V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m41s
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m41s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
@@ -27,7 +27,6 @@ remove_x509() {
|
||||
install -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/chroot/hooks/4020_remove_x509.hooks.sh" \
|
||||
"${TARGET}/root/.ciss/cdi/hooks/4020_remove_x509.hooks.sh"
|
||||
|
||||
|
||||
if ! chroot_script "${TARGET}" "/root/.ciss/cdi/hooks/4020_remove_x509.hooks.sh" "emergency"; then
|
||||
|
||||
do_log "warn" "file_only" "4020() Command: [chroot_script ${TARGET} /root/.ciss/cdi/hooks/4020_remove_x509.hooks.sh emergency] failed."
|
||||
|
||||
@@ -612,13 +612,20 @@ EOF
|
||||
|
||||
if [[ ! -f "${var_sudoers_winscp_global}" ]]; then
|
||||
|
||||
cat << EOF >| "${var_sudoers_winscp_global}"
|
||||
install_header "${var_sudoers_winscp_global}"
|
||||
install_comments "${var_sudoers_winscp_global}"
|
||||
cat << EOF >| "${var_sudoers_winscp_global}"
|
||||
### Added by CISS.debian.installer. WinSCP SFTP-as-root (least privilege).
|
||||
### Allow exactly the sftp-server binary, optionally with -e (stderr logging).
|
||||
Cmnd_Alias CISS_SFTPROOT = ${var_sftp_bin}, ${var_sftp_bin} -e
|
||||
|
||||
# Harden per-command defaults: noexec to block execve(), and forbid env changes.
|
||||
Defaults!CISS_SFTPROOT noexec, !setenv
|
||||
# Command-scoped hardening for the alias:
|
||||
# - noexec : disallow further exec()
|
||||
# - !setenv : forbid env manipulation
|
||||
# - timestamp_timeout=0: require re-auth each time (no caching)
|
||||
Defaults!CISS_SFTPROOT noexec, !setenv, timestamp_timeout=0
|
||||
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
|
||||
EOF
|
||||
chmod 0440 "${var_sudoers_winscp_global}"
|
||||
|
||||
@@ -641,7 +648,10 @@ EOF
|
||||
|
||||
else
|
||||
|
||||
echo "${var_user} ALL=(root) NOPASSWD: CISS_SFTPROOT" >| "${var_sudoers_winscp_user}"
|
||||
install_header "${var_sudoers_winscp_user}"
|
||||
install_comments "${var_sudoers_winscp_user}"
|
||||
echo "${var_user} ALL=(root) PASSWD: CISS_SFTPROOT" >> "${var_sudoers_winscp_user}"
|
||||
printf "# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf \n" >> "${var_sudoers_winscp_user}"
|
||||
|
||||
fi
|
||||
chmod 0440 "${var_sudoers_winscp_user}"
|
||||
|
||||
@@ -28,20 +28,31 @@ installation_packages() {
|
||||
|
||||
chroot_logger "${TARGET}${var_logfile}"
|
||||
|
||||
if [[ "${VAR_APT_FULL_UPGRADE}" == "true" ]]; then
|
||||
chroot_script "${TARGET}" "
|
||||
export INITRD=No
|
||||
apt-get update 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
apt-get upgrade -y 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
fi
|
||||
|
||||
chroot_script "${TARGET}" "
|
||||
export INITRD=No
|
||||
apt-get install -y --no-install-recommends --no-install-suggests ${ARY_PACKAGES[*]} 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
if [[ "${VAR_APT_FULL_UPGRADE}" == "true" ]]; then
|
||||
chroot_script "${TARGET}" "
|
||||
export INITRD=No
|
||||
apt-get update 2>&1 | tee -a ${var_logfile}
|
||||
apt-get upgrade -y 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
fi
|
||||
chroot_script "${TARGET}" "
|
||||
export INITRD=No
|
||||
apt-get autoclean -y 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
apt-get autopurge -y 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
apt-get autoremove -y 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
guard_dir && return 0
|
||||
}
|
||||
|
||||
102
func/cdi_4600_packages/4630_auditing_packages.sh
Normal file
102
func/cdi_4600_packages/4630_auditing_packages.sh
Normal file
@@ -0,0 +1,102 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Final checks.
|
||||
# Globals:
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
auditing_packages() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -r var_logfile="/root/.ciss/cdi/log/4630_auditing_packages.log"
|
||||
|
||||
chroot_logger "${TARGET}${var_logfile}"
|
||||
|
||||
chroot_script "${TARGET}" "
|
||||
if ! dpkg --audit 2>&1 | tee -a ${var_logfile}; then
|
||||
echo \"[dpkg --audit] failed with ExitCode: \$? \" >> ${var_logfile}
|
||||
else
|
||||
echo \"[dpkg --audit] ExitCode: \$? \" >> ${var_logfile}
|
||||
fi
|
||||
echo +++ >> ${var_logfile}
|
||||
|
||||
if ! apt-get check 2>&1 | tee -a ${var_logfile}; then
|
||||
echo \"[apt-get check] failed with ExitCode: \$? \" >> ${var_logfile}
|
||||
else
|
||||
echo \"[apt-get check] ExitCode: \$? \" >> ${var_logfile}
|
||||
fi
|
||||
echo +++ >> ${var_logfile}
|
||||
|
||||
### Only log anomalies from dpkg -V (no output == OK)
|
||||
if ! dpkg -V 2>&1 | tee -a ${var_logfile}; then
|
||||
echo \"[dpkg -V] failed with ExitCode: \$? \" >> ${var_logfile}
|
||||
else
|
||||
echo \"[dpkg -V] ExitCode: \$? \" >> ${var_logfile}
|
||||
fi
|
||||
echo +++ >> ${var_logfile}
|
||||
|
||||
### Simulations (no changes)
|
||||
if ! apt-get -s autoremove --purge 2>&1 | tee -a ${var_logfile}; then
|
||||
echo \"[apt-get -s autoremove --purge] failed with ExitCode: \$? \" >> ${var_logfile}
|
||||
else
|
||||
echo \"[apt-get -s autoremove --purge] ExitCode: \$? \" >> ${var_logfile}
|
||||
fi
|
||||
echo +++ >> ${var_logfile}
|
||||
|
||||
### Residual configs & holds
|
||||
if ! apt-mark showhold 2>&1 | tee -a ${var_logfile}; then
|
||||
echo \"[apt-mark showhold] failed with ExitCode: \$? \" >> ${var_logfile}
|
||||
else
|
||||
echo \"[apt-mark showhold] ExitCode: \$? \" >> ${var_logfile}
|
||||
fi
|
||||
echo +++ >> ${var_logfile}
|
||||
|
||||
### Apt pinning
|
||||
if ! grep -R . /etc/apt/preferences.d/ 2>&1 | tee -a ${var_logfile}; then
|
||||
echo \"[grep -R . /etc/apt/preferences.d/] failed with ExitCode: \$? \" >> ${var_logfile}
|
||||
else
|
||||
echo \"[grep -R . /etc/apt/preferences.d/] ExitCode: \$? \" >> ${var_logfile}
|
||||
fi
|
||||
echo +++ >> ${var_logfile}
|
||||
|
||||
### Diversions, statoverrides, alternatives
|
||||
if ! dpkg-divert --list 2>&1 | tee -a ${var_logfile}; then
|
||||
echo \"[dpkg-divert --list] failed with ExitCode: \$? \" >> ${var_logfile}
|
||||
else
|
||||
echo \"[dpkg-divert --list] ExitCode: \$? \" >> ${var_logfile}
|
||||
fi
|
||||
echo +++ >> ${var_logfile}
|
||||
|
||||
if ! dpkg-statoverride --list 2>&1 | tee -a ${var_logfile}; then
|
||||
echo \"[dpkg-statoverride --list] failed with ExitCode: \$? \" >> ${var_logfile}
|
||||
else
|
||||
echo \"[dpkg-statoverride --list] ExitCode: \$? \" >> ${var_logfile}
|
||||
fi
|
||||
echo +++ >> ${var_logfile}
|
||||
|
||||
if ! update-alternatives --get-selections 2>&1 | tee -a ${var_logfile}; then
|
||||
echo \"[update-alternatives --get-selections] failed with ExitCode: \$? \" >> ${var_logfile}
|
||||
else
|
||||
echo \"[update-alternatives --get-selections] ExitCode: \$? \" >> ${var_logfile}
|
||||
fi
|
||||
echo +++ >> ${var_logfile}
|
||||
"
|
||||
|
||||
guard_dir && return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -1,90 +0,0 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
verify_system() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
do_log "info" "file_only" "4100() Starting system integrity verification..."
|
||||
|
||||
###########################################
|
||||
## Systemd & Identity Checks
|
||||
###########################################
|
||||
do_log "info" "file_only" "4100() Checking systemd installation and machine-id."
|
||||
|
||||
chroot_script "${TARGET}" 'command -v systemctl && systemctl --version' >> "${LOG_FILE}" 2>&1 || \
|
||||
do_log "warning" "file_only" "4100() systemd or systemctl not properly installed."
|
||||
|
||||
chroot_script "${TARGET}" '[ -s /etc/machine-id ]' || \
|
||||
do_log "warning" "file_only" "4100() Missing or empty /etc/machine-id."
|
||||
|
||||
###########################################
|
||||
## crypttab & fstab Validation
|
||||
###########################################
|
||||
do_log "info" "file_only" "4100() Validating fstab and crypttab."
|
||||
|
||||
chroot_script "${TARGET}" 'systemd-analyze verify /etc/fstab /etc/crypttab' >> "${LOG_FILE}" 2>&1 || \
|
||||
do_log "warning" "file_only" "4100() systemd-analyze verification failed. See ${LOG_FILE}."
|
||||
|
||||
chroot_script "${TARGET}" 'findmnt --verify' >> "${LOG_FILE}" 2>&1 || \
|
||||
do_log "warning" "file_only" "4100() findmnt reports potential inconsistencies."
|
||||
|
||||
###########################################
|
||||
## Essential Services
|
||||
###########################################
|
||||
do_log "info" "file_only" "4100() Validating essential services."
|
||||
chroot_script "${TARGET}" 'systemctl list-unit-files --state=enabled,disabled' >> "${LOG_FILE}" 2>&1
|
||||
|
||||
###########################################
|
||||
## Init & Bootloader
|
||||
###########################################
|
||||
do_log "info" "file_only" "4100() Checking init and GRUB presence."
|
||||
|
||||
chroot_script "${TARGET}" 'readlink -f /sbin/init' >> "${LOG_FILE}" 2>&1 || \
|
||||
do_log "warning" "file_only" "4100() /sbin/init is missing or invalid."
|
||||
|
||||
chroot_script "${TARGET}" 'test -e /boot/grub/grub.cfg || test -e /boot/efi/EFI/debian/grubx64.efi' || \
|
||||
do_log "warning" "file_only" "4100() GRUB config or EFI binary not found."
|
||||
|
||||
###########################################
|
||||
## /etc Configuration Checks
|
||||
###########################################
|
||||
do_log "info" "file_only" "4100() Validating core /etc configurations."
|
||||
|
||||
chroot_script "${TARGET}" 'grep -E "^127\.0\.1\.1" /etc/hosts' >> "${LOG_FILE}" 2>&1 || \
|
||||
do_log "warning" "file_only" "4100() Missing 127.0.1.1 entry in /etc/hosts."
|
||||
|
||||
chroot_script "${TARGET}" '[ -s /etc/hostname ]' || \
|
||||
do_log "warning" "file_only" "4100() /etc/hostname is missing or empty."
|
||||
|
||||
###########################################
|
||||
## Permissions & Security
|
||||
###########################################
|
||||
do_log "info" "file_only" "4100() Auditing /root permissions and login shell."
|
||||
|
||||
chroot_script "${TARGET}" 'stat -c "%A %U:%G" /root' >> "${LOG_FILE}" 2>&1
|
||||
chroot_script "${TARGET}" 'grep ^root: /etc/passwd' >> "${LOG_FILE}" 2>&1
|
||||
|
||||
###########################################
|
||||
## dpkg & apt status
|
||||
###########################################
|
||||
do_log "info" "file_only" "4100() Verifying package integrity."
|
||||
|
||||
chroot_script "${TARGET}" 'dpkg --audit' >> "${LOG_FILE}" 2>&1 || true
|
||||
chroot_script "${TARGET}" 'apt-get check' >> "${LOG_FILE}" 2>&1 || \
|
||||
do_log "warning" "file_only" "4100() apt-get check reported errors."
|
||||
|
||||
do_log "info" "file_only" "4100() Verification completed. Output stored in: ${LOG_FILE}."
|
||||
guard_dir && return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -1,74 +0,0 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
# SPDX-Comment: SSH-Hardening Integrity Check (Centurion SSH Audit Support)
|
||||
|
||||
set -Ceuo pipefail
|
||||
IFS=$'\n\t'
|
||||
|
||||
declare -r REF_CONFIG="/path/to/includes/etc/ssh/sshd_config"
|
||||
declare -r LIVE_CONFIG="/etc/ssh/sshd_config"
|
||||
declare -r REF_SSHD_T="/path/to/includes/etc/ssh/sshd_config.sshdT"
|
||||
|
||||
hash_file() {
|
||||
sha256sum "$1" | awk '{print $1}'
|
||||
}
|
||||
|
||||
bold() { tput bold; echo "$1"; tput sgr0; }
|
||||
red() { tput setaf 1; echo "$1"; tput sgr0; }
|
||||
green() { tput setaf 2; echo "$1"; tput sgr0; }
|
||||
|
||||
echo
|
||||
bold "Checking SSH Configuration Integrity..."
|
||||
|
||||
if [[ ! -f "${REF_CONFIG}" ]]; then
|
||||
red "ERROR: Reference config '${REF_CONFIG}' not found."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -f "${LIVE_CONFIG}" ]]; then
|
||||
red "ERROR: Live config '${LIVE_CONFIG}' not found."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
declare -r HASH_REF=$(hash_file "${REF_CONFIG}")
|
||||
declare -r HASH_LIVE=$(hash_file "${LIVE_CONFIG}")
|
||||
|
||||
if [[ "${HASH_REF}" == "${HASH_LIVE}" ]]; then
|
||||
green "✓ sshd_config matches reference (SHA256: ${HASH_LIVE})"
|
||||
else
|
||||
red "✗ sshd_config has been modified!"
|
||||
diff -u "${REF_CONFIG}" "${LIVE_CONFIG}" || true
|
||||
fi
|
||||
|
||||
# Vergleich der sshd -T Ausgabe
|
||||
echo
|
||||
bold "🔍 Verifying sshd -T output..."
|
||||
|
||||
if [[ ! -f "${REF_SSHD_T}" ]]; then
|
||||
red "ERROR: Reference sshd -T output not found: '${REF_SSHD_T}'"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TMP_SSHD_T=$(mktemp)
|
||||
sshd -T > "${TMP_SSHD_T}"
|
||||
|
||||
if diff -q "${TMP_SSHD_T}" "${REF_SSHD_T}" >/dev/null; then
|
||||
green "✓ sshd -T output matches expected configuration."
|
||||
else
|
||||
red "✗ sshd -T output has changed:"
|
||||
diff -u "${REF_SSHD_T}" "${TMP_SSHD_T}" || true
|
||||
fi
|
||||
|
||||
rm -f "${TMP_SSHD_T}"
|
||||
echo
|
||||
bold "✔ SSH config integrity check completed."
|
||||
guard_dir && return 0
|
||||
@@ -1,104 +0,0 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
# SPDX-Comment: GRUB Kernel Parameter Linter
|
||||
|
||||
set -Ceuo pipefail
|
||||
|
||||
#######################################
|
||||
# Parse GRUB_CMDLINE string into array of unique options
|
||||
# Arguments:
|
||||
# 1: Grub file to parse
|
||||
#######################################
|
||||
parse_cmdline() {
|
||||
declare var_input="${1}"
|
||||
declare -a ary_input
|
||||
### Remove outer quotes if present.
|
||||
var_input="${var_input%\"}"
|
||||
var_input="${var_input#\"}"
|
||||
### Split into an array.
|
||||
read -r -a ary_input <<< "${var_input}"
|
||||
printf "%s\n" "${ary_input[@]}"
|
||||
}
|
||||
|
||||
#######################################
|
||||
# Key extractor: for 'console=tty0' -> 'console'
|
||||
# Arguments:
|
||||
# 1:
|
||||
#######################################
|
||||
extract_key() {
|
||||
declare var_param="${1}"
|
||||
if [[ "${var_param}" == *=* ]]; then
|
||||
echo "${var_param%%=*}"
|
||||
else
|
||||
echo "${var_param}"
|
||||
fi
|
||||
}
|
||||
|
||||
#######################################
|
||||
# Check Grub Command Lines for duplicate entries.
|
||||
# Globals:
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
check_grub_cmdline() {
|
||||
### Variable and Array declaration.
|
||||
declare var_grub_file="${TARGET}/etc/default/grub"
|
||||
declare var_grub_linux_line="" var_grub_default_line="" dup="" key="" p="" source=""
|
||||
declare -a ary_default_params=() ary_linux_params=()
|
||||
### Combine for conflict analysis.
|
||||
declare -A hmp_param_values=()
|
||||
declare -A hmp_param_sources=()
|
||||
declare -A hmp_duplicate_params=()
|
||||
|
||||
### Extract lines.
|
||||
var_grub_linux_line=$(grep -E '^GRUB_CMDLINE_LINUX=' "${var_grub_file}" | sed -E 's/GRUB_CMDLINE_LINUX=//')
|
||||
var_grub_default_line=$(grep -E '^GRUB_CMDLINE_LINUX_DEFAULT=' "${var_grub_file}" | sed -E 's/GRUB_CMDLINE_LINUX_DEFAULT=//')
|
||||
|
||||
### Parse both lines.
|
||||
mapfile -t ary_linux_params < <(parse_cmdline "${var_grub_linux_line}")
|
||||
mapfile -t ary_default_params < <(parse_cmdline "${var_grub_default_line}")
|
||||
|
||||
### Loop over all parameters.
|
||||
for source in "linux" "default"; do
|
||||
declare -n params="ary_${source}_params"
|
||||
for p in "${params[@]}"; do
|
||||
key=$(extract_key "${p}")
|
||||
if [[ -v hmp_param_values["${key}"] ]]; then
|
||||
if [[ "${hmp_param_values[${key}]}" != "${p}" ]]; then
|
||||
echo "Conflict: Parameter '${key}' has multiple values:"
|
||||
echo "- ${hmp_param_values[${key}]} (from ${hmp_param_sources[${key}]})"
|
||||
echo "- ${p} (from ${source})"
|
||||
else
|
||||
hmp_duplicate_params["${p}"]=1
|
||||
fi
|
||||
else
|
||||
hmp_param_values["${key}"]="${p}"
|
||||
hmp_param_sources["${key}"]="${source}"
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
### Report duplicates.
|
||||
if (( ${#hmp_duplicate_params[@]} > 0 )); then
|
||||
echo "Duplicate parameters found:"
|
||||
for dup in "${!hmp_duplicate_params[@]}"; do
|
||||
echo "- ${dup}"
|
||||
done
|
||||
fi
|
||||
|
||||
echo "GRUB_CMDLINE check complete."
|
||||
return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -1,41 +0,0 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-02-13; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-ExternalRef: GIT https://cendev.eu/marc.weidner/CISS.2025.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.2025.hardened.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
###########################################################################################
|
||||
# Wrapper to check if recovery partition is selected and if so, proceed with setup of recovery OS.
|
||||
# Globals:
|
||||
# MAP_MOUNTPATH_DEV
|
||||
# MODULE_ERR
|
||||
# MODULE_TXT
|
||||
# Arguments:
|
||||
# None
|
||||
###########################################################################################
|
||||
wrapper_recovery() {
|
||||
|
||||
declare FOUND="false"
|
||||
declare MOUNT_PATH=""
|
||||
declare HASHMAP_VALUE=""
|
||||
|
||||
for MOUNT_PATH in "${!MAP_MOUNTPATH_DEV[@]}"; do
|
||||
HASHMAP_VALUE="${MAP_MOUNTPATH_DEV[${MOUNT_PATH}]}"
|
||||
if [[ ${HASHMAP_VALUE} == "/dev/mapper/crypt_rescue" ]]; then
|
||||
FOUND="true"
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ ${FOUND} == true ]]; then
|
||||
3_9_0_functions_installation_setup_recovery
|
||||
3_9_1_functions_installation_generate_files_recovery
|
||||
fi
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -1,83 +0,0 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-02-13; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-ExternalRef: GIT https://cendev.eu/marc.weidner/CISS.2025.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.2025.hardened.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
###########################################################################################
|
||||
# Mounting '/dev/mapper/crypt_rescue', debootstrap recovery partition, preparing chroot.
|
||||
# Globals:
|
||||
# ERR_CHROOT_MOUNTS
|
||||
# ERR_DE_BOOT_STRAP
|
||||
# MODULE_ERR
|
||||
# MODULE_TXT
|
||||
# RECOVERY
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
###########################################################################################
|
||||
setup_recovery() {
|
||||
|
||||
# The '/dev/mapper/crypt_rescue' partition is not mounted by the installation script by default,
|
||||
# as it is not required to be automatically mounted by the production system via '/etc/crypttab' and '/etc/fstab'.
|
||||
mount /dev/mapper/crypt_rescue "${RECOVERY}"
|
||||
|
||||
# Debootstrap for a minimalistic Debian OS.
|
||||
if debootstrap --arch amd64 bookworm "${RECOVERY}" https://deb.debian.org/debian; then
|
||||
do_log "info" "file_only" "Executing 'debootstrap --arch amd64 bookworm '${RECOVERY}' https://deb.debian.org/debian' successful."
|
||||
else
|
||||
do_log "emergency" "file_only" "Executing 'debootstrap --arch amd64 bookworm '${RECOVERY}' https://deb.debian.org/debian' NOT successful."
|
||||
exit "${ERR_DE_BOOT_STRAP}"
|
||||
fi
|
||||
|
||||
### Reminder ###
|
||||
# --rbind: recursive binding.
|
||||
# --make-rslave: In this case, the mount point is marked as 'slave'.
|
||||
# This means changes to the source mount (e.g., /proc) are propagated to the target mount (e.g., "${TARGET}"/proc).
|
||||
# Conversely, changes to the target mount are not propagated back to the source mount.
|
||||
# This mode is necessary to avoid problems with double or erroneous propagation effects in chroot or container environments.
|
||||
|
||||
# Prepare the freshly installed Debian OS recovery system for further setup.
|
||||
if mount --make-rslave --rbind /proc "${RECOVERY}"/proc; then
|
||||
do_log "info" "file_only" "'mount --make-rslave --rbind /proc ${RECOVERY}/proc'."
|
||||
else
|
||||
do_log "emergency" "file_only" "Failed: 'mount --make-rslave --rbind /proc ${RECOVERY}/proc'."
|
||||
exit "${ERR_CHROOT_MOUNTS}"
|
||||
fi
|
||||
|
||||
if mount --make-rslave --rbind /sys "${RECOVERY}"/sys; then
|
||||
do_log "info" "file_only" "'mount --make-rslave --rbind /sys ${RECOVERY}/sys'."
|
||||
else
|
||||
do_log "emergency" "file_only" "Failed: 'mount --make-rslave --rbind /sys ${RECOVERY}/sys'."
|
||||
exit "${ERR_CHROOT_MOUNTS}"
|
||||
fi
|
||||
|
||||
if mount --make-rslave --rbind /dev "${RECOVERY}"/dev; then
|
||||
do_log "info" "file_only" "'mount --make-rslave --rbind /dev ${RECOVERY}/dev'."
|
||||
else
|
||||
do_log "emergency" "file_only" "Failed: 'mount --make-rslave --rbind /dev ${RECOVERY}/dev'."
|
||||
exit "${ERR_CHROOT_MOUNTS}"
|
||||
fi
|
||||
|
||||
if mount --make-rslave --rbind /run "${RECOVERY}"/run; then
|
||||
do_log "info" "file_only" "'mount --make-rslave --rbind /run ${RECOVERY}/run'."
|
||||
else
|
||||
do_log "emergency" "file_only" "Failed: 'mount --make-rslave --rbind /run ${RECOVERY}/run'."
|
||||
exit "${ERR_CHROOT_MOUNTS}"
|
||||
fi
|
||||
|
||||
if chroot_exec "${TARGET}" mkdir -p /etc/systemd/system/multi-user.target.wants; then
|
||||
do_log "info" "file_only" "Command: 'mkdir -p /etc/systemd/system/multi-user.target.wants' executed in: '${RECOVERY}'."
|
||||
else
|
||||
do_log "emergency" "file_only" "Failed: Command: 'mkdir -p /etc/systemd/system/multi-user.target.wants' executed in: '${RECOVERY}'."
|
||||
fi
|
||||
|
||||
do_show_footer "${MODULE_TXT}"
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
|
||||
@@ -1,387 +0,0 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-02-13; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-ExternalRef: GIT https://cendev.eu/marc.weidner/CISS.2025.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.2025.hardened.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
###########################################################################################
|
||||
# Generates '${RECOVERY}/etc/crypttab' and '${RECOVERY}/etc/fstab' files for recovery partition.
|
||||
# Globals:
|
||||
# tba
|
||||
# Arguments:
|
||||
# None
|
||||
###########################################################################################
|
||||
generate_files_recovery() {
|
||||
|
||||
### BLOCK '${RECOVERY}/etc/crypttab'
|
||||
|
||||
# Generate '${RECOVERY}/etc/crypttab'
|
||||
touch "${RECOVERY}"/etc/crypttab
|
||||
chmod 0644 "${RECOVERY}"/etc/crypttab
|
||||
|
||||
# Generate '${RECOVERY}/etc/crypttab' header
|
||||
# shellcheck disable=SC2129
|
||||
cat << EOF >> "${RECOVERY}"/etc/crypttab
|
||||
# <name> <device> <password-file-or-none> <options>
|
||||
|
||||
EOF
|
||||
|
||||
### Reminder ###
|
||||
# MAP_MOUNTPATH_DEV["${MOUNT_PATH}"]="/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
# MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]="${UUID}"
|
||||
# MAP_PATH_CRYPT["${MOUNT_PATH}"]="${ENCRYPTION_LABEL}"
|
||||
|
||||
# Extract the key from HashMap MAP_PATH_CRYPT["${MOUNT_PATH}"]="${ENCRYPTION_LABEL}"
|
||||
declare KEY=""
|
||||
declare VAR=""
|
||||
|
||||
for VAR in "${!MAP_PATH_CRYPT[@]}"; do
|
||||
if [[ ${MAP_PATH_CRYPT[$VAR]} == "crypt_rescue" ]]; then
|
||||
KEY="${VAR}"
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
declare ENCRYPTION_LABEL
|
||||
ENCRYPTION_LABEL="${MAP_PATH_CRYPT["${KEY}"]}"
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on /dev/mapper/${MAP_PATH_CRYPT["${KEY}"]} during installation" >> "${RECOVERY}"/etc/crypttab
|
||||
echo "${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]} none luks,discard" >> "${RECOVERY}"/etc/crypttab
|
||||
echo "" >> "${RECOVERY}"/etc/crypttab
|
||||
do_log "info" "file_only" "crypttab entry generated: '${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]} none luks,discard'."
|
||||
|
||||
|
||||
# Generate '${RECOVERY}/etc/crypttab' special ephemeral entries.
|
||||
declare -a EPHEMERAL_MOUNT_PATH=("SWAP" "/tmp")
|
||||
declare KEY=""
|
||||
|
||||
# MAP_EPHEMERAL_DEV["${MOUNT_PATH}"]="/dev/${DEV}${PARTITION}"
|
||||
# MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]="${ENCRYPTION_LABEL}"
|
||||
for KEY in "${EPHEMERAL_MOUNT_PATH[@]}"; do
|
||||
|
||||
if [[ ${KEY} == "SWAP" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_EPHEMERAL_DEV[${KEY}]} during installation" >> "${RECOVERY}"/etc/crypttab
|
||||
echo "${MAP_EPHEMERAL_ENCLABEL[${KEY}]} LABEL=SWAP /dev/random swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096" >> "${RECOVERY}"/etc/crypttab
|
||||
echo "" >> "${RECOVERY}"/etc/crypttab
|
||||
do_log "info" "file_only" "'${RECOVERY}/etc/crypttab' entry generated: '${MAP_EPHEMERAL_ENCLABEL[${KEY}]} LABEL=SWAP /dev/random swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096'."
|
||||
|
||||
elif [[ ${KEY} == "/tmp" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_EPHEMERAL_DEV[${KEY}]} during installation" >> "${RECOVERY}"/etc/crypttab
|
||||
echo "${MAP_EPHEMERAL_ENCLABEL[${KEY}]} LABEL=ext4_tmp /dev/random offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4" >> "${RECOVERY}"/etc/crypttab
|
||||
echo "" >> "${RECOVERY}"/etc/crypttab
|
||||
do_log "info" "file_only" "'${RECOVERY}/etc/crypttab' entry generated: '${MAP_EPHEMERAL_ENCLABEL[${KEY}]} LABEL=ext4_tmp /dev/random offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4'."
|
||||
|
||||
else
|
||||
|
||||
do_log "info" "file_only" "${RECOVERY}/etc/crypttab (This message should never get printed.)"
|
||||
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
### BLOCK '${RECOVERY}/etc/fstab'
|
||||
|
||||
# Generate '${RECOVERY}/etc/fstab'
|
||||
touch "${RECOVERY}"/etc/fstab
|
||||
chmod 0644 "${RECOVERY}"/etc/fstab
|
||||
|
||||
# Generate '${RECOVERY}/etc/fstab' header
|
||||
# shellcheck disable=SC2129
|
||||
cat << EOF >> "${RECOVERY}"/etc/fstab
|
||||
# /etc/fstab: static file system information.
|
||||
#
|
||||
# Use 'blkid' to print the universally unique identifier for a
|
||||
# device; this may be used with UUID= as a more robust way to name devices
|
||||
# that works even if disks are added and removed. See fstab(5).
|
||||
#
|
||||
# systemd generates mount units based on this file, see systemd.mount(5).
|
||||
# Please run 'systemctl daemon-reload' after making changes here.
|
||||
#
|
||||
# <file system> <mount point> <type> <options> <dump> <pass>
|
||||
|
||||
EOF
|
||||
|
||||
### Reminder ###
|
||||
# MAP_MOUNTPATH_DEV["${MOUNT_PATH}"]="/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
# MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]="${UUID}"
|
||||
# MAP_PATH_CRYPT["${MOUNT_PATH}"]="${ENCRYPTION_LABEL}"
|
||||
|
||||
# Generate '${TARGET}/etc/fstab' special entries '/' '/boot' '/boot/efi'.
|
||||
# Define the order of the special keys.
|
||||
declare -a KEY_ORDER
|
||||
KEY_ORDER=("/RECOVERY")
|
||||
|
||||
declare DEVICE_PATH
|
||||
declare DEVICE_UUID
|
||||
declare ENCRYPTION_LABEL
|
||||
declare KEY
|
||||
declare MATCHING_VAR
|
||||
declare TRANSFORMED_STRING
|
||||
|
||||
for KEY in "${KEY_ORDER[@]}"; do
|
||||
# Initialize variables
|
||||
DEVICE_PATH="${MAP_MOUNTPATH_DEV[${KEY}]}"
|
||||
DEVICE_UUID=$(blkid -s UUID -o value "${DEVICE_PATH}")
|
||||
|
||||
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
|
||||
if [[ ${DEVICE_PATH} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
|
||||
|
||||
TRANSFORMED_STRING=$(echo "${DEVICE_PATH}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
|
||||
|
||||
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
elif [[ ${DEVICE_PATH} =~ ^/dev/mapper/ ]]; then
|
||||
|
||||
# Extract ENCRYPTION_LABEL
|
||||
ENCRYPTION_LABEL="${DEVICE_PATH#/dev/mapper/}"
|
||||
|
||||
# Search matching variable of the sourced "${PRESEED}" variable file
|
||||
MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${ENCRYPTION_LABEL}")
|
||||
|
||||
if [[ -n ${MATCHING_VAR} ]]; then
|
||||
|
||||
# Extract third, fourth and fifth part of the respective variable
|
||||
TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${ENCRYPTION_LABEL}'."
|
||||
exit "${ERR_NO_ENCR_LABEL}"
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${DEVICE_PATH}'."
|
||||
exit "${ERR_NO_DEVIC_PATH}"
|
||||
|
||||
fi
|
||||
|
||||
declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
|
||||
declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
|
||||
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
|
||||
declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
|
||||
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
|
||||
declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"
|
||||
|
||||
declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
|
||||
declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
|
||||
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
|
||||
declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
|
||||
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
|
||||
declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
|
||||
|
||||
if [[ ${KEY} == "/" ]]; then
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
|
||||
|
||||
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "${MAP_MOUNTPATH_DEV[${KEY}]} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 1" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "file_only" "fstab entry generated: '${MAP_MOUNTPATH_DEV[${KEY}]} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 1'."
|
||||
|
||||
elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "${MAP_MOUNTPATH_DEV[${KEY}]} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 1" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "file_only" "fstab entry generated: '${MAP_MOUNTPATH_DEV[${KEY}]} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 1'."
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${KEY}'."
|
||||
|
||||
fi
|
||||
|
||||
elif [[ ${KEY} == "/boot" ]]; then
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
|
||||
|
||||
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "file_only" "fstab entry generated: 'UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2'."
|
||||
|
||||
elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "file_only" "fstab entry generated: 'UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2'."
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${KEY}'."
|
||||
|
||||
fi
|
||||
|
||||
elif [[ ${KEY} == "/boot/efi" ]]; then
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION} == "fat32" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${DEVICE_UUID} ${KEY} vfat umask=0077 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "file_only" "fstab entry generated: 'UUID=${DEVICE_UUID} ${KEY} vfat umask=0077 0 2'."
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${KEY}'."
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid '${KEY}' for '/', '/boot', '/boot/efi' found."
|
||||
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
# Generate '${TARGET}/etc/fstab' remaining entries
|
||||
for KEY in "${!MAP_MOUNTPATH_DEV[@]}"; do
|
||||
|
||||
# Initialize variables
|
||||
DEVICE_PATH="${MAP_MOUNTPATH_DEV[${KEY}]}"
|
||||
DEVICE_UUID=$(blkid -s UUID -o value "${DEVICE_PATH}")
|
||||
|
||||
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
|
||||
if [[ ${DEVICE_PATH} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
|
||||
|
||||
TRANSFORMED_STRING=$(echo "${DEVICE_PATH}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
|
||||
|
||||
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
elif [[ ${DEVICE_PATH} =~ ^/dev/mapper/ ]]; then
|
||||
|
||||
# Extract ENCRYPTION_LABEL
|
||||
ENCRYPTION_LABEL="${DEVICE_PATH#/dev/mapper/}"
|
||||
|
||||
# Search matching variable of the sourced "${PRESEED}" variable file
|
||||
MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${ENCRYPTION_LABEL}")
|
||||
|
||||
if [[ -n ${MATCHING_VAR} ]]; then
|
||||
|
||||
# Extract third, fourth and fifth part of the respective variable
|
||||
TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${ENCRYPTION_LABEL}'."
|
||||
exit "${ERR_NO_ENCR_LABEL}"
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${DEVICE_PATH}'."
|
||||
exit "${ERR_NO_DEVIC_PATH}"
|
||||
|
||||
fi
|
||||
|
||||
declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
|
||||
declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
|
||||
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
|
||||
declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
|
||||
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
|
||||
declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"
|
||||
|
||||
declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
|
||||
declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
|
||||
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
|
||||
declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
|
||||
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
|
||||
declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
|
||||
|
||||
# Skip already mounted paths ("/", "/boot", "/boot/efi")
|
||||
if [[ " ${KEY_ORDER[*]} " == *" ${KEY} "* ]]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
|
||||
|
||||
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "file_only" "fstab entry generated: 'UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2'."
|
||||
|
||||
elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "file_only" "fstab entry generated: 'UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2'."
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${KEY}'."
|
||||
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
# Add entry for CD-ROM device
|
||||
# shellcheck disable=2129
|
||||
echo "# /media/cdrom0 was on /dev/sr0 during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "file_only" "fstab entry generated: '/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0'."
|
||||
|
||||
# Add entry for proc and tmpfs device
|
||||
# shellcheck disable=2129
|
||||
echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
|
||||
echo "proc /proc proc nodev,nosuid,noexec,hidepid=2 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,relatime,size=1G 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "file_only" "fstab entry generated: 'proc /proc proc nodev,nosuid,noexec,hidepid=2 0 0'."
|
||||
do_log "info" "file_only" "fstab entry generated: 'tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,relatime,size=1G 0 0'."
|
||||
|
||||
|
||||
# Add entry for SWAP device
|
||||
declare MOUNT_PATH="SWAP"
|
||||
# shellcheck disable=2129
|
||||
echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
|
||||
echo "${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} none swap defaults 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "file_only" "fstab entry generated: '${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} none swap defaults 0 0'."
|
||||
|
||||
|
||||
# Add entry for '/tmp' device
|
||||
declare MOUNT_PATH="/tmp"
|
||||
# shellcheck disable=2129
|
||||
echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
|
||||
echo "${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} /tmp ext4 defaults,rw,nodev,nosuid,relatime 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "file_only" "fstab entry generated: '${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} /tmp ext4 defaults,rw,nodev,nosuid,relatime 0 0'."
|
||||
|
||||
|
||||
|
||||
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
|
||||
73
func/cdi_5000_recovery/5000_debootstrap.sh
Normal file
73
func/cdi_5000_recovery/5000_debootstrap.sh
Normal file
@@ -0,0 +1,73 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Install a minimal Debian environment using the 'debootstrap' command.
|
||||
# Globals:
|
||||
# LOG_REC
|
||||
# RECOVERY
|
||||
# VAR_ARCHITECTURE
|
||||
# VAR_CODENAME
|
||||
# debootstrap_includes
|
||||
# debootstrap_mirror
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
# ERR_DEBOOTSTRAP
|
||||
#######################################
|
||||
func_debootstrap_reco() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -r var_arch="${VAR_ARCHITECTURE}"
|
||||
declare -r var_dist="${VAR_CODENAME}"
|
||||
declare -r var_target="${RECOVERY}"
|
||||
declare -r var_mirror="${debootstrap_mirror}"
|
||||
declare -r var_includes="${debootstrap_includes}"
|
||||
declare -a ary_cmd=()
|
||||
|
||||
ary_cmd+=( "debootstrap" "--arch=${var_arch}" "--keep-debootstrap-dir" "--log-extra-deps" "--merged-usr" )
|
||||
|
||||
if [[ -n "${var_includes}" ]]; then ary_cmd+=( "--include=${var_includes}" ); fi
|
||||
|
||||
ary_cmd+=( "${var_dist}" "${var_target}" "${var_mirror}" )
|
||||
|
||||
do_log "debug" "file_only" "5000() Executing: [${ary_cmd[*]}]"
|
||||
|
||||
# shellcheck disable=SC2312
|
||||
if "${ary_cmd[@]}" | tee "${LOG_REC}"; then
|
||||
|
||||
do_log "info" "file_only" "5000() [${ary_cmd[*]}] successful."
|
||||
|
||||
install -d -m 0700 -o root -g root "${var_target}/root/.ciss/cdi/backup"
|
||||
install -d -m 0700 -o root -g root "${var_target}/root/.ciss/cdi/debootstrap"
|
||||
install -d -m 0700 -o root -g root "${var_target}/root/.ciss/cdi/hooks"
|
||||
install -d -m 0700 -o root -g root "${var_target}/root/.ciss/cdi/keys"
|
||||
install -d -m 0700 -o root -g root "${var_target}/root/.ciss/cdi/log"
|
||||
|
||||
mv -T "${var_target}/debootstrap" "${var_target}/root/.ciss/cdi/debootstrap"
|
||||
|
||||
chmod 0700 "${var_target}/root/.ciss"
|
||||
chmod 0700 "${var_target}/root/.ciss/cdi"
|
||||
chmod 0700 "${var_target}/root/.ciss/cdi/debootstrap"
|
||||
|
||||
guard_dir && return 0
|
||||
|
||||
else
|
||||
|
||||
do_log "emergency" "file_only" "5000() [${ary_cmd[*]}] failed."
|
||||
return "${ERR_DEBOOTSTRAP}"
|
||||
|
||||
fi
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
83
func/cdi_5000_recovery/5005_debootstrap_checks.sh
Normal file
83
func/cdi_5000_recovery/5005_debootstrap_checks.sh
Normal file
@@ -0,0 +1,83 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Preliminary post debootstrap checks.
|
||||
# Globals:
|
||||
# RECOVERY
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
check_debootstrap_reco() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -r var_logfile="/root/.ciss/cdi/log/5005_debootstrap_checks.log"
|
||||
|
||||
chroot_logger "${RECOVERY}${var_logfile}"
|
||||
|
||||
chroot_script "${RECOVERY}" "
|
||||
{
|
||||
### Header
|
||||
echo '==[debootstrap checks]=='
|
||||
date -Is 2>/dev/null || true
|
||||
|
||||
### dpkg audit (non-fatal)
|
||||
echo '### dpkg --audit'
|
||||
dpkg --audit || true
|
||||
|
||||
### essential subset (status & version)
|
||||
echo '### dpkg-query essential subset'
|
||||
dpkg-query -W -f='\${db:Status-Abbrev} \${binary:Package} \${Version}\n' dpkg libc6 coreutils bash apt systemd 2>/dev/null || true
|
||||
|
||||
### init presence (log explicit)
|
||||
echo '### init presence'
|
||||
if [[ -x /sbin/init ]] || [[ -x /lib/systemd/systemd ]]; then
|
||||
echo 'init_present=yes'
|
||||
else
|
||||
echo 'init_present=no'
|
||||
fi
|
||||
|
||||
### awk path and alternative link (if any)
|
||||
echo '### awk'
|
||||
awk_path=\$(command -v awk || true)
|
||||
printf 'awk_path=%s\n' \"\$awk_path\"
|
||||
if [[ -L /usr/bin/awk ]]; then
|
||||
printf 'awk_link=/usr/bin/awk -> %s\n' \"\$(readlink -f /usr/bin/awk 2>/dev/null || true)\"
|
||||
fi
|
||||
|
||||
### usr-merge / tainted check
|
||||
echo '### usr-merge / taint'
|
||||
usr_merge_ok=yes
|
||||
for p in /bin /sbin /lib /lib64; do
|
||||
[[ -e \"\$p\" ]] || continue
|
||||
if [[ -L \"\$p\" ]]; then
|
||||
tgt=\$(readlink -f \"\$p\" 2>/dev/null || true)
|
||||
printf '%s -> %s\n' \"\$p\" \"\$tgt\"
|
||||
else
|
||||
usr_merge_ok=no
|
||||
printf '%s is not a symlink (tainted: unmerged-bin)\n' \"\$p\"
|
||||
fi
|
||||
done
|
||||
printf 'usr_merge_ok=%s\n' \"\$usr_merge_ok\"
|
||||
|
||||
### architecture
|
||||
echo '### architecture'
|
||||
dpkg --print-architecture 2>/dev/null || true
|
||||
} >> ${var_logfile}
|
||||
"
|
||||
|
||||
guard_dir && return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
119
func/cdi_5000_recovery/5010_prepare_mounts.sh
Normal file
119
func/cdi_5000_recovery/5010_prepare_mounts.sh
Normal file
@@ -0,0 +1,119 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Configure the recovery system for chroot.
|
||||
# Globals:
|
||||
# ERR_CHRT_MOUNTS
|
||||
# RECOVERY
|
||||
# VAR_CHROOT_ACTIVATED
|
||||
# VAR_NEED_RUN_IN_TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# ERR_CHRT_MOUNTS
|
||||
# 0: on success
|
||||
#######################################
|
||||
prepare_mounts_reco() {
|
||||
|
||||
### Notes
|
||||
# This file mounts all necessary pseudo filesystems into the target root environment to enable chroot operations.
|
||||
# --rbind: recursive binding.
|
||||
# --make-rslave: In this case, the mount point is marked as 'slave'.
|
||||
# This means changes to the source mount (e.g., /proc) are propagated to the target mount (e.g., "${RECOVERY}/proc").
|
||||
# Conversely, changes to the target mount are not propagated back to the source mount.
|
||||
# This mode is necessary to avoid problems with double or erroneous propagation effects in chroot or container environments.
|
||||
#
|
||||
# Some subdirectories (such as /dev/pts, /dev/shm, /sys/fs/cgroup) are remounted with more restrictive options
|
||||
# like 'noexec', 'nosuid', and 'nodev' to enhance security. This ensures they override the inherited bind-mounts and
|
||||
# enforce proper runtime behavior in the chroot.
|
||||
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -A HMP_SPECIAL_MOUNTS=(
|
||||
["/dev"]="devtmpfs devtmpfs mode=0755,nosuid" # Base device node FS
|
||||
["/dev/pts"]="devpts devpts noexec,nosuid" # Pseudoterminals
|
||||
["/dev/shm"]="tmpfs tmpfs rw,nosuid,nodev" # Shared memory
|
||||
["/dev/mqueue"]="mqueue mqueue rw,nosuid,nodev,noexec" # POSIX message queues
|
||||
["/dev/hugepages"]="hugetlbfs hugetlbfs rw,nosuid,nodev" # Huge pages
|
||||
["/proc"]="proc proc nosuid,noexec,nodev" # procfs
|
||||
["/sys"]="sysfs sysfs nosuid,noexec,nodev" # sysfs
|
||||
["/sys/fs/cgroup"]="cgroup2 cgroup2 rw,nosuid,nodev,noexec,relatime" # Unified cgroup2
|
||||
)
|
||||
|
||||
declare var_path="" var_fs="" var_src="" var_opts=""
|
||||
|
||||
for var_path in "${!HMP_SPECIAL_MOUNTS[@]}"; do
|
||||
|
||||
mkdir -p "${RECOVERY}${var_path}"
|
||||
|
||||
done
|
||||
|
||||
|
||||
for var_path in "${!HMP_SPECIAL_MOUNTS[@]}"; do
|
||||
|
||||
IFS=" " read -r var_fs var_src var_opts <<< "${HMP_SPECIAL_MOUNTS[${var_path}]}"
|
||||
|
||||
if mountpoint -q "${RECOVERY}${var_path}"; then
|
||||
|
||||
do_log "info" "file_only" "5010() Skipped: '${RECOVERY}${var_path}' is already a mountpoint."
|
||||
continue
|
||||
|
||||
fi
|
||||
|
||||
if ! mount -t "${var_fs}" "${var_src}" "${RECOVERY}${var_path}" -o "${var_opts}"; then
|
||||
|
||||
do_log "emergency" "file_only" "5010() Command: [mount -t ${var_fs} ${var_src} ${RECOVERY}${var_path} -o ${var_opts}] failed."
|
||||
return "${ERR_CHRT_MOUNTS}"
|
||||
|
||||
fi
|
||||
|
||||
do_log "info" "file_only" "5010() Command: [mount -t ${var_fs} ${var_src} ${RECOVERY}${var_path} -o ${var_opts}] successful."
|
||||
|
||||
done
|
||||
|
||||
|
||||
if [[ "${VAR_NEED_RUN_IN_TARGET:-false}" == "true" ]]; then
|
||||
|
||||
mkdir -p "${RECOVERY}/run"
|
||||
|
||||
if ! mount --make-rslave --rbind /run "${RECOVERY}/run"; then
|
||||
|
||||
do_log "emergency" "file_only" "5010() Command: [mount --make-rslave --rbind /run ${RECOVERY}/run] failed."
|
||||
return "${ERR_CHRT_MOUNTS}"
|
||||
|
||||
fi
|
||||
|
||||
do_log "info" "file_only" "5010() Command: [mount --make-rslave --rbind /run ${RECOVERY}/run] successful."
|
||||
|
||||
fi
|
||||
|
||||
|
||||
if ! chroot_exec "${RECOVERY}" mkdir -p /etc/systemd/system/multi-user.target.wants; then
|
||||
|
||||
do_log "emergency" "file_only" "5010() Command: [chroot_exec ${RECOVERY} mkdir -p /etc/systemd/system/multi-user.target.wants] failed."
|
||||
return "${ERR_CHRT_MOUNTS}"
|
||||
|
||||
fi
|
||||
|
||||
do_log "info" "file_only" "5010() Command: [chroot_exec ${RECOVERY} mkdir -p /etc/systemd/system/multi-user.target.wants] successful."
|
||||
|
||||
mkdir -p "${RECOVERY}/media/cdrom0"
|
||||
|
||||
# shellcheck disable=SC2034
|
||||
declare -gx VAR_CHROOT_ACTIVATED="recovery"
|
||||
do_log "info" "file_only" "5010() Command: [declare -gx VAR_CHROOT_ACTIVATED=recovery]"
|
||||
|
||||
guard_dir && return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
49
func/cdi_5000_recovery/5015_check_usr_merge.sh
Normal file
49
func/cdi_5000_recovery/5015_check_usr_merge.sh
Normal file
@@ -0,0 +1,49 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Check if the recovery system is not 'tainted: unmerged-usr'.
|
||||
# Globals:
|
||||
# RECOVERY
|
||||
# architecture
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
check_usr_merge_reco() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -r var_logfile="/root/.ciss/cdi/log/5015_check_usr_merge.log"
|
||||
|
||||
chroot_logger "${RECOVERY}${var_logfile}"
|
||||
|
||||
# shellcheck disable=SC2312
|
||||
chroot_script "${RECOVERY}" "
|
||||
test -L /bin && test $(readlink -f /bin) = '/usr/bin' && echo 'MERGED:/bin' >> ${var_logfile} || echo 'UNMERGED:/bin' >> ${var_logfile}
|
||||
test -L /sbin && test $(readlink -f /sbin) = '/usr/sbin' && echo 'MERGED:/sbin' >> ${var_logfile} || echo 'UNMERGED:/sbin' >> ${var_logfile}
|
||||
test -L /lib && test $(readlink -f /lib) = '/usr/lib' && echo 'MERGED:/lib' >> ${var_logfile} || echo 'UNMERGED:/lib' >> ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
if [[ "${architecture}" == "amd64" ]]; then
|
||||
# shellcheck disable=SC2312
|
||||
chroot_script "${RECOVERY}" "
|
||||
test -L /lib64 && test $(readlink -f /lib64) = '/usr/lib64' && echo 'MERGED:/lib64' >> ${var_logfile} || echo 'UNMERGED:/lib64' >> ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
fi
|
||||
|
||||
guard_dir && return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
42
func/cdi_5000_recovery/5020_remove_x509.sh
Normal file
42
func/cdi_5000_recovery/5020_remove_x509.sh
Normal file
@@ -0,0 +1,42 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Chroot hook for deleting all expired X.509 certificates in the recovery system.
|
||||
# Globals:
|
||||
# RECOVERY
|
||||
# VAR_SETUP_PATH
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
remove_x509_reco() {
|
||||
|
||||
install -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/chroot/hooks/4020_remove_x509.hooks.sh" \
|
||||
"${RECOVERY}/root/.ciss/cdi/hooks/5020_remove_x509.hooks.sh"
|
||||
|
||||
if ! chroot_script "${RECOVERY}" "/root/.ciss/cdi/hooks/5020_remove_x509.hooks.sh" "emergency"; then
|
||||
|
||||
do_log "warn" "file_only" "5020() Command: [chroot_script ${RECOVERY} /root/.ciss/cdi/hooks/5020_remove_x509.hooks.sh emergency] failed."
|
||||
|
||||
else
|
||||
|
||||
do_log "debug" "file_only" "5020() Command: [chroot_script ${RECOVERY} /root/.ciss/cdi/hooks/5020_remove_x509.hooks.sh emergency] successful."
|
||||
|
||||
fi
|
||||
|
||||
guard_dir && return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -13,19 +13,19 @@
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Basic '/etc/crypttab' checks inside chroot.
|
||||
# Configure the '/etc/hostname' | '/etc/hosts' | '/etc/mailname' files.
|
||||
# Globals:
|
||||
# RECOVERY
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
check_crypttab() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
#declare -r var_logfile="/root/.ciss/cdi/log/4215_check_crypttab.log"
|
||||
|
||||
#chroot_logger "${TARGET}${var_logfile}"
|
||||
setup_hostname_reco() {
|
||||
cp -a "${TARGET}/etc/hosts" "${RECOVERY}/etc/hosts"
|
||||
cp -a "${TARGET}/etc/hostname" "${RECOVERY}/etc/hostname"
|
||||
cp -a "${TARGET}/etc/mailname" "${RECOVERY}/etc/mailname"
|
||||
|
||||
guard_dir && return 0
|
||||
}
|
||||
@@ -13,15 +13,24 @@
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Finalize the system.
|
||||
# Configure the '/etc/resolv.conf' file.
|
||||
# Globals:
|
||||
# RECOVERY
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
finalize_system() {
|
||||
setup_resolv_reco() {
|
||||
if [[ -f "${RECOVERY}/etc/resolv.conf" ]]; then
|
||||
mkdir -p "${RECOVERY}/root/.ciss/cdi/backup/etc"
|
||||
mv "${RECOVERY}/etc/resolv.conf" "${RECOVERY}/root/.ciss/cdi/backup/etc/resolv.conf.bak"
|
||||
do_log "info" "file_only" "5035() Existing '${RECOVERY}/etc/resolv.conf' moved."
|
||||
fi
|
||||
|
||||
cp -a "${TARGET}/etc/resolv.conf" "${RECOVERY}/etc/resolv.conf"
|
||||
|
||||
guard_dir && return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -13,28 +13,27 @@
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Updating 'machine-id' to 'whonix id'.
|
||||
# Configure the '/etc/timezone' | '/etc/localtime' files.
|
||||
# Globals:
|
||||
# TARGET
|
||||
# VAR_SETUP_PATH
|
||||
# RECOVERY
|
||||
# ntp_timezone
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
setup_machineid() {
|
||||
if [[ -f "${TARGET}/var/lib/dbus/machine-id" ]]; then
|
||||
rm -f "${TARGET}/var/lib/dbus/machine-id"
|
||||
fi
|
||||
install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/machine-id" "${TARGET}/var/lib/dbus/machine-id"
|
||||
setup_timezone_reco() {
|
||||
### Create '${RECOVERY}/etc/timezone' file.
|
||||
cat << EOF >| "${RECOVERY}/etc/timezone"
|
||||
${ntp_timezone:-UTC}
|
||||
EOF
|
||||
chmod 0644 "${RECOVERY}/etc/timezone"
|
||||
do_log "info" "file_only" "5040() File generated: '${RECOVERY}/etc/timezone' | timezone '${ntp_timezone:-UTC}'."
|
||||
|
||||
if [[ -f "${TARGET}/etc/machine-id" ]]; then
|
||||
rm -f "${TARGET}/etc/machine-id"
|
||||
fi
|
||||
install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/machine-id" "${TARGET}/etc/machine-id"
|
||||
chroot_exec "${RECOVERY}" ln -sf "/usr/share/zoneinfo/${ntp_timezone}" /etc/localtime
|
||||
|
||||
do_log "info" "file_only" "Machine ID updated: 'machine-id' to 'whonix id'."
|
||||
chroot_exec "${RECOVERY}" dpkg-reconfigure -f noninteractive tzdata
|
||||
|
||||
return 0
|
||||
guard_dir && return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
48
func/cdi_5000_recovery/5999_exiting_chroot_recovery.sh
Normal file
48
func/cdi_5000_recovery/5999_exiting_chroot_recovery.sh
Normal file
@@ -0,0 +1,48 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Exiting chroot of the target system.
|
||||
# Globals:
|
||||
# RECOVERY
|
||||
# VAR_NEED_RUN_IN_TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
exiting_chroot_recovery() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -a ary_umount=( "/sys/fs/cgroup" "/dev/hugepages" "/dev/mqueue" "/dev/shm" "/dev/pts" "/proc" "/sys" "/dev" )
|
||||
declare var_path=""
|
||||
|
||||
for var_path in "${ary_umount[@]}"; do
|
||||
|
||||
umount -l "${RECOVERY}${var_path}" 2>/dev/null || true
|
||||
do_log "info" "file_only" "5999() Command: [umount -l ${RECOVERY}${var_path} 2>/dev/null || true] issued."
|
||||
|
||||
done
|
||||
|
||||
if [[ "${VAR_NEED_RUN_IN_TARGET:-false}" == "true" ]]; then
|
||||
|
||||
umount -l "${RECOVERY}/run" 2>/dev/null || true
|
||||
do_log "info" "file_only" "5999() Command: [umount -l ${RECOVERY}/run 2>/dev/null || true] issued."
|
||||
|
||||
fi
|
||||
|
||||
declare -gx VAR_CHROOT_ACTIVATED="false"
|
||||
|
||||
guard_dir && return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -1,23 +0,0 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Setup sudo.
|
||||
# Arguments:
|
||||
# None
|
||||
#######################################
|
||||
setup_sudo() {
|
||||
return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
Reference in New Issue
Block a user