V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
2025-07-08 20:53:47 +02:00
parent e63e343bc7
commit 6d255e9c07
21 changed files with 158 additions and 68 deletions

View File

@@ -13,11 +13,13 @@
guard_sourcing
#######################################
# Specify the NIC interactively for setup.
# Specify the network interface card (NIC) interactively for setup.
# Globals:
# DIR_TMP
# Arguments:
# None
# None
# Returns:
# 0: Successfully executed commands.
#######################################
check_nic() {
ip -o link show | awk -F': ' '{print $2}' | sed 's!lo!!' | sed '/^$/d' | awk '{$1=$1};1' >| "${DIR_TMP}nic.tmp"
@@ -35,6 +37,7 @@ check_nic() {
var_nic=$(dialog --ascii-lines --clear --backtitle "Specify the NIC for setup" --radiolist "NIC available" 0 0 ${var_counter} ${var_radiolist} 3>&1 1>&2 2>&3)
clear
do_log "info" "false" "You have selected: '${var_nic}' - proceeding with setup."
do_log "info" "true" "You have selected: '${var_nic}' - proceeding with setup."
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

View File

@@ -52,7 +52,7 @@ grub_extract_current_string() {
grub_finalize_string() {
VAR_GRUB_CMDLINE_LINUX="${VAR_GRUB_CMDLINE_LINUX}${VAR_H}"
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT}${VAR_H}"
sed -i "s/$VAR_ORIG_GRUB_CMDLINE_LINUX/$VAR_GRUB_CMDLINE_LINUX/" "${TARGET}/etc/default/grub"
sed -i "s/$VAR_ORIG_GRUB_CMDLINE_LINUX_DEFAULT/$VAR_GRUB_CMDLINE_LINUX_DEFAULT/" "${TARGET}/etc/default/grub"
sed -i "s/${VAR_ORIG_GRUB_CMDLINE_LINUX}/${VAR_GRUB_CMDLINE_LINUX}/" "${TARGET}/etc/default/grub"
sed -i "s/${VAR_ORIG_GRUB_CMDLINE_LINUX_DEFAULT}/${VAR_GRUB_CMDLINE_LINUX_DEFAULT}/" "${TARGET}/etc/default/grub"
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

View File

@@ -15,9 +15,9 @@ guard_sourcing
#######################################
# Helper Module to generate a Subnet Mask out of an IP in CCDIR Notation.
# Arguments:
# $1: IPv4 in CCDIR Notation, e.g.,: 192.168.128.128/24
# 1: IPv4 in CCDIR Notation, e.g.,: 192.168.128.128/24
# Returns:
# 0 : In every case a zero return value is delivered.
# 0: In every case a zero return value is delivered.
#######################################
generate_subnetmask() {
declare var_arg="$1"

View File

@@ -17,8 +17,8 @@ guard_sourcing
# Globals:
# C_RES
# Arguments:
# $1: One of "${C_BLA}" | "${C_RED}" | "${C_GRE}" | "${C_YEL}" | "${C_BLU}" | "${C_MAG}" | "${C_CYA}" | "${C_WHI}"
# $2: Text string to print on terminal.
# 1: One of "${C_BLA}" | "${C_RED}" | "${C_GRE}" | "${C_YEL}" | "${C_BLU}" | "${C_MAG}" | "${C_CYA}" | "${C_WHI}"
# 2: Text string to print on terminal.
#######################################
do_print_color() {
printf "%s\n" "${1}${2}${C_RES}"
@@ -29,8 +29,8 @@ do_print_color() {
# Globals:
# C_RES
# Arguments:
# $1: One of "${C_BLA}" | "${C_RED}" | "${C_GRE}" | "${C_YEL}" | "${C_BLU}" | "${C_MAG}" | "${C_CYA}" | "${C_WHI}"
# $2: Text string to print on terminal.
# 1: One of "${C_BLA}" | "${C_RED}" | "${C_GRE}" | "${C_YEL}" | "${C_BLU}" | "${C_MAG}" | "${C_CYA}" | "${C_WHI}"
# 2: Text string to print on terminal.
#######################################
do_print_fold() {
declare var_color="$1"; shift
@@ -42,7 +42,7 @@ do_print_fold() {
#######################################
# Wrapper around 'printf' for logfile redirect.
# Arguments:
# $1: Text string to redirect to a log file.
# 1: Text string to redirect to a log file.
#######################################
do_print_log() {
printf "%s\n" "${1}"

View File

@@ -15,7 +15,7 @@ guard_sourcing
#######################################
# Remove any leading or trailing whitespace.
# Arguments:
# $1: String to clean.
# 1: String to clean.
#######################################
remove_whitespace() {
# shellcheck disable=SC2155
@@ -26,7 +26,7 @@ remove_whitespace() {
#######################################
# Function to escape all shell metacharacters
# Arguments:
# $1: String to Sanitize
# 1: String to Sanitize
#######################################
sanitize_input() {
declare input="$1"
@@ -37,7 +37,7 @@ sanitize_input() {
#######################################
# Function to remove any character not in the allowed set
# Arguments:
# $1: String to Sanitize
# 1: String to Sanitize
#######################################
sanitize_string() {
declare input="$1"

View File

@@ -18,8 +18,8 @@ guard_sourcing
# ERR_DOWNLOAD_FAILED
# ERR_NO_DOWNLOAD_ARG
# Arguments:
# $1: URL from which to download a specific file.
# $2: /path/to/file to be saved to.
# 1: URL from which to download a specific file.
# 2: /path/to/file to be saved to.
# Returns:
# ${ERR_DOWNLOAD_FAILED}: Download failed.
# ${ERR_NO_DOWNLOAD_ARG}: No arguments specified.
@@ -49,8 +49,8 @@ scurl() {
# ERR_DOWNLOAD_FAILED
# ERR_NO_DOWNLOAD_ARG
# Arguments:
# $1: URL from which to download a specific file.
# $2: /path/to/file to be saved to.
# 1: URL from which to download a specific file.
# 2: /path/to/file to be saved to.
# Returns:
# ${ERR_DOWNLOAD_FAILED}: Download failed.
# ${ERR_NO_DOWNLOAD_ARG}: No arguments specified.

View File

@@ -15,8 +15,8 @@ guard_sourcing
#######################################
# yq_val <YQ expression> <file> - Returns value, converts null to ""
# Arguments:
# $1: Key String to evaluate
# $2: YAML File
# 1: Key String to evaluate
# 2: YAML File
#######################################
yq_val() {
declare var_h; var_h=$(yq e "$1" "$2")

View File

@@ -15,7 +15,7 @@ guard_sourcing
#######################################
# Log level values for comparison.
# Arguments:
# $1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
# 1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
#######################################
log_level_value() {
case "${1,,}" in
@@ -35,7 +35,7 @@ log_level_value() {
# Globals:
# DEFAULT_LOG_LEVEL
# Arguments:
# $1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
# 1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
#######################################
do_should_log() {
# shellcheck disable=SC2155
@@ -56,7 +56,7 @@ do_should_log() {
# C_WHI
# C_YEL
# Arguments:
# $1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
# 1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
#######################################
do_get_log_color() {
case "${1,,}" in
@@ -75,9 +75,9 @@ do_get_log_color() {
# LOG_ERR
# LOG_INS
# Arguments:
# $1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
# $2: "${LOG_ONLY}" boolean "true" | "false"
# $@: "${MESSAGE[*]}" arbitrary text string to log.
# 1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
# 2: "${LOG_ONLY}" boolean "true" | "false"
# @: "${MESSAGE[*]}" arbitrary text string to log.
#######################################
do_log() {
declare var_log_level="$1"; shift

View File

@@ -17,7 +17,7 @@ guard_sourcing
# Globals:
# ERR_INVALID_IPV4
# Arguments:
# $1: IPv4 to validate.
# 1: IPv4 to validate.
#######################################
validation_ipv4() {
declare var_ip="$1"
@@ -38,7 +38,7 @@ validation_ipv4() {
# Globals:
# ERR_INVALID_IPV6
# Arguments:
# $1: IPv6 address
# 1: IPv6 address
#######################################
validation_ipv6() {
### Original input (may include %zone).
@@ -90,7 +90,7 @@ validation_ipv6() {
# Globals:
# ERR_INVALID_PORT
# Arguments:
# $1: Port number
# 1: Port number
#######################################
validation_port() {
declare var_port="$1"

View File

@@ -21,7 +21,7 @@ guard_sourcing
# DIR_TMP
# VAR_PRESEED
# Arguments:
# None
# None
#######################################
yaml_parser() {
cat "${DIR_CNF}/preseed.yaml" "${DIR_CNF}/partitioning.yaml" >| "${DIR_TMP}/combined.yaml"

View File

@@ -27,10 +27,11 @@ guard_sourcing
# "${ERR_PART_READ}"
# "${ERR_TABLE_CREATE}"
# "${ERR_TABLE_DELETE}"
# 0: Successfully executed commands.
#######################################
partitioning() {
### Declare Arrays and Variables.
declare -Ag HMP_PATH_PARTUUID
declare -Agx HMP_PATH_PARTUUID
declare var_dev var_part var_end_arg var_begin var_end var_fs var_boot var_pri var_uuid var_mount_path
declare -a ary_devs ary_parts

View File

@@ -19,18 +19,20 @@ guard_sourcing
# DIR_CNF
# HMP_EPHEMERAL_DEV
# HMP_EPHEMERAL_ENCLABEL
# HMP_EPHEMERAL_FS_LABEL
# HMP_PATH_ENCLABEL
# HMP_PATH_LUKSUUID
# VAR_CRYPT_ROOT
# VAR_RECIPE_STRING
# VAR_SETUP_PART
# Arguments:
# None
# None
# Returns:
# 0: Successful
# 0: Successfully executed commands.
#######################################
partition_encryption() {
### Declare Arrays and Variables.
declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_EPHEMERAL_FS_LABEL HMP_PATH_LUKSUUID HMP_PATH_ENCLABEL
declare -Agx HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_EPHEMERAL_FS_LABEL HMP_PATH_LUKSUUID HMP_PATH_ENCLABEL
declare var_dev var_part \
var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_nuke var_encryption_cipher \
var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta \
@@ -146,7 +148,7 @@ partition_encryption() {
# shellcheck disable=SC2155
[[ "${var_mount_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
HMP_PATH_LUKSUUID["UUID_${var_mount_path}"]="${var_uuid}"
HMP_PATH_ENCLABEL["UUID_${var_mount_path}"]="${var_encryption_label}"
HMP_PATH_ENCLABEL["LABEL_${var_mount_path}"]="${var_encryption_label}"
done

View File

@@ -22,11 +22,11 @@ guard_sourcing
# Arguments:
# None
# Returns:
# 0: Successful
# 0: Successfully executed commands.
#######################################
partition_formatting() {
### Declare Arrays and Variables.
declare -Ag HMP_PATH_FSUUID
declare -Agx HMP_PATH_FSUUID
declare var_dev var_part \
var_encryption_enable var_encryption_label var_fs_btrfs_checksum var_fs_btrfs_compress var_fs_btrfs_dedup \
var_fs_format var_fs_label var_fs_options var_fs_version var_mount_path var_node var_fs_uuid
@@ -88,11 +88,15 @@ partition_formatting() {
do_log "info" "false" "Partition: '${var_node}' formatted: ext4."
echo "Partition: '${var_node}':" >> "${DIR_LOG}/ext4.log"
tune2fs -l "${var_node}" >> "${DIR_LOG}/ext4.log"
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"
;;
fat32)
mkfs.fat -F 32 -n "${var_fs_label}" "${var_node}"
do_log "info" "false" "Partition: '${var_node}' formatted: FAT32."
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"
;;
*)

View File

@@ -19,7 +19,9 @@ guard_sourcing
# VAR_RECIPE_STRING
# VAR_SETUP_PART
# Arguments:
# None
# None
# Returns:
# 0: Successfully executed commands.
#######################################
setup_filesystem() {
### Declare Arrays and Variables.

View File

@@ -15,9 +15,9 @@ guard_sourcing
#######################################
# Validates var_mount_path to be processed.
# Arguments:
# $1 var_mount_path
# 1 var_mount_path
# Returns:
# 0: Skip mounting,
# 0: Skip mounting
# 1: Process mount
#######################################
skip_path() {
@@ -33,9 +33,9 @@ skip_path() {
# ERR_MOUNTING_DEV
# TARGET
# Arguments:
# $1: MOUNT_PATH
# $2: MOUNT_DEVICE
# $3: MOUNT_OPTIONS
# 1: MOUNT_PATH
# 2: MOUNT_DEVICE
# 3: MOUNT_OPTIONS
#######################################
mount_with_dir() {
declare var_mount_path="$1" var_mount_device="$2" var_mount_options="$3"
@@ -54,10 +54,10 @@ mount_with_dir() {
#######################################
# Device Path Resolver
# Arguments:
# $1: Device
# $2: Partition
# $3: Boolean Encryption
# $4: Encryption Label
# 1: Device
# 2: Partition
# 3: Boolean Encryption
# 4: Encryption Label
#######################################
resolve_device() {
declare local_var_dev="$1" local_var_partition="$2" local_var_enc_boolean="$3" local_var_enc_label="$4"
@@ -71,8 +71,8 @@ resolve_device() {
#######################################
# Validates btrfs compression algo and level.
# Arguments:
# $1 var_fs_btrfs_compress
# $2 var_fs_btrfs_level
# 1 var_fs_btrfs_compress
# 2 var_fs_btrfs_level
# Returns:
# 0: Valid combination.
# 1: Invalid combination.
@@ -88,14 +88,20 @@ validate_btrfs_compression() {
#######################################
# Function for mounting all partitions for debootstrap, including the generation of btrfs subvolumes.
# Globals:
# ERR_MOUNTING_DEV
# ERR_MOUNTING_ROOT
# HMP_MOUNTPATH_DEV
# TARGET
# VAR_RECIPE_STRING
# VAR_SAFE_MNT_BASE
# VAR_SETUP_PART
# Arguments:
# None
# None
# Returns:
# ERR_BTRFS_INITPH
# ERR_BTRFS_OPTION
# ERR_BTRFS_SUBVOL
# ERR_MOUNTING_DEV
# ERR_MOUNTING_ROOT
# 0: Successfully executed commands.
#######################################
mount_partition() {
### Mount "/"-filesystem

59
func/3290_uuid_logger.sh Normal file
View File

@@ -0,0 +1,59 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
guard_sourcing
#######################################
# Logger for all generated partition, LUKS container and file system UUIDs.
# Globals:
# HMP_PATH_ENCLABEL
# HMP_PATH_FSUUID
# HMP_PATH_PARTUUID
# LOG_UID
# Arguments:
# None
# Returns:
# 0: Successfully executed commands.
#######################################
uuid_logger() {
declare var_key var_mountpoint var_uuid
printf 'UUID Partition:\n' >> "${LOG_UID}"
for var_key in "${!HMP_PATH_PARTUUID[@]}"; do
# Remove Prefix "UUID_"
var_mountpoint="${var_key#UUID_}"
var_uuid="${HMP_PATH_PARTUUID[${var_key}]}"
# Left-aligned field width 63; "UUID=" starts directly after column 64.
printf '%-63sUUID=%s\n' "${var_mountpoint}:" "${var_uuid}" >> "${LOG_UID}"
done
printf '\n' >> "${LOG_UID}"
printf 'UUID LUKS Container:\n' >> "${LOG_UID}"
for var_key in "${!HMP_PATH_ENCLABEL[@]}"; do
var_mountpoint="${HMP_PATH_ENCLABEL[${var_key}]}"
var_uuid="${HMP_PATH_PARTUUID[${var_key}]}"
# Left-aligned field width 63; "UUID=" starts directly after column 64.
printf '%-63sUUID=%s\n' "${var_mountpoint}:" "${var_uuid}" >> "${LOG_UID}"
done
printf '\n' >> "${LOG_UID}"
printf 'UUID Filesystem:\n' >> "${LOG_UID}"
for var_key in "${!HMP_PATH_FSUUID[@]}"; do
# Remove Prefix "UUID_"
var_mountpoint="${var_key#UUID_}"
var_uuid="${HMP_PATH_FSUUID[${var_key}]}"
# Left-aligned field width 63; "UUID=" starts directly after column 64.
printf '%-63sUUID=%s\n' "${var_mountpoint}:" "${var_uuid}" >> "${LOG_UID}"
done
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

View File

@@ -15,14 +15,13 @@ guard_sourcing
#######################################
# Install minimal Debian environment via 'debootstrap' command.
# Globals:
# ERR_DEBOOTSTRAP
# TARGET
# architecture
# distribution
# Arguments:
# None
# Returns:
# "${ERR_DEBOOTSTRAP}"
# ERR_DEBOOTSTRAP
# 0: Successfully executed commands.
#######################################
func_debootstrap() {

View File

@@ -1,18 +1,16 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-02-13; WEIDNER, Marc S.; <cendev@coresecret.eu>
# SPDX-ExternalRef: GIT https://cendev.eu/marc.weidner/CISS.2025.debian.installer.git
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <cendev@coresecret.eu>
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.2025.hardened.installer framework.
# SPDX-PackageName: CISS.2025.hardened.installer
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
###########################################################################################
# 3.7.5. Functions - installation - setup timezone #
###########################################################################################
guard_sourcing
###########################################################################################
# Configure timezone
@@ -24,11 +22,7 @@
# Arguments:
# None
###########################################################################################
3_7_5_functions_installation_setup_timezone() {
declare -g -x MODULE_ERR="3_7_5_functions_installation_setup_timezone"
declare -g -x MODULE_TXT="Setup timezone"
do_show_header "${MODULE_TXT}"
setup_timezone() {
### Reminder ###
# ls /usr/share/zoneinfo

View File

@@ -34,6 +34,7 @@ gen_dir_files() {
touch "${LOG_ERR}" && chmod 0600 "${LOG_ERR}"
touch "${LOG_INS}" && chmod 0600 "${LOG_INS}"
touch "${LOG_NIC}" && chmod 0600 "${LOG_NIC}"
touch "${LOG_UID}" && chmod 0600 "${LOG_UID}"
touch "${VAR_PRESEED}" && chmod 0600 "${VAR_PRESEED}"
touch "${DIR_LOG}/btrfs.log" && chmod 0600 "${DIR_LOG}/btrfs.log"
touch "${DIR_LOG}/cpu.log" && chmod 0600 "${DIR_LOG}/cpu.log"

18
var/dummy.var.sh Normal file
View File

@@ -0,0 +1,18 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# This file is for static tests of preseed.yaml and partitioning.yaml only.
# 4000_debootstrap.sh
declare -g architecture="" distribution=""
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

View File

@@ -35,6 +35,7 @@ declare -grx DIR_TMP="/tmp/.ciss/tmp"
declare -grx LOG_ERR="${DIR_LOG}/ciss_debian_installer_$$_error.log"
declare -grx LOG_INS="${DIR_LOG}/ciss_debian_installer_$$_install.log"
declare -grx LOG_NIC="${DIR_LOG}/ciss_debian_installer_$$_nic.log"
declare -grx LOG_UID="${DIR_LOG}/ciss_debian_installer_$$_uuid.log"
### Initialize variable of imported and cleaned 'YAML' -> 'BASH-variable'-file.
declare -grx VAR_PRESEED="${DIR_TMP}/combined.var"