msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-06-25 17:28:11 +02:00
parent 5496977d6a
commit 804788b38b
6 changed files with 312 additions and 348 deletions
Download Patch File Download Diff File Expand all files Collapse all files

93
func/3200_partitioning.sh
View File

@@ -14,93 +14,88 @@
# Function that generates each partition on each device according to the chosen recipe string.
# Globals:
# ERR_PARTITIONTBL
# HMP_RECIPE_DEV_PARTITIONS
# ERR_READ_PARTTBL
# HMP_UUID_PARTITION
# RECIPE_STRING
# RECIPE_TABLE
# VAR_RECIPE_TABLE
# VAR_SETUP_PART
# Arguments:
# None
# None
#######################################
partitioning() {
### REMINDER
# HashMap : "${!HMP_RECIPE_DEV_PARTITIONS[@]}"
# ${DEVICE}: "${HMP_RECIPE_DEV_PARTITIONS[$DEVICE]}"
### Declare Arrays and Variables.
declare -Ag HMP_UUID_PARTITION
declare var_dev var_part var_begin var_end var_fs var_boot var_pri var_uuid
declare var_dev var_partition var_partition_number
### Iterate through each device.
for var_dev in "${!HMP_RECIPE_DEV_PARTITIONS[@]}"; do
var_partition_number=${HMP_RECIPE_DEV_PARTITIONS[${var_dev}]}
### Iterate over all devices in the recipe.
for var_dev in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}"); do
### All current data for the respective device will be deleted.
blkdiscard /dev/"${var_dev}"
blkdiscard "/dev/${var_dev}" \
|| { do_log "fatal" "false" "Partition table deletion '/dev/${var_dev}' failed."; exit "${ERR_READ_PARTTBL}"; }
do_log "info" "false" "Partition table of '/dev/${var_dev}' discarded."
if [[ ${VAR_RECIPE_TABLE} == "gpt" ]]; then
if [[ "${VAR_RECIPE_TABLE}" == "gpt" ]]; then
parted -s /dev/"${var_dev}" mklabel gpt
parted -s "/dev/${var_dev}" mklabel gpt \
|| { do_log "fatal" "false" "Partition table creation '/dev/${var_dev}' failed."; exit "${ERR_READ_PARTTBL}"; }
do_log "info" "false" "Partition table '${VAR_RECIPE_TABLE}' of '/dev/${var_dev}' generated."
elif [[ ${VAR_RECIPE_TABLE} == "mbr" ]]; then
elif [[ "${VAR_RECIPE_TABLE}" == "mbr" ]]; then
parted -s /dev/"${var_dev}" mklabel mbr
parted -s "/dev/${var_dev}" mklabel mbr \
|| { do_log "fatal" "false" "Partition table creation '/dev/${var_dev}' failed."; exit "${ERR_READ_PARTTBL}"; }
do_log "info" "false" "Partition table '${VAR_RECIPE_TABLE}' of '/dev/${var_dev}' generated."
else
do_log "fatal" "false" "No valid partition table chosen. String was '${VAR_RECIPE_TABLE}'. Exiting setup."
do_log "fatal" "false" "No valid partition table chosen. String was '${VAR_RECIPE_TABLE}'."
exit "${ERR_PARTITIONTBL}"
fi
### Iterate through each partition on the current device.
for (( var_partition=1; var_partition<=var_partition_number; var_partition++ )); do
#for var_partition in $(seq 1 "${var_partition_number}"); do
### Iterate over all partitions for this device.
for var_part in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}"); do
### Generate variables for the current partition.
declare begin_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_begin"
declare end_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_end"
declare bootable_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_bootable"
declare primary_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_primary"
declare filesystem_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_filesystem_version"
### Initialise variables.
declare BEGIN=${!begin_var}
declare END=${!end_var}
declare BOOTABLE=${!bootable_var}
declare PRIMARY=${!primary_var}
declare FILESYSTEM=${!filesystem_var}
### Extract parameters from YAML.
var_begin=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.begin" "${VAR_SETUP_PART}")
var_end=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.end" "${VAR_SETUP_PART}")
var_fs=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_boot=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.bootable" "${VAR_SETUP_PART}")
var_pri=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.primary" "${VAR_SETUP_PART}")
### Generate partition.
if [[ ${END} == "-1" ]]; then
if [[ "${var_end}" == "-1" ]]; then
parted -s /dev/"${var_dev}" mkpart "${PRIMARY}" "${FILESYSTEM}" "${BEGIN}" 100%
do_log "info" "false" "Partition generated: '${var_partition}' | on device '/dev/${var_dev}' | begin: '${BEGIN}' | end: 100 % of remaining disk."
parted -s /dev/"${var_dev}" mkpart "${var_pri}" "${var_fs}" "${var_begin}" "100%" \
|| { do_log "fatal" "false" "Partition creation '/dev/${var_dev}${var_part}' failed."; exit "${ERR_READ_PARTTBL}"; }
do_log "info" "false" "Partition generated: '${var_part}' | on device '/dev/${var_dev}' | begin: '${var_begin}' | end: 100 % of remaining disk."
else
parted -s /dev/"${var_dev}" mkpart "${PRIMARY}" "${FILESYSTEM}" "${BEGIN}" "${END}"
do_log "info" "false" "Partition generated: '${var_partition}' | on device '/dev/${var_dev}' | begin: '${BEGIN}' | end: '${END}'."
parted -s /dev/"${var_dev}" mkpart "${var_pri}" "${var_fs}" "${var_begin}" "${var_end}" \
|| { do_log "fatal" "false" "Partition creation '/dev/${var_dev}${var_part}' failed."; exit "${ERR_READ_PARTTBL}"; }
do_log "info" "false" "Partition generated: '${var_part}' | on device '/dev/${var_dev}' | begin: '${var_begin}' | end: '${var_end}'."
fi
### Set the bootable flag if necessary.
if [[ "${BOOTABLE,,}" == true ]]; then
parted -s "/dev/${var_dev}" set "${var_partition}" boot on
do_log "info" "false" "Partition: '/dev/${var_dev}${var_partition}' marked as bootable."
if [[ "${var_boot,,}" == "true" ]]; then
parted -s "/dev/${var_dev}" set "${var_part}" boot on
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' marked as bootable."
fi
if [[ "${PRIMARY,,}" == logical ]]; then
parted -s "/dev/${var_dev}" set "${var_partition}" "${FILESYSTEM}" on
### Read UUID of the newly created partition
var_uuid=$(blkid -s UUID -o value "/dev/${var_dev}${var_part}")
if [[ -z "${var_uuid}" ]]; then
do_log "fatal" "false" "WARNING: could not read UUID for '/dev/${var_dev}${var_part}'."
exit "${ERR_READ_PARTTBL}"
else
### Store UUID in an associative array.
HMP_UUID_PARTITION["UUID_${var_dev}${var_part}"]="${var_uuid}"
do_log "info" "false" "Saved in HashMap HMP_UUID_PARTITION: 'UUID_${var_dev}${var_part}' -> '${var_uuid}'."
fi
### Save UUID of the generated partition
# shellcheck disable=SC2155
declare UUID=$(blkid -s UUID -o value "/dev/${var_dev}${var_partition}")
HMP_UUID_PARTITION["UUID_${var_dev}${var_partition}"]="${UUID}"
do_log "info" "false" "Saved in HashMap HMP_UUID_PARTITION: 'UUID_${var_dev}${var_partition}' -> '${HMP_UUID_PARTITION["UUID_${var_dev}${var_partition}"]}'"
done
done

108
func/3200_partitioning_new.sh
View File

@@ -1,108 +0,0 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
#######################################
# Function that generates each partition on each device according to the chosen recipe string.
# Globals:
# ERR_PARTITIONTBL
# HMP_RECIPE_DEV_PARTITIONS
# HMP_UUID_PARTITION
# RECIPE_STRING
# RECIPE_TABLE
# VAR_RECIPE_TABLE
# Arguments:
# None
#######################################
partitioning() {
### REMINDER
# HashMap : "${!HMP_RECIPE_DEV_PARTITIONS[@]}"
# ${DEVICE}: "${HMP_RECIPE_DEV_PARTITIONS[$DEVICE]}"
declare var_dev var_partition var_partition_number
### Iterate through each device.
for var_dev in "${!HMP_RECIPE_DEV_PARTITIONS[@]}"; do
var_partition_number=${HMP_RECIPE_DEV_PARTITIONS[${var_dev}]}
### All current data for the respective device will be deleted.
blkdiscard /dev/"${var_dev}"
do_log "info" "false" "Partition table of '/dev/${var_dev}' discarded."
if [[ ${VAR_RECIPE_TABLE} == "gpt" ]]; then
parted -s /dev/"${var_dev}" mklabel gpt
do_log "info" "false" "Partition table '${VAR_RECIPE_TABLE}' of '/dev/${var_dev}' generated."
elif [[ ${VAR_RECIPE_TABLE} == "mbr" ]]; then
parted -s /dev/"${var_dev}" mklabel mbr
do_log "info" "false" "Partition table '${VAR_RECIPE_TABLE}' of '/dev/${var_dev}' generated."
else
do_log "fatal" "false" "No valid partition table chosen. String was '${VAR_RECIPE_TABLE}'. Exiting setup."
exit "${ERR_PARTITIONTBL}"
fi
### Iterate through each partition on the current device.
for (( var_partition=1; var_partition<=var_partition_number; var_partition++ )); do
#for var_partition in $(seq 1 "${var_partition_number}"); do
### Generate variables for the current partition.
declare begin_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_begin"
declare end_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_end"
declare bootable_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_bootable"
declare primary_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_primary"
declare filesystem_var="recipe_${RECIPE_STRING}_dev_${var_dev}_${var_partition}_filesystem_version"
### Initialise variables.
declare BEGIN=${!begin_var}
declare END=${!end_var}
declare BOOTABLE=${!bootable_var}
declare PRIMARY=${!primary_var}
declare FILESYSTEM=${!filesystem_var}
### Generate partition.
if [[ ${END} == "-1" ]]; then
parted -s /dev/"${var_dev}" mkpart "${PRIMARY}" "${FILESYSTEM}" "${BEGIN}" 100%
do_log "info" "false" "Partition generated: '${var_partition}' | on device '/dev/${var_dev}' | begin: '${BEGIN}' | end: 100 % of remaining disk."
else
parted -s /dev/"${var_dev}" mkpart "${PRIMARY}" "${FILESYSTEM}" "${BEGIN}" "${END}"
do_log "info" "false" "Partition generated: '${var_partition}' | on device '/dev/${var_dev}' | begin: '${BEGIN}' | end: '${END}'."
fi
### Set the bootable flag if necessary.
if [[ "${BOOTABLE,,}" == true ]]; then
parted -s "/dev/${var_dev}" set "${var_partition}" boot on
do_log "info" "false" "Partition: '/dev/${var_dev}${var_partition}' marked as bootable."
fi
if [[ "${PRIMARY,,}" == logical ]]; then
parted -s "/dev/${var_dev}" set "${var_partition}" "${FILESYSTEM}" on
fi
### Save UUID of the generated partition
# shellcheck disable=SC2155
declare UUID=$(blkid -s UUID -o value "/dev/${var_dev}${var_partition}")
HMP_UUID_PARTITION["UUID_${var_dev}${var_partition}"]="${UUID}"
do_log "info" "false" "Saved in HashMap HMP_UUID_PARTITION: 'UUID_${var_dev}${var_partition}' -> '${HMP_UUID_PARTITION["UUID_${var_dev}${var_partition}"]}'"
done
done
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

247
func/3220_partition_encryption.sh Normal file
View File

@@ -0,0 +1,247 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
###########################################################################################
# Function to encrypt the respective partition on each device according to the chosen recipe string.
partition_encryption() {
### Declare Arrays and Variables.
declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL
declare -Ag HMP_ENCRYPTIONLABEL_UUID HMP_MOUNTPATH_ENCRYPTIONLABEL
declare var_dev var_part \
var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_nuke var_encryption_cipher \
var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta \
var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path
### Iterate over all devices in the recipe.
for var_dev in $(yq e ".recipe.${RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}"); do
### Iterate over all partitions for this device.
for var_part in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}"); do
### Extract parameters from YAML.
var_encryption_enable=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
var_encryption_ephemeral=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.ephemeral" "${VAR_SETUP_PART}")
var_encryption_integrity=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.integrity" "${VAR_SETUP_PART}")
var_encryption_nuke=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.nuke" "${VAR_SETUP_PART}")
var_encryption_cipher=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.cipher" "${VAR_SETUP_PART}")
var_encryption_hash=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.hash" "${VAR_SETUP_PART}")
var_encryption_iter=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.itertime" "${VAR_SETUP_PART}")
var_encryption_key=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.key" "${VAR_SETUP_PART}")
var_encryption_label=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label" "${VAR_SETUP_PART}")
var_encryption_meta=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.metadatasize" "${VAR_SETUP_PART}")
var_encryption_pbkdf=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdf" "${VAR_SETUP_PART}")
var_encryption_rng=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.rng" "${VAR_SETUP_PART}")
var_filesystem_label=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label" "${VAR_SETUP_PART}")
var_mount_path=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
if [[ "${var_encryption_enable,,}" == "true" ]]; then
if [[ "${var_encryption_ephemeral,,}" == "true" ]]; then
if [[ "${var_mount_path}" == "SWAP" ]]; then
mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
do_log "info" "false" "Ephemeral 'SWAP' prepared on: '/dev/${var_dev}${var_part}'."
HMP_EPHEMERAL_DEV["${var_mount_path}"]="/dev/${var_dev}${var_part}"
HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
do_log "info" "false" "Stored in HashMap [MAP_EPHEMERAL_DEV] : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
do_log "info" "false" "Stored in HashMap [MAP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
elif [[ "${var_mount_path}" == "/tmp" ]]; then
mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
do_log "info" "false" "Ephemeral '/tmp' prepared on: '/dev/${var_dev}${var_part}'."
HMP_EPHEMERAL_DEV["${var_mount_path}"]="/dev/${var_dev}${var_part}"
HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
do_log "info" "false" "Stored in HashMap [MAP_EPHEMERAL_DEV] : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
do_log "info" "false" "Stored in HashMap [MAP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
else
do_log "error" "false" "Partition: '/dev/${var_dev}${var_part}' Invalid value for 'MOUNT_PATH': '${var_mount_path}'."
fi
elif [[ "${var_encryption_ephemeral,,}" == "false" ]]; then
if [[ "${var_encryption_integrity,,}" == "true" ]]; then
if [[ "${var_encryption_nuke,,}" == "true" ]]; then
cryptsetup luksFormat "/dev/${var_dev}${var_part}" \
--key-file="${DIR_CNF}/password.txt" \
--type luks2 \
--cipher "${var_encryption_cipher}" \
--hash "${var_encryption_hash}" \
--iter-time "${var_encryption_iter}" \
--key-size "${var_encryption_key}" \
--label "${var_encryption_label}" \
--luks2-metadata-size "${var_encryption_meta}" \
--pbkdf "${var_encryption_pbkdf}" \
--"${var_encryption_rng}" \
--integrity hmac-sha512 \
--batch-mode --verbose
cryptsetup luksAddKey "/dev/${var_dev}${var_part}" \
--key-file="${DIR_CNF}/password.txt" \
--new-keyfile="${DIR_CNF}/password_nuke.txt" \
--new-key-slot 31 \
--batch-mode --verbose
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' dm-integrity encrypted and 'Nuke-Key' added."
cryptsetup luksHeaderBackup "/dev/${var_dev}${var_part}" \
--header-backup-file="${DIR_BAK}/luks_header_${var_dev}${var_part}.bak"
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
elif [[ "${var_encryption_nuke,,}" == "false" ]]; then
cryptsetup luksFormat "/dev/${var_dev}${var_part}" \
--key-file="${DIR_CNF}/password.txt" \
--type luks2 \
--cipher "${var_encryption_cipher}" \
--hash "${var_encryption_hash}" \
--iter-time "${var_encryption_iter}" \
--key-size "${var_encryption_key}" \
--label "${var_encryption_label}" \
--luks2-metadata-size "${var_encryption_meta}" \
--pbkdf "${var_encryption_pbkdf}" \
--"${var_encryption_rng}" \
--integrity hmac-sha512 \
--batch-mode --verbose
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' dm-integrity encrypted."
cryptsetup luksHeaderBackup "/dev/${var_dev}${var_part}" \
--header-backup-file="${DIR_BAK}/luks_header_${var_dev}${var_part}.bak"
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
else
do_log "error" "false" "Partition: '/dev/${var_dev}${var_part}' Invalid value for 'NUKE_ENABLE': '${var_encryption_nuke}'."
fi
elif [[ "${var_encryption_integrity,,}" == "false" ]]; then
if [[ "${var_encryption_nuke,,}" == "true" ]]; then
cryptsetup luksFormat "/dev/${var_dev}${var_part}" \
--key-file="${DIR_CNF}/password.txt" \
--type luks2 \
--cipher "${var_encryption_cipher}" \
--hash "${var_encryption_hash}" \
--iter-time "${var_encryption_iter}" \
--key-size "${var_encryption_key}" \
--label "${var_encryption_label}" \
--luks2-metadata-size "${var_encryption_meta}" \
--pbkdf "${var_encryption_pbkdf}" \
--"${var_encryption_rng}" \
--batch-mode --verbose
cryptsetup luksAddKey "/dev/${var_dev}${var_part}" \
--key-file="${DIR_CNF}/password.txt" \
--new-keyfile="${DIR_CNF}/password_nuke.txt" \
--new-key-slot 31 \
--batch-mode --verbose
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' encrypted and 'Nuke-Key' added."
cryptsetup luksHeaderBackup "/dev/${var_dev}${var_part}" \
--header-backup-file="${DIR_BAK}/luks_header_${var_dev}${var_part}.bak"
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '/${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
elif [[ ${var_encryption_nuke,,} == "false" ]]; then
cryptsetup luksFormat "/dev/${var_dev}${var_part}" \
--key-file="${DIR_CNF}/password.txt" \
--type luks2 \
--cipher "${var_encryption_cipher}" \
--hash "${var_encryption_hash}" \
--iter-time "${var_encryption_iter}" \
--key-size "${var_encryption_key}" \
--label "${var_encryption_label}" \
--luks2-metadata-size "${var_encryption_meta}" \
--pbkdf "${var_encryption_pbkdf}" \
--"${var_encryption_rng}" \
--batch-mode --verbose
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' encrypted."
cryptsetup luksHeaderBackup "/dev/${var_dev}${var_part}" \
--header-backup-file="${DIR_BAK}/luks_header_${var_dev}${var_part}.bak"
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '/${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
else
do_log "error" "false" "Partition: '/dev/${var_dev}${var_part}' Invalid value for 'NUKE_ENABLE': '${var_encryption_nuke}'."
fi
else
do_log "error" "false" "Partition: '/dev/${var_dev}${var_part}' Invalid value for 'INTEGRITY_ENABLE': '${var_encryption_integrity}'."
fi
else
do_log "error" "false" "Partition: '/dev/${var_dev}${var_part}' Invalid value for 'EPHEMERAL_ENABLE': '${var_encryption_ephemeral}'."
fi
else
do_log "error" "true" "Partition: '/dev/${var_dev}${var_part}' Invalid value for 'ENCRYPTION_ENABLE': '${var_encryption_enable}'."
fi
### Opening encrypted partition.
if [[ "${var_encryption_enable,,}" == "true" && ${var_encryption_ephemeral,,} == "false" ]]; then
cryptsetup luksOpen "/dev/${var_dev}${var_part}" \
--key-file="${DIR_CNF}/password.txt" \
"${var_encryption_label}"
do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."
### Store UUID of the encrypted partition
# shellcheck disable=SC2155
declare var_uuid=$(blkid -s UUID -o value "/dev/mapper/${var_encryption_label}")
if [[ "${var_mount_path}" = "/" ]]; then
# shellcheck disable=SC2155
declare -grx VAR_CRYPT_ROOT="$(blkid -s UUID -o value "/dev/mapper/${var_encryption_label}")"
fi
HMP_ENCRYPTIONLABEL_UUID["${var_encryption_label}"]="${var_uuid}"
HMP_MOUNTPATH_ENCRYPTIONLABEL["${var_mount_path}"]="${var_encryption_label}"
do_log "info" "false" "Saved in HashMap [HMP_ENCRYPTIONLABEL_UUID] : '${var_encryption_label}' -> '${HMP_ENCRYPTIONLABEL_UUID["${var_encryption_label}"]}'"
do_log "info" "false" "Saved in HashMap [HMP_MOUNTPATH_ENCRYPTIONLABEL] : '${var_mount_path}' -> '${HMP_MOUNTPATH_ENCRYPTIONLABEL["${var_mount_path}"]}'"
else
do_log "error" "false" "Partition: '/dev/${var_dev}${var_part}' Opening encrypted partition - Invalid value for 'ENCRYPTION_ENABLE': '${var_encryption_enable}' and 'EPHEMERAL_ENABLE': '${var_encryption_ephemeral}'."
fi
done
done
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh: