "${TARGET}"/etc/fstab
-  do_log "info" "false" "fstab entry generated: '${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]}  none  swap  defaults  0  0'."
+    var_entry=$(yq e -r '.recipe.*.dev.* | select(.mount.path == "'"${var_path}"'")' "${VAR_SETUP_PART}")
 
-  # TODO: flexible '/tmp' entry, not only ephemeral SWAP.
-  # Add entry for '/tmp' device
-  declare MOUNT_PATH="/tmp"
-  # shellcheck disable=2129
-  echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
-  echo "${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]}  /tmp  ext4  defaults,rw,nodev,nosuid,relatime  0  0" >> "${TARGET}"/etc/fstab
-  echo "" >> "${TARGET}"/etc/fstab
-  do_log "info" "false" "fstab entry generated: '${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]}  /tmp  ext4  defaults,rw,nodev,nosuid,relatime  0  0'."
+    if [[ -z "${var_entry}" ]]; then
+      continue
+    fi
 
-  do_show_footer "${MODULE_TXT}"
+    var_part=$(echo "${var_entry}" | yq e 'path | .[-2]' -)
+    var_dev=$(yq e '.recipe.*.dev | keys[0]' "${VAR_SETUP_PART}")
+    var_key="UUID_${var_path}"
+    var_uuid="${HMP_PATH_FSUUID[${var_key}]}"
+    var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress"   "${VAR_SETUP_PART}")
+    var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level"         "${VAR_SETUP_PART}")
+    var_fs_btrfs_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.subvolume" "${VAR_SETUP_PART}")
+    var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"                 "${VAR_SETUP_PART}")
+    var_mount_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options"                   "${VAR_SETUP_PART}")
+    var_mount_optsnap=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.optsnap"                   "${VAR_SETUP_PART}")
+
+    if [[ "${var_fs_version,,}" == btrfs ]]; then
+
+      if [[ "${var_fs_btrfs_level}" -eq 0 ]]; then
+        var_btrfs_compression="compress=no"
+      else
+        var_btrfs_compression="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
+      fi
+
+      echo "UUID=${var_uuid}    ${var_path}    ${var_fs_version}    ${var_mount_options},${var_btrfs_compression}    0 2" >> "${TARGET}/etc/fstab"
+      do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid}    ${var_path}    ${var_fs_version}    ${var_mount_options},${var_btrfs_compression}    0 2'."
+
+      if [[ -n "${var_fs_btrfs_subvolume}" ]]; then
+
+        echo "UUID=${var_uuid}    ${var_path}/.snapshots    ${var_fs_version}    ${var_mount_optsnap}    0 0" >> "${TARGET}/etc/fstab"
+        do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid}    ${var_path}/.snapshots    ${var_fs_version}    ${var_mount_optsnap}    0 0'."
+
+      fi
+
+      echo "" >> "${TARGET}/etc/fstab"
+      continue
+
+    elif [[ "${var_fs_version,,}" == ext4 ]]; then
+
+      echo "UUID=${var_uuid}    ${var_path}    ${var_fs_version}    ${var_mount_options}    0 2" >> "${TARGET}/etc/fstab"
+      do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid}    ${var_path}    ${var_fs_version}    ${var_mount_options}    0 2'."
+      echo "" >> "${TARGET}/etc/fstab"
+      continue
+
+    elif [[ "${var_fs_version,,}" == fat32 ]]; then
+
+      echo "UUID=${var_uuid}    ${var_path}    vfat    ${var_mount_options}    0 2" >> "${TARGET}"/etc/fstab
+      do_log "info" "false" "fstab entry generated: 'UUID=${var_uuid}    ${var_path}    vfat    ${var_mount_options}    0 2'."
+      echo "" >> "${TARGET}"/etc/fstab
+      continue
+
+    fi
+
+  done
+
+  cat << 'EOF' >> "${TARGET}/etc/fstab"
+/dev/sr0                                   /media/cdrom0  udf,iso9660  user,noauto                                           0 0
+
+EOF
+  do_log "info" "false" "fstab entry generated: '/dev/sr0  /media/cdrom0  udf,iso9660  user,noauto  0 0'."
+
+  ### Add entry for SWAP device.
+  var_path="SWAP"
+  echo "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}  none  swap  defaults  0 0" >> "${TARGET}/etc/fstab"
+  echo "" >> "${TARGET}/etc/fstab"
+  do_log "info" "false" "fstab entry generated: '/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}  none  swap  defaults  0 0'."
+
+  ### Add entry for '/tmp' device.
+  var_path="/tmp"
+  echo "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}  /tmp  ext4  defaults,rw,nodev,nosuid,relatime  0 0" >> "${TARGET}/etc/fstab"
+  echo "" >> "${TARGET}/etc/fstab"
+  do_log "info" "false" "fstab entry generated: '/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}  /tmp  ext4  defaults,rw,nodev,nosuid,relatime  0 0'."
 }
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh