V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4000_debootstrap/4010_prepare_mounts.sh

@@ -15,9 +15,10 @@ guard_sourcing
 #######################################
 # Configure the target system for chroot.
 # Globals:
-#   ERR_CHRT_MOUNTS
 #   TARGET
 #   VAR_CHROOT_ACTIVATED
+#   VAR_CHROOT_SYS_MASK_ENTER
+#   VAR_CHROOT_SYS_MASK_LEAVE
 #   VAR_NEED_RUN_IN_TARGET
 # Arguments:
 #   None
@@ -53,6 +54,73 @@ prepare_mounts() {
 
   declare     var_path="" var_fs="" var_src="" var_opts=""
 
+  # shellcheck disable=SC2034
+  declare -g  VAR_CHROOT_SYS_MASK_ENTER=""
+  # shellcheck disable=SC2034
+  VAR_CHROOT_SYS_MASK_ENTER=$(cat <<'EOF'
+declare var_had_sys="0"
+
+if mountpoint -q /sys/fs/cgroup; then
+  umount -l /sys/fs/cgroup || {
+    printf 'ERROR: cannot umount /sys/fs/cgroup\n' >&2
+    return 128
+  }
+fi
+
+if mountpoint -q /sys; then
+  var_had_sys="1"
+  umount -l /sys || {
+    printf 'ERROR: cannot umount /sys\n' >&2
+    return 129
+  }
+fi
+
+mkdir -p /run
+printf '%s\n' "${var_had_sys}" >| /run/.ciss_sysmask  ### 1 = had sysfs, 0 = none
+
+mkdir -p /sys
+### Empty, read-only directory so tools that expect /sys to exist don't fail.
+if ! mount -t tmpfs -o ro,nosuid,nodev,noexec,mode=0555,size=1M tmpfs /sys; then
+  printf 'ERROR: cannot mount tmpfs on /sys\n' >&2
+  return 130
+fi
+EOF
+  )
+
+  # shellcheck disable=SC2034
+  declare -g  VAR_CHROOT_SYS_MASK_LEAVE=""
+  # shellcheck disable=SC2034
+  VAR_CHROOT_SYS_MASK_LEAVE=$(cat <<'EOF'
+declare var_had_sys="0"
+
+if [[ -f /run/.ciss_sysmask ]]; then
+  # shellcheck disable=SC2155
+  declare var_had_sys="$(cat /run/.ciss_sysmask 2>/dev/null || printf '0')"
+fi
+
+if mountpoint -q /sys; then
+  umount -l /sys || {
+    printf 'ERROR: cannot unmount masked /sys\n' >&2
+    return 131
+  }
+fi
+
+### Restore sysfs and cgroup2.
+if ! mount -t sysfs -o nosuid,noexec,nodev sysfs /sys; then
+  printf 'ERROR: cannot mount sysfs on /sys\n' >&2
+  return 132
+fi
+
+mkdir -p /sys/fs/cgroup
+if ! mount -t cgroup2 -o rw,nosuid,nodev,noexec,relatime cgroup2 /sys/fs/cgroup; then
+  printf 'ERROR: cannot mount cgroup2 on /sys/fs/cgroup\n' >&2
+  return 133
+fi
+
+rm -f /run/.ciss_sysmask
+EOF
+  )
+
   for var_path in "${!HMP_SPECIAL_MOUNTS[@]}"; do
 
     mkdir -p "${TARGET}${var_path}"

func/cdi_4200_boot/4210_generate_crypttab.sh

@@ -90,26 +90,26 @@ EOF
       case  "${var_key,,}" in
 
         "/")
-          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "check,discard,initramfs,keyscript=decrypt_keyctl,loud,luks,same-cpu-crypt,tries=1"
+          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "pw_main" "check,discard,initramfs,keyscript=decrypt_keyctl,loud,luks,same-cpu-crypt,tries=1"
           ;;
 
         "/usr")
-          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "check,discard,initramfs,keyscript=decrypt_keyctl,loud,luks,same-cpu-crypt,tries=1"
+          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "pw_main" "check,discard,initramfs,keyscript=decrypt_keyctl,loud,luks,same-cpu-crypt,tries=1"
           ;;
 
         "/boot")
-          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "check,discard,initramfs,loud,luks,same-cpu-crypt,tries=1"
+          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "pw_boot" "check,discard,initramfs,loud,luks,same-cpu-crypt,tries=1"
           ;;
 
         *)
-          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "check,discard,initramfs,keyscript=decrypt_keyctl,loud,luks,same-cpu-crypt,tries=1"
+          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "pw_main" "check,discard,initramfs,keyscript=decrypt_keyctl,loud,luks,same-cpu-crypt,tries=1"
           ;;
 
       esac
 
     else
 
-      write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard"
+      write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "check,discard,luks,same-cpu-crypt"
 
     fi
 

func/cdi_4300_network/4320_update_initramfs.sh

@@ -15,7 +15,9 @@ guard_sourcing
 #######################################
 # Deploy all changes made using the 'update-grub' and 'update-initramfs' commands.
 # Globals:
-#   TARGET
+#   VAR_CHROOT_SYS_MASK_ENTER
+#   VAR_CHROOT_SYS_MASK_LEAVE
+#   VAR_KERNEL
 # Arguments:
 #   None
 # Returns:
@@ -35,9 +37,25 @@ update_initramfs() {
     "
 
   chroot_script "${TARGET}" "
-    depmod -a ${var_kernel}
+    ### Write the two helpers verbatim (no host-side expansion).
+    cat >/tmp/.ciss_sysmask_enter.sh <<'EOS_ENTER'
+${VAR_CHROOT_SYS_MASK_ENTER}
+EOS_ENTER
+
+    cat >/tmp/.ciss_sysmask_leave.sh <<'EOS_LEAVE'
+${VAR_CHROOT_SYS_MASK_LEAVE}
+EOS_LEAVE
+
+    ### run: mask sys, build, unmask.
+    bash -e /tmp/.ciss_sysmask_enter.sh
+
+    depmod -a ${var_kernel} 2>&1 | tee -a ${var_logfile}
+
     update-initramfs -c -v -k all 2>&1 | tee -a ${var_logfile}
     echo ExitCode: \$? >> ${var_logfile}
+
+    bash -e /tmp/.ciss_sysmask_leave.sh
+    rm -f /tmp/.ciss_sysmask_{enter,leave}.sh
   "
 
   chroot_script "${TARGET}" "