V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

.shellcheckrc

@@ -9,6 +9,9 @@
 # SPDX-PackageName: CISS.debian.installer
 # SPDX-Security-Contact: security@coresecret.eu
 
+# https://github.com/koalaman/shellcheck/wiki/directive
+# https://github.com/koalaman/shellcheck/wiki/Optional
+
 encoding=utf-8
 external-sources=true
 shell=bash
@@ -16,6 +19,8 @@ source-path=~/func
 source-path=~/lib
 source-path=~/var
 
+enable=add-default-case
+enable=avoid-negated-conditions
 enable=avoid-nullary-conditions
 enable=check-extra-masked-returns
 enable=check-set-e-suppressed
@@ -24,5 +29,6 @@ enable=deprecate-which
 enable=quote-safe-variables
 enable=require-double-brackets
 enable=require-variable-braces
+enable=useless-use-of-cat
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf

func/cdi_1000_helper/1080_helper_chroot.sh

@@ -142,6 +142,7 @@ chroot_script() {
         box   ) dialog_box_cleaner   ;;
         gauge ) dialog_gauge_cleaner ;;
         text  ) dialog_text_cleaner  ;;
+        *     ) : ;;
       esac
 
       do_log "emergency" "tty" "1080() Launching interactive debug shell in chroot: '${var_chroot_target}'."
@@ -184,9 +185,9 @@ readonly -f chroot_script
 #######################################
 chroot_stdin() {
   ### Declare Arrays, HashMaps, and Variables.
-  declare     var_chroot_target="$1"; shift      ### consume TARGET
+  declare     var_chroot_target="$1"; shift      ### Consume 'TARGET'.
-  declare     payload_marker="$1"; shift         ### consume marker (e.g. "__payload__")
+  declare     payload_marker="$1"; shift         ### Consume marker (e.g. "__payload__").
-  declare     var_log_level_on_error="emergency" ### default
+  declare     var_log_level_on_error="emergency" ### Default.
   declare     var_default_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
   declare     var_mod="${BASH_SOURCE[1]##*/}"; var_mod="${var_mod%%_*}()"
 
@@ -235,6 +236,7 @@ chroot_stdin() {
         box   ) dialog_box_cleaner   ;;
         gauge ) dialog_gauge_cleaner ;;
         text  ) dialog_text_cleaner  ;;
+        *     ) : ;;
       esac
 
       do_log "emergency" "tty" "1080() Launching interactive debug shell in chroot: '${var_chroot_target}'."

func/cdi_4000_debootstrap/4010_prepare_mounts.sh

@@ -58,102 +58,96 @@ prepare_mounts() {
   # shellcheck disable=SC2034
   VAR_CHROOT_SYS_MASK_HELPER=$(cat <<'EOF'
 #-------------------------------------------------------------------------------
-# Helpers: mount detection and conditional umount (idempotent).
+# Quick sys mask for initramfs build (minimalistic, idempotent)
+# - No strict mountpoint probing; we just try and remember what worked.
+# - Safe with 'set -e' because we branch on command success/failure.
 
-# Detect if PATH is an exact mountpoint (not just covered by a parent mount).
+cdi_sys_quick_enter() {
-cdi_is_mountpoint() {
-  declare path="${1:?target path required}"
-
-  if command -v mountpoint >/dev/null 2>&1; then
-
-    mountpoint -q -- "${path}"
-
-    return $?
-
-  fi
-
-  if command -v findmnt >/dev/null 2>&1; then
-
-    # Exact mountpoint check (not -T which matches enclosing mounts).
-    findmnt -rn --mountpoint "${path}" >/dev/null 2>&1 && return 0 || return 1
-
-  fi
-
-  # Fallback: parse /proc/self/mountinfo (field 5 = mountpoint, no spaces here).
-  awk -v p="${path}" '$5==p {found=1; exit} END{exit (found?0:1)}' /proc/self/mountinfo 2>/dev/null
-}
-
-cdi_umount_if_mountpoint() {
-  declare path="${1:?target path required}"
-
-  if cdi_is_mountpoint "${path}"; then
-
-    umount -l -- "${path}" || { printf 'ERROR: cannot umount %s\n' "${path}" >&2; return 128; }
-
-  fi
-
-  return 0
-}
-
-cdi_sys_mask_enter() {
   declare state="/run/.ciss_sysmask"
+  declare did_unmount_cg="0"
+  declare did_mask_sys="0"
+
+  echo "Inside chroot: cdi_sys_quick_enter() @ Start."
+
   mkdir -p /run
-
-  # Record only true mountpoints.
-  declare had_sys="0"
-  declare had_cg="0"
-
-  cdi_is_mountpoint /sys && had_sys="1"
-  cdi_is_mountpoint /sys/fs/cgroup && had_cg="1"
-
-  printf 'HAD_SYS=%s\nHAD_CG=%s\n' "${had_sys}" "${had_cg}" >| "${state}"
-
-  # Unmount only if exact mountpoints exist.
-  cdi_umount_if_mountpoint /sys/fs/cgroup || return 129
-  cdi_umount_if_mountpoint /sys || return 130
-
   mkdir -p /sys
-  mount -t tmpfs -o ro,nosuid,nodev,noexec,mode=0555,size=1M tmpfs /sys \
+
-    || { printf 'ERROR: cannot mount tmpfs on /sys\n' >&2; return 131; }
+  # 1) Try to unmount 'cgroup2' (ok if it wasn't mounted).
+  if umount -l /sys/fs/cgroup 2>/dev/null; then
+
+    did_unmount_cg="1"
+
+  else
+
+    did_unmount_cg="0"
+
+  fi
+
+  # 2) Try to overlay '/sys' with a tiny read-only 'tmpfs' (mask host sysfs view).
+  if mount -t tmpfs -o ro,nosuid,nodev,noexec,mode=0555,size=1M tmpfs /sys 2>/dev/null; then
+
+    did_mask_sys="1"
+
+  else
+
+    did_mask_sys="0"
+
+  fi
+
+  printf 'MASK_SYS=%s\nUNMOUNTED_CG=%s\n' "${did_mask_sys}" "${did_unmount_cg}" >| "${state}"
+
+  echo "${state}"
+
+  echo "Inside chroot: cdi_sys_quick_enter() @ End."
 
   return 0
 }
 
-cdi_sys_mask_leave() {
+cdi_sys_quick_leave() {
   declare state="/run/.ciss_sysmask"
-  declare had_sys="0"
+  declare did_mask_sys="0"
-  declare had_cg="0"
+  declare did_unmount_cg="0"
+
+  echo "Inside chroot: cdi_sys_quick_leave() @ Start."
 
   if [[ -f "${state}" ]]; then
 
     # shellcheck disable=SC2155
-    declare had_sys="$(grep -Eo '^HAD_SYS=[01]' "${state}" 2>/dev/null | cut -d= -f2 || printf '0')"
+    declare did_mask_sys="$(grep -Eo '^MASK_SYS=[01]' "${state}" 2>/dev/null | cut -d= -f2 || printf '0')"
 
     # shellcheck disable=SC2155
-    declare had_cg="$(grep -Eo '^HAD_CG=[01]' "${state}" 2>/dev/null | cut -d= -f2 || printf '0')"
+    declare did_unmount_cg="$(grep -Eo '^UNMOUNTED_CG=[01]' "${state}" 2>/dev/null | cut -d= -f2 || printf '0')"
 
   fi
 
-  # Drop the mask if present (it is an exact mountpoint).
+  # 1) Drop '/sys' mask only if we actually overlaid it.
-  cdi_umount_if_mountpoint /sys || return 132
+  if [[ "${did_mask_sys}" == "1" ]]; then
 
-  if [[ "${had_sys}" == "1" ]]; then
+    if ! umount -l /sys 2>/dev/null; then
 
-    mount -t sysfs -o nosuid,nodev,noexec sysfs /sys \
+      printf 'WARN: could not unmount masked /sys (continuing)\n' >&2
-      || { printf 'ERROR: cannot mount sysfs on /sys\n' >&2; return 133; }
+
+    fi
 
   fi
 
-  if [[ "${had_cg}" == "1" ]]; then
+  # 2) Restore 'cgroup2' only if we unmounted it before.
+  if [[ "${did_unmount_cg}" == "1" ]]; then
 
     mkdir -p /sys/fs/cgroup
-    mount -t cgroup2 -o rw,nosuid,nodev,noexec,relatime cgroup2 /sys/fs/cgroup \
+
-      || { printf 'ERROR: cannot mount cgroup2 on /sys/fs/cgroup\n' >&2; return 134; }
+    if ! mount -t cgroup2 -o rw,nosuid,nodev,noexec,relatime cgroup2 /sys/fs/cgroup 2>/dev/null; then
+
+      printf 'WARN: could not remount cgroup2 (continuing)\n' >&2
+
+    fi
 
   fi
 
   rm -f -- "${state}"
 
+  echo "Inside chroot: cdi_sys_quick_leave() @ End."
+
   return 0
 }
 #-------------------------------------------------------------------------------

func/cdi_4300_network/4320_update_initramfs.sh

@@ -15,7 +15,7 @@ guard_sourcing
 #######################################
 # Deploy all changes made using the 'update-grub' and 'update-initramfs' commands.
 # Globals:
-#   VAR_CHROOT_SYS_MASK_HELPEr
+#   VAR_CHROOT_SYS_MASK_HELPER
 #   VAR_KERNEL
 # Arguments:
 #   None
@@ -44,14 +44,14 @@ EOS_ENTER
     source /tmp/.ciss_sysmask_helper.sh
 
     ### run: mask sys, build, unmask.
-    cdi_sys_mask_enter
+    cdi_sys_quick_enter
 
     depmod -a ${var_kernel} 2>&1 | tee -a ${var_logfile}
 
     update-initramfs -c -v -k all 2>&1 | tee -a ${var_logfile}
     echo ExitCode: \$? >> ${var_logfile}
 
-    cdi_sys_mask_leave
+    cdi_sys_quick_leave
     rm -f /tmp/.ciss_sysmask_helper.sh
   "
 
@@ -62,4 +62,7 @@ EOS_ENTER
 
   guard_dir && return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f update_initramfs
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh