msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 45s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-07-29 18:50:39 +02:00
parent ca72cf915b
commit 6ff5ebb430
9 changed files with 157 additions and 178 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
func/partitioning/3200_partitioning.sh
View File

@@ -47,13 +47,21 @@ partitioning() {
### Declare Arrays, HashMaps, and Variables.
# shellcheck disable=SC2034
declare -Ag HMP_PATH_PARTUUID # Used in: 3290() - [Mount Path:Partition UUID].
# shellcheck disable=SC2034
declare -Ag HMP_FSTAB_MOUNT_FTYPE # Used in: 4040() - [Mount Path:Filesystem type].
# shellcheck disable=SC2034
declare -Ag HMP_PATH_DEV_PART # Used in: 3220() - [Mount Path:DEV.PARTITION].
# Used in: 3240() - [Mount Path:DEV.PARTITION].
# Used in: 3280() - [Mount Path:DEV.PARTITION].
# shellcheck disable=SC2034
declare -ag ARY_CRYPT_MOUNT_PATHS=() # Used in: 3220() - Only entries [/paths] for encryption.
# shellcheck disable=SC2034
declare -ag ARY_FORMT_MOUNT_PATHS=() # Used in: 3240() - Only entries [/paths] for filesystem generation.
# shellcheck disable=SC2034
declare -ag ARY_FSTAB_MOUNT_PATHS=() # Used in: 4040() - Only entries [/paths] for '/etc/fstab' generation.
declare -ag ARY_PATHS_SORTED=() # Used in: - All entries [/paths] in a mount ordering scheme.
# shellcheck disable=SC2034
declare -ag ARY_PATHS_SORTED=() # Used in: 3280() - All entries [/paths] in a mount ordering scheme.
# Used in: 4040() - All entries [/paths] in a mount ordering scheme.
declare var_dev="" var_part="" \
var_begin="" var_boot="" var_encryption="" var_end="" var_end_arg="" var_end_mib="" var_format="" var_fs="" \
@@ -250,15 +258,18 @@ partitioning() {
fi
### Gathering information for forthcoming modules 32n0().
# shellcheck disable=SC2034
HMP_PATH_DEV_PART["${var_mount_path}"]="${var_dev}.${var_part}"
### Gathering information for encryption module 3220().
if [[ "${var_encryption}" == "true" ]]; then
# shellcheck disable=SC2034
ARY_CRYPT_MOUNT_PATHS+=("${var_mount_path}")
fi
### Gathering information for filesystem module 3240().
if [[ "${var_format}" == "true" ]]; then
# shellcheck disable=SC2034
ARY_FORMT_MOUNT_PATHS+=("${var_mount_path}")
fi
@@ -267,6 +278,7 @@ partitioning() {
### Gathering information for '/etc/fstab'-generation in 4040().
if [[ "${var_mount_true}" == "true" ]]; then
# shellcheck disable=SC2034
ARY_FSTAB_MOUNT_PATHS+=("${var_mount_path}")
do_log "debug" "file_only" "3200() Stored in Array [ARY_FSTAB_MOUNT_PATHS] : '${var_mount_path}'."
HMP_FSTAB_MOUNT_FTYPE["${var_mount_path}"]="${var_fs}"

19
func/partitioning/3220_partition_encryption.sh
View File

@@ -41,10 +41,10 @@ partition_encryption() {
### Declare Arrays, HashMaps, and Variables.
declare -Ag HMP_PATH_LUKSUUID # Used in: 3290() - [Mount Path:LUKS UUID].
# Used in: 4060() - [Mount Path:LUKS UUID].
declare -Ag HMP_EPHEMERAL_ENCLABEL
declare -Ag HMP_EPHEMERAL_FS_LABEL
declare -Ag HMP_EPHEMERAL_ENCLABEL # Used in: 4040() - [Mount Path:LUKS Encryption Label].
declare -Ag HMP_EPHEMERAL_FS_LABEL # Used in: 4060() - [Mount Path:Ephemeral Host FS Label]. Substituted by FS-UUID
declare -Ag HMP_PATH_ENCLABEL
declare -Ag HMP_PATH_ENCLABEL # Used in: 4060() - [Mount Path:LUKS Encryption Label].
declare -gx VAR_CRYPT_ROOT="" # LUKS UUID of '/'.
declare -gx VAR_CRYPT_RECOVERY="" # LUKS UUID of '/recovery'.
@@ -121,12 +121,17 @@ partition_encryption() {
mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev_part}" 1M
do_log "info" "file_only" "3220() Ephemeral: '${var_encryption_path}' prepared on: '/dev/${var_dev_part}'."
var_fs_uuid=$(blkid -s UUID -o value "${var_dev_part}")
### Gathering information for '/etc/fstab'-generation in 4040() and '/etc/crypttab'-generation in 4060().
# shellcheck disable=SC2034
HMP_PATH_FSUUID["${var_encryption_path}"]="${var_fs_uuid}"
do_log "debug" "file_only" "3220() [HMP_PATH_FSUUID] : '${var_encryption_path}' -> '${HMP_PATH_FSUUID["${var_encryption_path}"]}'"
HMP_EPHEMERAL_ENCLABEL["${var_encryption_path}"]="${var_encryption_label}"
HMP_EPHEMERAL_FS_LABEL["${var_encryption_path}"]="${var_filesystem_label}"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_encryption_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_encryption_path}"]}'"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_encryption_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_encryption_path}"]}'"
do_log "debug" "file_only" "3220() [HMP_EPHEMERAL_ENCLABEL]: '${var_encryption_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_encryption_path}"]}'"
do_log "debug" "file_only" "3220() [HMP_EPHEMERAL_FS_LABEL]: '${var_encryption_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_encryption_path}"]}'"
### The setup of ephemeral devices MUST stop here.
continue
@@ -184,8 +189,8 @@ partition_encryption() {
HMP_PATH_LUKSUUID["${var_encryption_path}"]="${var_uuid}"
HMP_PATH_ENCLABEL["${var_encryption_path}"]="${var_encryption_label}"
do_log "debug" "file_only" "3220() [HMP_PATH_LUKSUUID] : '${var_encryption_path}' -> '${HMP_PATH_LUKSUUID["${var_encryption_path}"]}'"
do_log "debug" "file_only" "3220() [HMP_PATH_ENCLABEL] : '${var_encryption_path}' -> '${HMP_PATH_ENCLABEL["${var_encryption_path}"]}'"
do_log "debug" "file_only" "3220() [HMP_PATH_LUKSUUID]: '${var_encryption_path}' -> '${HMP_PATH_LUKSUUID["${var_encryption_path}"]}'"
do_log "debug" "file_only" "3220() [HMP_PATH_ENCLABEL]: '${var_encryption_path}' -> '${HMP_PATH_ENCLABEL["${var_encryption_path}"]}'"
done

20
func/partitioning/3240_partition_formatting.sh
View File

@@ -29,13 +29,16 @@ guard_sourcing
#######################################
partition_formatting() {
### Declare Arrays, HashMaps, and Variables.
# shellcheck disable=SC2034
declare -Ag HMP_PATH_FSUUID # Used in: 3290() - [Mount Path:Filesystem UUID].
# Used in: 4040() - [Mount Path:Filesystem UUID].
# Used in: 4060() - [Mount Path:Filesystem UUID].
declare var_dev="" var_dev_part="" \
var_encryption_enable="" var_encryption_label="" var_format_path="" var_fs_btrfs_checksum="" var_fs_btrfs_compress="" \
var_fs_btrfs_mdup="" var_fs_label="" var_fs_options="" var_fs_version="" var_node="" var_fs_uuid=""
declare var_dev="" var_dev_part="" \
var_encryption_enable="" var_encryption_label="" var_format_path="" var_fs_btrfs_checksum="" \
var_fs_btrfs_compress="" var_fs_btrfs_mdup="" var_fs_label="" var_fs_options="" var_fs_version="" \
var_node="" var_fs_uuid=""
declare -a ary_opts=() ary_fmt_opts=()
declare -a ary_opts=() ary_fmt_opts=()
for var_format_path in "${ARY_FORMT_MOUNT_PATHS[@]}"; do
@@ -85,7 +88,8 @@ partition_formatting() {
btrfs filesystem show "${var_node}" >> "${DIR_LOG}/btrfs.log"
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
### Gathering information for '/etc/fstab'-generation in 4040().
### Gathering information for '/etc/fstab'-generation in 4040() and '/etc/crypttab'-generation in 4060().
# shellcheck disable=SC2034
HMP_PATH_FSUUID["${var_format_path}"]="${var_fs_uuid}"
;;
@@ -101,7 +105,8 @@ partition_formatting() {
tune2fs -l "${var_node}" >> "${DIR_LOG}/ext4.log"
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
### Gathering information for '/etc/fstab'-generation in 4040().
### Gathering information for '/etc/fstab'-generation in 4040() and '/etc/crypttab'-generation in 4060().
# shellcheck disable=SC2034
HMP_PATH_FSUUID["${var_format_path}"]="${var_fs_uuid}"
;;
@@ -112,7 +117,8 @@ partition_formatting() {
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'FAT32'."
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
### Gathering information for '/etc/fstab'-generation in 4040().
### Gathering information for '/etc/fstab'-generation in 4040() and '/etc/crypttab'-generation in 4060().
# shellcheck disable=SC2034
HMP_PATH_FSUUID["${var_format_path}"]="${var_fs_uuid}"
;;

26
func/partitioning/3280_mount_partition.sh
View File

@@ -26,9 +26,9 @@ guard_sourcing
#######################################
mount_with_dir() {
declare var_mount_path="$1" var_mount_device="$2" var_mount_options="${3:-}"
declare -a ary_cmd=(mount)
declare -a ary_cmd=( mount )
if [[ "${var_mount_device}" =~ ^[0-9a-fA-F-]{8,}$ ]]; then
if [[ "${var_mount_device}" =~ ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}$ ]] || [[ "${var_mount_device}" =~ ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$ ]]; then
if [[ -e "/dev/disk/by-uuid/${var_mount_device}" ]]; then
@@ -149,6 +149,11 @@ mount_partition() {
var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
var_fs_uuid="${HMP_PATH_FSUUID["${var_mount_path}"]}"
if [[ -z "${var_fs_uuid}" ]]; then
do_log "error" "file_only" "3280() FS-UUID for mount path: '${var_mount_path}' not found in: 'HMP_PATH_FSUUID'."
return "${ERR_MOUNTING_DEV}"
fi
### Mounting of Ephemeral 'SWAP' and '/tmp' as per https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption#UUID_and_LABEL
if [[ "${var_mount_path,,}" == "swap" ]]; then
@@ -175,7 +180,7 @@ mount_partition() {
mkdir -p "${TARGET}/tmp"
safe_exec mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 "/dev/mapper/${var_encryption_label}" "${ERR_MOUNTING_DEV}" || return "${ERR_MOUNTING_DEV}"
safe_exec mkfs.ext4 -E lazy_itable_init=1,lazy_journal_init=1 "/dev/mapper/${var_encryption_label}" "${ERR_MOUNTING_DEV}" || return "${ERR_MOUNTING_DEV}"
### Gathering information for '/etc/fstab'-generation in 4040().
HMP_FSTAB_MOUNT_OPTS["${var_mount_path}"]="${var_mount_options}"
@@ -225,10 +230,11 @@ mount_partition() {
validate_btrfs_compression "${var_fs_btrfs_compress}" "${var_fs_btrfs_level}" || return "${ERR_BTRFS_OPTION}"
var_btrfs_options="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
[[ -n "${var_mount_options}" ]] && var_btrfs_options+="${var_mount_options},${var_btrfs_options},subvol=${var_fs_btrfs_subvolume}"
[[ -z "${var_mount_options}" ]] && var_btrfs_options+="${var_btrfs_options},subvol=${var_fs_btrfs_subvolume}"
if [[ -n "${var_mount_options}" ]]; then
var_btrfs_options="${var_mount_options},compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level},subvol=${var_fs_btrfs_subvolume}"
else
var_btrfs_options="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level},subvol=${var_fs_btrfs_subvolume}"
fi
### Gathering information for '/etc/fstab'-generation in 4040().
HMP_FSTAB_MOUNT_OPTS["${var_mount_path}"]="${var_btrfs_options}"
@@ -243,7 +249,11 @@ mount_partition() {
mkdir -p "${TARGET}${var_mount_path}/.snapshots"
do_log "info" "file_only" "3280() Created: '${TARGET}${var_mount_path}/.snapshots'."
var_mount_optsnap="${var_mount_optsnap},subvol=${var_snapshot}"
if [[ -n "${var_mount_optsnap}" ]]; then
var_mount_optsnap+=",subvol=${var_snapshot}"
else
var_mount_optsnap="subvol=${var_snapshot}"
fi
### Gathering information for '/etc/fstab'-generation in 4040().
HMP_FSTAB_MOUNT_OPTS["${var_mount_path}/.snapshots"]="${var_mount_optsnap}"

4
func/system/4020_configure_system.sh
View File

@@ -32,7 +32,7 @@ configure_system() {
# Conversely, changes to the target mount are not propagated back to the source mount.
# This mode is necessary to avoid problems with double or erroneous propagation effects in chroot or container environments.
declare var_src var_dst
declare var_src="" var_dst=""
declare -a ary_mounts=(proc sys dev run)
for var_src in "${ary_mounts[@]}"; do
@@ -52,7 +52,7 @@ configure_system() {
return "${ERR_CHRT_MOUNTS}"
fi
do_log "info" "file_only" "4020() Command: [mkdir -p /etc/systemd/system/multi-user.target.wants] successful in: '${TARGET}'."
do_log "info" "file_only" "4020() Command: [mkdir -p /etc/systemd/system/multi-user.target.wants] failed in: '${TARGET}'."
declare -gx VAR_CHROOT_ACTIVATED="system"

216
func/system/4040_generate_fstab.sh
View File

@@ -17,36 +17,52 @@ guard_sourcing
# Globals:
# TARGET
# Arguments:
# 1: UUID
# 1: UUID or /dev/mapper
# 2: Mount Path
# 3: Filesystem
# 4: Mount Options
# 5: Pass value, while Dump value is hardcoded always "0", e.g., "1"
# 5: Pass value, while Dump value is hardcoded always "0".
# Returns:
# 0: on success
#######################################
write_fstab() {
declare write_uuid="$1" write_path="$2" write_type="$3" write_opts="$4" write_pass="$5"
printf "%-43s%-28s%-8s%-74s0 %s\n" "UUID=${write_uuid}" "${write_path}" "${write_type}" "${write_opts}" "${write_pass}" >> "${TARGET}/etc/fstab"
do_log "info" "file_only" "4040() fstab entry generated: [UUID=${write_uuid} ${write_path} ${write_type} ${write_opts} 0 ${write_pass}]."
declare write_maps="$1" write_path="$2" write_type="$3" write_opts="$4" write_pass="$5"
if [[ "${write_maps}" =~ ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}$ ]] || [[ "${write_maps}" =~ ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$ ]]; then
printf "%-43s%-28s%-8s%-74s0 %s\n" "UUID=${write_maps}" "${write_path}" "${write_type}" "${write_opts}" "${write_pass}" >> "${TARGET}/etc/fstab"
do_log "info" "file_only" "4040() fstab entry generated: [UUID=${write_maps} ${write_path} ${write_type} ${write_opts} 0 ${write_pass}]."
elif [[ "${write_maps}" == /dev/mapper/* ]]; then
printf "%-43s%-28s%-8s%-74s0 %s\n" "${write_maps}" "${write_path}" "${write_type}" "${write_opts}" "${write_pass}" >> "${TARGET}/etc/fstab"
do_log "info" "file_only" "4040() fstab entry generated: [${write_maps} ${write_path} ${write_type} ${write_opts} 0 ${write_pass}]."
fi
return 0
}
#######################################
# Generate target '/etc/fstab' entries.
# Globals:
# ARY_PATHS_SORTED
# DIR_LOG
# HMP_EPHEMERAL_ENCLABEL
# HMP_FSTAB_MOUNT_FTYPE
# HMP_FSTAB_MOUNT_OPTS
# HMP_PATH_FSUUID
# MAP_MOUNTPATH_DEV
# TARGET
# VAR_RECIPE_STRING
# VAR_SETUP_PART
# Arguments:
# None
# Returns:
# 0: on success
#######################################
generate_fstab() {
### Declare Arrays, HashMaps, and Variables.
declare var_path="" var_dmapper="" var_fs_uuid="" var_fs_path="" var_fs_type="" var_fs_opts="" var_fs_pass=""
declare -i rc=0
### Generate '${TARGET}/etc/fstab' header.
: >| "${TARGET}/etc/fstab"
chmod 0600 "${TARGET}/etc/fstab"
@@ -73,7 +89,6 @@ generate_fstab() {
#
# <file system UUID> <mount point> <type> <options> <dump> <pass>
### Secure tmpfs mounts for a hardened system
# Mount the proc filesystem to provide process and kernel information
@@ -89,157 +104,92 @@ tmpfs /run tmpfs m
EOF
### Generate '${TARGET}/etc/fstab' special entries '/' '/boot' '/boot/efi'.
### Define the order of the special paths.
declare -a ary_path_order=("/" "/boot" "/boot/efi")
declare -a ary_skip=("/" "/boot" "/boot/efi" "/recovery")
declare var_path="" var_fs_uuid="" var_fs_path="" var_fs_type="" var_fs_opts=""
### Generate dynamic '${TARGET}/etc/fstab' entries.
for var_path in "${ARY_PATHS_SORTED[@]}"; do
for var_path in "${ary_path_order[@]}"; do
case "${var_path,,}" in
var_fs_uuid="${HMP_PATH_FSUUID["${var_path}"]}"
var_fs_path="${var_path}"
var_fs_type="${HMP_FSTAB_MOUNT_FTYPE["${var_path}"]}"
var_fs_opts="${HMP_FSTAB_MOUNT_OPTS["${var_path}"]}"
swap)
var_dmapper="${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}"
var_fs_uuid="/dev/mapper/${var_dmapper}"
var_fs_path="none"
var_fs_type="swap"
var_fs_opts="defaults"
var_fs_pass="0"
;;
done
/tmp)
declare var_path var_entry var_part var_dev var_key var_uuid var_fs_btrfs_compress var_fs_btrfs_level var_fs_btrfs_subvolume \
var_fs_version var_mount_options var_mount_optsnap var_btrfs_compression
var_dmapper="${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}"
var_fs_uuid="/dev/mapper/${var_dmapper}"
var_fs_path="${var_path}"
var_fs_type="${HMP_FSTAB_MOUNT_FTYPE["${var_path}"]}"
var_fs_opts="${HMP_FSTAB_MOUNT_OPTS["${var_path}"]}"
var_fs_pass="0"
;;
for var_path in "${ary_path_order[@]}"; do
*)
var_entry=$(yq e -r '.recipe.*.dev.* | select(.mount.path == "'"${var_path}"'")' "${VAR_SETUP_PART}")
var_fs_uuid="${HMP_PATH_FSUUID["${var_path}"]}"
var_fs_path="${var_path}"
var_fs_type="${HMP_FSTAB_MOUNT_FTYPE["${var_path}"]}"
var_fs_opts="${HMP_FSTAB_MOUNT_OPTS["${var_path}"]}"
case "${var_path,,}" in
/) var_fs_pass="1" ;;
/boot/efi) var_fs_pass="0" ;;
*) var_fs_pass="2" ;;
esac
;;
if [[ -z "${var_entry}" ]]; then
continue
fi
esac
case "${var_fs_type,,}" in
btrfs)
var_part=$(echo "${var_entry}" | yq e 'path | .[-2]' -)
var_dev=$(echo "${var_entry}" | yq e 'path | .[-3]' -)
var_key="UUID_${var_path}"
var_uuid="${HMP_PATH_FSUUID[${var_key}]}"
var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level" "${VAR_SETUP_PART}")
var_fs_btrfs_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.subvolume" "${VAR_SETUP_PART}")
var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options" "${VAR_SETUP_PART}")
var_mount_optsnap=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.optsnap" "${VAR_SETUP_PART}")
if [[ "${var_fs_version,,}" == btrfs ]]; then
if [[ "${var_fs_btrfs_level:-0}" == 0 ]]; then
var_btrfs_compression="compress=no"
else
var_btrfs_compression="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
fi
write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options},${var_btrfs_compression}" "1"
if [[ -n "${var_fs_btrfs_subvolume}" ]]; then
if [[ "${var_path}" == "/" ]]; then
write_fstab "${var_uuid}" "/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0"
else
write_fstab "${var_uuid}" "${var_path}/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0"
write_fstab "${var_fs_uuid}" "${var_fs_path}" "${var_fs_type}" "${var_fs_opts}" "${var_fs_pass}"
if [[ -v HMP_FSTAB_MOUNT_OPTS["${var_path}/.snapshots"] ]]; then
var_fs_opts="${HMP_FSTAB_MOUNT_OPTS["${var_path}/.snapshots"]}"
write_fstab "${var_fs_uuid}" "${var_fs_path}/.snapshots" "${var_fs_type}" "${var_fs_opts}" "${var_fs_pass}"
fi
continue
;;
fi
continue
ext4)
elif [[ "${var_fs_version,,}" == ext4 ]]; then
write_fstab "${var_fs_uuid}" "${var_fs_path}" "${var_fs_type}" "${var_fs_opts}" "${var_fs_pass}"
continue
;;
write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options}" "1"
continue
fat32)
elif [[ "${var_fs_version,,}" == fat32 ]]; then
write_fstab "${var_fs_uuid}" "${var_fs_path}" "vfat" "${var_fs_opts}" "${var_fs_pass}"
continue
;;
write_fstab "${var_uuid}" "${var_path}" "vfat" "${var_mount_options}" "2"
continue
fi
done
for var_path in "${ARY_FSTAB_MOUNT_PATHS[@]}"; do
:
done
### Generate '${TARGET}/etc/fstab' remaining entries.
for var_path in "${!MAP_MOUNTPATH_DEV[@]}"; do
if validation_array "${var_path}" "${ary_skip[@]}"; then
continue
fi
var_entry=$(yq e -r '.recipe.*.dev.* | select(.mount.path == "'"${var_path}"'")' "${VAR_SETUP_PART}")
if [[ -z "${var_entry}" ]]; then
continue
fi
var_part=$(echo "${var_entry}" | yq e 'path | .[-2]' -)
var_dev=$(echo "${var_entry}" | yq e 'path | .[-3]' -)
var_key="UUID_${var_path}"
var_uuid="${HMP_PATH_FSUUID[${var_key}]}"
var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level" "${VAR_SETUP_PART}")
var_fs_btrfs_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.subvolume" "${VAR_SETUP_PART}")
var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options" "${VAR_SETUP_PART}")
var_mount_optsnap=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.optsnap" "${VAR_SETUP_PART}")
if [[ "${var_fs_version,,}" == btrfs ]]; then
if [[ "${var_fs_btrfs_level:-0}" == 0 ]]; then
var_btrfs_compression="compress=no"
else
var_btrfs_compression="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
fi
write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options},${var_btrfs_compression}" "2"
if [[ -n "${var_fs_btrfs_subvolume}" ]]; then
write_fstab "${var_uuid}" "${var_path}/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0"
fi
continue
elif [[ "${var_fs_version,,}" == ext4 ]]; then
write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options}" "2"
continue
elif [[ "${var_fs_version,,}" == fat32 ]]; then
write_fstab "${var_uuid}" "${var_path}" "vfat" "${var_mount_options}" "2"
continue
fi
esac
done
cat << 'EOF' >> "${TARGET}/etc/fstab"
/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0
/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0
EOF
do_log "info" "file_only" "fstab entry generated: '/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0'."
### Add entry for 'SWAP' device.
var_path="SWAP"
write_fstab "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}" "none" "swap" "defaults" "0"
: >| "${DIR_LOG}/fstab.verify.log"
chmod 0600 "${DIR_LOG}/fstab.verify.log"
### Add entry for '/tmp' device.
var_path="/tmp"
write_fstab "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}" "/tmp" "ext4" "defaults,rw,nodev,nosuid,relatime" "0"
do_in_target_script "${TARGET}" 'systemd-analyze verify /etc/fstab' >> "${DIR_LOG}/fstab.verify.log" 2>&1
rc="$?"
if (( rc == 0 )); then
do_log "info" "file_only" "4040() '/etc/fstab' verified successfully with systemd-analyze."
else
do_log "warning" "file_only" "4040() '/etc/fstab' verification returned errors — see '${DIR_LOG}/fstab.verify.log'."
fi
return 0
}

24
func/system/4060_generate_crypttab.sh
View File

@@ -25,9 +25,9 @@ guard_sourcing
# 0: on success
#######################################
write_crypttab() {
declare _label="$1" _device="$2" _key_file="$3" _opts="$4"
printf "%s %s %s %s\n" "${_label}" "${_device}" "${_key_file}" "${_opts}" >> "${TARGET}/etc/crypttab"
do_log "info" "file_only" "4060() crypttab entry generated: [${_label} ${_device} ${_key_file} ${_opts}]."
declare write_label="$1" write_dev="$2" write_key_file="$3" write_opts="$4"
printf "%-43s %-45s %-29s %s\n" "${write_label}" "${write_dev}" "${write_key_file}" "${write_opts}" >> "${TARGET}/etc/crypttab"
do_log "info" "file_only" "4060() crypttab entry generated: [${write_label} ${write_dev} ${write_key_file} ${write_opts}]."
return 0
}
@@ -35,8 +35,8 @@ write_crypttab() {
# Generate target '/etc/crypttab' entries.
# Globals:
# HMP_EPHEMERAL_ENCLABEL
# HMP_EPHEMERAL_FS_LABEL
# HMP_PATH_ENCLABEL
# HMP_PATH_FSUUID
# HMP_PATH_LUKSUUID
# TARGET
# VAR_NUKE
@@ -47,10 +47,10 @@ write_crypttab() {
# 0: on success
#######################################
generate_crypttab() {
declare var_key var_encryption_label var_luks_uuid
### Declare Arrays, HashMaps, and Variables.
declare var_key="" var_encryption_label="" var_luks_uuid="" var_ephemeral_enclabel="" var_host_uuid=""
### Generate '${TARGET}/etc/crypttab' header.
install -d -m 0755 "${TARGET}/etc"
: >| "${TARGET}/etc/crypttab"
chmod 0600 "${TARGET}/etc/crypttab"
@@ -66,7 +66,7 @@ generate_crypttab() {
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# /etc/crypttab: static file system information.
# Static file system information: '/etc/crypttab'.
#
# Basic rule: 'discard' / 'nodiscard' are normally only set in '/etc/crypttab' when LUKS/dm-crypt is in use. Options like
# 'discard=async' or similar are typically only set in '/etc/fstab' (at the file system level). The crypttab determines whether
@@ -77,13 +77,11 @@ generate_crypttab() {
# not specify discard in the '/etc/crypttab', dm-crypt blocks TRIM by default. This would render a discard in the '/etc/fstab'
# ineffective.
#
# <name> <device> <password-file-or-none> <options>
# <name> <device> <password-file-or-none> <options>
EOF
### Generate '${TARGET}/etc/crypttab' entries.
declare var_ephemeral_enclabel var_ephemeral_fs_label
for var_key in "${!HMP_PATH_LUKSUUID[@]}"; do
var_encryption_label="${HMP_PATH_ENCLABEL["${var_key}"]}"
@@ -112,14 +110,14 @@ EOF
for var_key in "${!HMP_EPHEMERAL_ENCLABEL[@]}"; do
var_ephemeral_enclabel="${HMP_EPHEMERAL_ENCLABEL["${var_key}"]}"
var_ephemeral_fs_label="${HMP_EPHEMERAL_FS_LABEL["${var_key}"]}"
var_host_uuid="${HMP_PATH_FSUUID["${var_key}"]}"
case "${var_key}" in
SWAP)
write_crypttab "${var_ephemeral_enclabel}" "LABEL=${var_ephemeral_fs_label}" "/dev/random" "swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096"
write_crypttab "${var_ephemeral_enclabel}" "UUID=${var_host_uuid}" "/dev/random" "swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096"
;;
/tmp)
write_crypttab "${var_ephemeral_enclabel}" "LABEL=${var_ephemeral_fs_label}" "/dev/random" "offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4"
write_crypttab "${var_ephemeral_enclabel}" "UUID=${var_host_uuid}" "/dev/random" "offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4"
;;
*)
do_log "error" "file_only" "Only 'SWAP' and '/tmp' are valid Partitions for Ephemeral Encryption. Given value was: '${var_key}'."