V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m21s
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m21s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
@@ -1,267 +0,0 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-02-13; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-ExternalRef: GIT https://cendev.eu/marc.weidner/CISS.2025.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.2025.hardened.installer framework.
|
||||
# SPDX-PackageName: CISS.2025.hardened.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
###########################################################################################
|
||||
# 3.6.1. Functions - installation - mount partition #
|
||||
###########################################################################################
|
||||
|
||||
###########################################################################################
|
||||
# Function to generate btrfs-subvolumes.
|
||||
# Globals:
|
||||
# ERR_CREAT_SUB_VOL
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# 1: MOUNT_PATH
|
||||
# 2: SUBVOLUME
|
||||
###########################################################################################
|
||||
create_btrfs_subvolume() {
|
||||
declare MOUNT_PATH="$1"
|
||||
declare SUBVOLUME="$2"
|
||||
|
||||
btrfs subvolume create "${TARGET}${MOUNT_PATH}/${SUBVOLUME}" || {
|
||||
do_log "error" "false" "Error occurred at creation of subvolume: '${SUBVOLUME}' in: '${TARGET}${MOUNT_PATH}'."
|
||||
exit "${ERR_CREAT_SUB_VOL}"
|
||||
}
|
||||
do_log "info" "false" "Created: '${SUBVOLUME}' at: '${TARGET}${MOUNT_PATH}'."
|
||||
}
|
||||
|
||||
###########################################################################################
|
||||
# Function to create the mount path and mount the respective device on it.
|
||||
# Globals:
|
||||
# ERR_MOUNTING_PATH
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# $1: MOUNT_PATH
|
||||
# $2: MOUNT_DEVICE
|
||||
# $3: MOUNT_OPTIONS
|
||||
###########################################################################################
|
||||
mount_with_dir() {
|
||||
declare MOUNT_PATH="$1"
|
||||
declare MOUNT_DEVICE="$2"
|
||||
declare MOUNT_OPTIONS="$3"
|
||||
|
||||
if [[ ${MOUNT_PATH} == "/" ]]; then
|
||||
MOUNT_PATH=""
|
||||
fi
|
||||
|
||||
# Create directory
|
||||
mkdir -p "${TARGET}${MOUNT_PATH}"
|
||||
|
||||
# Mount routine
|
||||
mount "${MOUNT_OPTIONS:+-o $MOUNT_OPTIONS}" "${MOUNT_DEVICE}" "${TARGET}${MOUNT_PATH}" || {
|
||||
do_log "error" "false" "Error occurred at mounting '${MOUNT_DEVICE}' on: '${TARGET}${MOUNT_PATH}'."
|
||||
exit "${ERR_MOUNTING_PATH}"
|
||||
}
|
||||
do_log "info" "false" "Mounted: '${MOUNT_DEVICE}' on: '${TARGET}${MOUNT_PATH}' with: '${MOUNT_OPTIONS}'."
|
||||
}
|
||||
|
||||
###########################################################################################
|
||||
# Function for mounting all partitions for debootstrap incl. generating btrfs subvolumes.
|
||||
# Globals:
|
||||
# ERR_MOUNTING_ROOT
|
||||
# ERR_NO_DEVIC_PATH
|
||||
# ERR_NO_ENCR_LABEL
|
||||
# MAP_EPHEMERAL_DEV
|
||||
# MAP_MOUNTPATH_DEV
|
||||
# MODULE_ERR
|
||||
# MODULE_TXT
|
||||
# RECIPE_STRING
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
###########################################################################################
|
||||
3_6_1_functions_installation_mount_partition() {
|
||||
declare -g -x MODULE_ERR="3_6_1_functions_installation_mount_partition"
|
||||
declare -g -x MODULE_TXT="Mounting all partitions for debootstrap incl. generating btrfs subvolumes"
|
||||
do_show_header "${MODULE_TXT}"
|
||||
|
||||
# Mount "/"-filesystem
|
||||
declare -r MOUNT_PATH_ROOT="/"
|
||||
if [[ -n ${MAP_MOUNTPATH_DEV[$MOUNT_PATH_ROOT]} ]]; then
|
||||
mount_with_dir "${MOUNT_PATH_ROOT}" "${MAP_MOUNTPATH_DEV[$MOUNT_PATH_ROOT]}"
|
||||
else
|
||||
do_log "error" "false" "Root-filesystem '${MOUNT_PATH_ROOT}' not found in Hashmap."
|
||||
exit "${ERR_MOUNTING_ROOT}"
|
||||
fi
|
||||
|
||||
# Ensure order of "/boot" and "/boot/efi"
|
||||
declare PATH
|
||||
for PATH in "/boot" "/boot/efi"; do
|
||||
if [[ -n ${MAP_MOUNTPATH_DEV[$PATH]} ]]; then
|
||||
mount_with_dir "${PATH}" "${MAP_MOUNTPATH_DEV[$PATH]}"
|
||||
else
|
||||
do_log "info" "false" "Entry '${PATH}' not found in Hashmap."
|
||||
fi
|
||||
done
|
||||
|
||||
# Mounting all remaining keys of hashmap 'MAP_MOUNTPATH_DEV'.
|
||||
declare KEY
|
||||
declare TRANSFORMED_STRING
|
||||
declare DEVICE_PATH
|
||||
declare ENCRYPTION_LABEL
|
||||
declare MATCHING_VAR
|
||||
|
||||
for KEY in "${!MAP_MOUNTPATH_DEV[@]}"; do
|
||||
# Initialize variables
|
||||
DEVICE_PATH="${MAP_MOUNTPATH_DEV[${KEY}]}"
|
||||
|
||||
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
|
||||
if [[ ${DEVICE_PATH} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
|
||||
|
||||
TRANSFORMED_STRING=$(echo "${DEVICE_PATH}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
|
||||
|
||||
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
elif [[ ${DEVICE_PATH} =~ ^/dev/mapper/ ]]; then
|
||||
|
||||
# Extract ENCRYPTION_LABEL
|
||||
ENCRYPTION_LABEL="${DEVICE_PATH#/dev/mapper/}"
|
||||
|
||||
# Search matching variable of sourced "${PRESEED}" variable file
|
||||
MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${ENCRYPTION_LABEL}")
|
||||
|
||||
if [[ -n ${MATCHING_VAR} ]]; then
|
||||
|
||||
# Extract third, fourth and fifth part of the respective variable
|
||||
TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_([^_]+_[^_]+_[^_]+)_.*|\1|')
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${ENCRYPTION_LABEL}'."
|
||||
exit "${ERR_NO_ENCR_LABEL}"
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${DEVICE_PATH}'."
|
||||
exit "${ERR_NO_DEVIC_PATH}"
|
||||
|
||||
fi
|
||||
|
||||
declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
|
||||
declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
|
||||
declare ENCRYPTION_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_encryption_label"
|
||||
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
|
||||
declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
|
||||
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
|
||||
declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"
|
||||
|
||||
declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
|
||||
declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
|
||||
declare ENCRYPTION_LABEL=${!ENCRYPTION_LABEL_VAR}
|
||||
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
|
||||
declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
|
||||
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
|
||||
declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
|
||||
|
||||
# Skip already mounted paths ("/", "/boot", "/boot/efi")
|
||||
if [[ ${KEY} == "/" || ${KEY} == "/boot" || ${KEY} == "/boot/efi" ]]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION,,} == "btrfs" ]]; then
|
||||
|
||||
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
|
||||
mount_with_dir "${KEY}" "${DEVICE_PATH}" "${BTRFS_OPTIONS}"
|
||||
[[ -n ${MOUNT_SUBVOLUME} ]] && create_btrfs_subvolume "${KEY}" "${MOUNT_SUBVOLUME}"
|
||||
|
||||
elif [[ ${FILESYSTEM_VERSION,,} == "ext4" ]]; then
|
||||
|
||||
mount_with_dir "${KEY}" "${DEVICE_PATH}"
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "No valid filesystem: '${FILESYSTEM_VERSION}' found for ${KEY}."
|
||||
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
# Reminder: MAP_EPHEMERALLABEL_DEV["${MOUNT_PATH}"]="/dev/${DEV}${PARTITION}"
|
||||
# Mounting remaining entries of hashmap 'MAP_EPHEMERALLABEL_DEV'.
|
||||
declare KEY
|
||||
declare TRANSFORMED_STRING
|
||||
declare DEVICE_PATH
|
||||
|
||||
for KEY in "${!MAP_EPHEMERAL_DEV[@]}"; do
|
||||
# Initialize variables
|
||||
DEVICE_PATH="${MAP_EPHEMERAL_DEV[${KEY}]}"
|
||||
|
||||
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
|
||||
if [[ ${DEVICE_PATH} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
|
||||
|
||||
TRANSFORMED_STRING=$(echo "${DEVICE_PATH}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
|
||||
|
||||
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
elif [[ ${DEVICE_PATH} =~ ^/dev/mapper/ ]]; then
|
||||
|
||||
# Extract ENCRYPTION_LABEL
|
||||
ENCRYPTION_LABEL="${DEVICE_PATH#/dev/mapper/}"
|
||||
|
||||
# Search matching variable of sourced "${PRESEED}" variable file
|
||||
MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${ENCRYPTION_LABEL}")
|
||||
|
||||
if [[ -n ${MATCHING_VAR} ]]; then
|
||||
|
||||
# Extract third, fourth and fifth part of the respective variable
|
||||
TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${ENCRYPTION_LABEL}'."
|
||||
exit "${ERR_NO_ENCR_LABEL}"
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${DEVICE_PATH}'."
|
||||
exit "${ERR_NO_DEVIC_PATH}"
|
||||
|
||||
fi
|
||||
|
||||
declare ENCRYPTION_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_encryption_label"
|
||||
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
|
||||
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
|
||||
declare ENCRYPTION_LABEL=${!ENCRYPTION_LABEL_VAR}
|
||||
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
|
||||
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
|
||||
|
||||
if [[ ${KEY} == "SWAP" ]]; then
|
||||
|
||||
cryptsetup open --type plain --key-file /dev/random \
|
||||
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
|
||||
--sector-size 4096 "/dev/disk/by-label/${FILESYSTEM_LABEL}" "${ENCRYPTION_LABEL}"
|
||||
mkswap "/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
swapon "/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
do_log "info" "false" "Mounted: '${KEY}' on: '/dev/mapper/${ENCRYPTION_LABEL}'."
|
||||
|
||||
elif [[ ${KEY} == "/tmp" ]]; then
|
||||
|
||||
cryptsetup open --type plain --key-file /dev/random \
|
||||
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
|
||||
--sector-size 4096 "/dev/disk/by-label/${FILESYSTEM_LABEL}" "${ENCRYPTION_LABEL}"
|
||||
mkdir -p "${TARGET}/tmp"
|
||||
mount "${MOUNT_OPTIONS:+-o $MOUNT_OPTIONS}" "/dev/mapper/${ENCRYPTION_LABEL}" "${TARGET}/tmp"
|
||||
do_log "info" "false" "Mounted: '${KEY}' on: '/dev/mapper/${ENCRYPTION_LABEL}'."
|
||||
|
||||
else
|
||||
do_log "warn" "false" "Ephemeral configuration for ${KEY} is not valid or disabled."
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
do_log "info" "false" "All devices of 'MAP_MOUNTPATH_DEV' and 'MAP_EPHEMERALLABEL_DEV' successfully mounted."
|
||||
|
||||
do_show_footer "${MODULE_TXT}"
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
|
||||
Reference in New Issue
Block a user