V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4200_boot/4200_generate_fstab.sh

@@ -63,26 +63,9 @@ generate_fstab() {
   declare    var_path="" var_dmapper="" var_fs_uuid="" var_fs_path="" var_fs_type="" var_fs_opts="" var_fs_pass=""
 
   ### Generate '${TARGET}/etc/fstab' header.
-  : >| "${TARGET}/etc/fstab"
-  chmod 0600 "${TARGET}/etc/fstab"
-
+  insert_header "${TARGET}/etc/fstab"
+  insert_comments "${TARGET}/etc/fstab"
   cat << EOF >> "${TARGET}/etc/fstab"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/fstab
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
 # Use 'blkid' to print the universally unique identifier for a device; this may be used with [UUID=] as a more robust way to
 # name devices that work even if disks are added and removed. See fstab(5).
 #

func/cdi_4200_boot/4210_generate_crypttab.sh

@@ -117,11 +117,11 @@ EOF
     case "${var_key}" in
 
       SWAP)
-        write_crypttab "${var_ephemeral_enclabel}" "UUID=${var_host_uuid}" "/dev/random" "swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096"
+        write_crypttab "${var_ephemeral_enclabel}" "UUID=${var_host_uuid}" "/dev/urandom" "plain,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,discard,swap"
         ;;
 
       /tmp)
-        write_crypttab "${var_ephemeral_enclabel}" "UUID=${var_host_uuid}" "/dev/random" "offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4"
+        write_crypttab "${var_ephemeral_enclabel}" "UUID=${var_host_uuid}" "/dev/urandom" "plain,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,discard,tmp=ext4"
         ;;
 
       *)

func/cdi_4500_user/4500_installation_accounts.sh

@@ -35,17 +35,17 @@ installation_accounts() {
   declare var_username="" var_fullname="" var_uid="" var_gid="" var_shell="" var_password="" var_sshpubkey="" var_sudo="" \
     var_restricted="" var_chpasswd="" var_sshdir=""
 
-
-
-
-
   ### Hardening '/etc/login.defs'
   rm -f "${TARGET}/etc/login.defs"
-  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/login.defs" "${TARGET}/etc/"
+  insert_header "${TARGET}/etc/login.defs"
+  insert_comments "${TARGET}/etc/login.defs"
+  cat "${VAR_SETUP_PATH}/target/includes/etc/login.defs" >> "${TARGET}/etc/login.defs"
 
   ### Hardening '/etc/security/pwquality.conf'
   rm -f "${TARGET}/etc/security/pwquality.conf"
-  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/security/pwquality.cnf" "${TARGET}/etc/security/pwquality.conf"
+  insert_header "${TARGET}/etc/security/pwquality.conf"
+  insert_comments "${TARGET}/etc/security/pwquality.conf"
+  cat "${VAR_SETUP_PATH}/target/includes/etc/security/pwquality.cnf" >> "${TARGET}/etc/security/pwquality.conf"
 
   ### Preparing the root account
   chown root:root "${TARGET}/etc/passwd" "${TARGET}/etc/shadow" "${TARGET}/etc/group" "${TARGET}/etc/gshadow"