V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-07-27 17:07:27 +02:00
parent 6caacb541b
commit 9be2bc1083
13 changed files with 774 additions and 124 deletions
--- a/func/partitioning/3200_partitioning.sh
+++ b/func/partitioning/3200_partitioning.sh
@@ -109,9 +109,13 @@ partitioning() {
      var_boot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.bootable"         "${VAR_SETUP_PART}")
      var_pri=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.primary"           "${VAR_SETUP_PART}")
      var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
-      var_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.label"           "${VAR_SETUP_PART}")

-      ### Assign the landing zone of each partition.
+      ### Assign the start zone of the first partition and skip the first 2 MiB as best practice.
+      if [[ "${var_begin,,}" == "min" ]]; then
+        var_begin="2MiB"
+      fi
+
+      ### Assign the landing zone of the last partition and reserve 16 MiB for GPT and mdadm binary metadata.
      if [[ "${var_end,,}" == "max" ]]; then
        var_dev_size=$(blockdev --getsize64 "/dev/${var_dev}")
        var_dev_end=$(( var_dev_size - 16 * 1024 * 1024 ))
@@ -124,6 +128,9 @@ partitioning() {
      case "${VAR_RECIPE_TABLE,,}" in

        gpt)
+
+          var_label=$(get_label "${var_mount_path}" "${var_fs}" "part")
+
          if ! parted -s "/dev/${var_dev}" mkpart "${var_label}" "${var_fs}" "${var_begin}" "${var_end_arg}"; then

            do_log "fatal" "file_only" "3200() [parted -s /dev/${var_dev} mkpart ${var_label} ${var_fs} ${var_begin} ${var_end_arg}] failed."
--- a/func/partitioning/3220_partition_encryption.sh
+++ b/func/partitioning/3220_partition_encryption.sh
@@ -35,8 +35,8 @@ partition_encryption() {
  declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_EPHEMERAL_FS_LABEL HMP_PATH_LUKSUUID HMP_PATH_ENCLABEL
  declare var_dev var_part \
    var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_cipher \
-    var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta \
-    var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path var_uuid
+    var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta var_encryption_cores \
+    var_encryption_slot var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path var_uuid var_fs
  declare -a ary_devs=() ary_parts=() ary_luks_opts=()

  ### Iterate over all devices in the recipe.
@@ -60,17 +60,20 @@ partition_encryption() {
      var_encryption_hash=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.hash"           "${VAR_SETUP_PART}")
      var_encryption_iter=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.itertime"       "${VAR_SETUP_PART}")
      var_encryption_key=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.key"             "${VAR_SETUP_PART}")
-      var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label"         "${VAR_SETUP_PART}")
+      var_encryption_slot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.keyslotssize"   "${VAR_SETUP_PART}")
      var_encryption_meta=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.metadatasize"   "${VAR_SETUP_PART}")
      var_encryption_pbkdf=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdf"         "${VAR_SETUP_PART}")
+      var_encryption_cores=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdfparallel" "${VAR_SETUP_PART}")
      var_encryption_rng=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.rng"             "${VAR_SETUP_PART}")
-      var_filesystem_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label"         "${VAR_SETUP_PART}")
+      var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"                     "${VAR_SETUP_PART}")
      var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                     "${VAR_SETUP_PART}")

      if [[ "${var_encryption_enable,,}" != "true" ]]; then
        continue
      fi

+      var_encryption_label=$(get_label "${var_mount_path}" "${var_fs}" "luks")
+
      if [[ "${var_mount_path,,}" == "/boot" ]]; then
        ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_boot.txt" )
      else
@@ -79,13 +82,15 @@ partition_encryption() {

      ary_luks_opts+=(
        --type luks2
-        --cipher "${var_encryption_cipher}"
-        --hash "${var_encryption_hash}"
-        --iter-time "${var_encryption_iter}"
-        --key-size "${var_encryption_key}"
+        --cipher "${var_encryption_cipher:-aes-xts-plain64}"
+        --hash "${var_encryption_hash:-sha512}"
+        --iter-time "${var_encryption_iter:-3000}"
+        --key-size "${var_encryption_key:-512}"
        --label "${var_encryption_label}"
-        --luks2-metadata-size "${var_encryption_meta}"
-        --pbkdf "${var_encryption_pbkdf}"
+        --luks2-keyslots-size "${var_encryption_slot:-16777216}"
+        --luks2-metadata-size "${var_encryption_meta:-4194304}"
+        --pbkdf "${var_encryption_pbkdf:-argon2id}"
+        --pbkdf-parallel "${var_encryption_cores:-1}"
        "--${var_encryption_rng}"
        --batch-mode
        --verbose
@@ -99,6 +104,8 @@ partition_encryption() {

          SWAP|/tmp)

+            var_filesystem_label=$(get_label "${var_mount_path}" "${var_fs}" "file")
+
            mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
            do_log "info" "file_only" "3220() Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."

@@ -106,9 +113,9 @@ partition_encryption() {
            HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
            HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]="${var_filesystem_label}"

-            do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_DEV]     : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
-            do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
-            do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]}'"
+            do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_DEV]     : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
+            do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
+            do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]}'"
            continue
            ;;

--- a/func/partitioning/3240_partition_formatting.sh
+++ b/func/partitioning/3240_partition_formatting.sh
@@ -26,7 +26,7 @@ guard_sourcing
 #######################################
 partition_formatting() {
  ### Declare Arrays and Variables.
-  declare -Agx HMP_PATH_FSUUID
+  declare -Ag HMP_PATH_FSUUID
  declare var_dev var_part \
    var_encryption_enable var_encryption_label var_fs_btrfs_checksum var_fs_btrfs_compress var_fs_btrfs_mdup \
    var_fs_format var_fs_label var_fs_options var_fs_version var_mount_path var_node var_fs_uuid
@@ -44,12 +44,10 @@ partition_formatting() {

      ### Extract parameters from YAML.
      var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable"         "${VAR_SETUP_PART}")
-      var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label"           "${VAR_SETUP_PART}")
      var_fs_btrfs_checksum=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.checksum" "${VAR_SETUP_PART}")
      var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
      var_fs_btrfs_mdup=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.mdup"         "${VAR_SETUP_PART}")
      var_fs_format=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.format"                 "${VAR_SETUP_PART}")
-      var_fs_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label"                   "${VAR_SETUP_PART}")
      var_fs_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.options"               "${VAR_SETUP_PART}")
      var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"               "${VAR_SETUP_PART}")
      var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                       "${VAR_SETUP_PART}")
@@ -59,24 +57,27 @@ partition_formatting() {
      ### Preparation of Ephemeral 'SWAP' and '/tmp' as per https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption#UUID_and_LABEL
      case "${var_mount_path,,}" in
        swap|/tmp)
-          # mkfs.ext4 -L "${var_fs_label}" "/dev/${var_dev}${var_part}" 1M
          do_log "info" "file_only" "3240() Partition: '/dev/${var_dev}${var_part}' ephemeral encryption already prepared in 3220(): '${var_mount_path}'."
          continue
          ;;
      esac

      if [[ "${var_encryption_enable,,}" == "true" ]]; then
+        var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
        var_node="/dev/mapper/${var_encryption_label}"
      else
        var_node="/dev/${var_dev}${var_part}"
      fi

+      var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
+
      case "${var_fs_version,,}" in

        btrfs)
          ary_opts=( -L "${var_fs_label}" -f --csum "${var_fs_btrfs_checksum}" )
          [[ "${var_fs_btrfs_mdup,,}" == "true" ]] && ary_opts+=( -m dup )
          mkfs.btrfs "${ary_opts[@]}" "${var_node}"
+          do_log "debug" "file_only" "3240() [mkfs.btrfs ${ary_opts[*]} ${var_node}]."
          do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'btrfs' options: '${ary_opts[*]}'."
          echo "Partition: '${var_node}':" >> "${DIR_LOG}/btrfs.log"
          btrfs filesystem show "${var_node}" >> "${DIR_LOG}/btrfs.log"
@@ -87,6 +88,7 @@ partition_formatting() {
        ext4)
          read -r -a ary_fmt_opts <<< "${var_fs_options}"
          mkfs.ext4 -L "${var_fs_label}" "${ary_fmt_opts[@]}" "${var_node}"
+          do_log "debug" "file_only" "3240() [mkfs.ext4 -L ${var_fs_label} ${ary_fmt_opts[*]} ${var_node}]."
          do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'ext4' options: '${ary_fmt_opts[*]}'."
          echo "Partition: '${var_node}':" >> "${DIR_LOG}/ext4.log"
          tune2fs -l "${var_node}" >> "${DIR_LOG}/ext4.log"
@@ -96,6 +98,7 @@ partition_formatting() {

        fat32)
          mkfs.fat -F 32 -n "${var_fs_label}" "${var_node}"
+          do_log "debug" "file_only" "3240() [mkfs.fat -F 32 -n ${var_fs_label} ${var_node}]."
          do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'FAT32'."
          var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
          HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"
--- a/func/partitioning/3260_setup_filesystem.sh
+++ b/func/partitioning/3260_setup_filesystem.sh
@@ -26,7 +26,7 @@ guard_sourcing
 setup_filesystem() {
  ### Declare Arrays and Variables.
  declare -Ag HMP_MOUNTPATH_DEV
-  declare var_dev var_part var_encryption_enable var_encryption_label var_mount_enable var_mount_path var_node
+  declare var_dev var_part var_encryption_enable var_encryption_label var_fs_version var_mount_enable var_mount_path var_node
  declare -a ary_devs ary_parts

  ### Iterate over all devices in the recipe.
@@ -41,7 +41,7 @@ setup_filesystem() {

      ### Extract parameters from YAML.
      var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
-      var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label"   "${VAR_SETUP_PART}")
+      var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"       "${VAR_SETUP_PART}")
      var_mount_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.enable"           "${VAR_SETUP_PART}")
      var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"               "${VAR_SETUP_PART}")

@@ -53,6 +53,7 @@ setup_filesystem() {

      if [[ "${var_encryption_enable}" == "true" ]]; then

+        var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
        var_node="/dev/mapper/${var_encryption_label}"

      elif [[ "${var_encryption_enable}" == "false" ]]; then
--- a/func/partitioning/3280_mount_partition.sh
+++ b/func/partitioning/3280_mount_partition.sh
@@ -113,7 +113,7 @@ mount_partition() {

  else

-    do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap."
+    do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
    return "${ERR_MOUNTING_ROOT}"

  fi
@@ -129,7 +129,7 @@ mount_partition() {

    else

-      do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap."
+      do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."

    fi

@@ -138,7 +138,7 @@ mount_partition() {
  declare var_dev var_part \
    var_fs_btrfs_compress var_fs_btrfs_level var_fs_btrfs_subvolume var_fs_btrfs_snapshot \
    var_encryption_enable var_encryption_label \
-    var_fs_label var_fs_options var_fs_version var_mount_path var_mount_options var_mount_optsnap
+    var_fs_label var_fs_options var_fs_version var_mount_path var_mount_options var_snapshot var_mount_optsnap
  declare -a ary_devs ary_parts

  ### Iterate over all devices in the recipe.
@@ -154,11 +154,8 @@ mount_partition() {
      ### Extract parameters from YAML.
      var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress"   "${VAR_SETUP_PART}")
      var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level"         "${VAR_SETUP_PART}")
-      var_fs_btrfs_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.subvolume" "${VAR_SETUP_PART}")
      var_fs_btrfs_snapshot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.snapshot"   "${VAR_SETUP_PART}")
      var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable"           "${VAR_SETUP_PART}")
-      var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label"             "${VAR_SETUP_PART}")
-      var_fs_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label"                     "${VAR_SETUP_PART}")
      var_fs_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.options"                 "${VAR_SETUP_PART}")
      var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version"                 "${VAR_SETUP_PART}")
      var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path"                         "${VAR_SETUP_PART}")
@@ -168,21 +165,34 @@ mount_partition() {
      ### Skip already mounted paths ("/", "/boot", "/boot/efi") and skip ("/recovery")
      skip_path "${var_mount_path}" && continue

+      var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
+
      if [[ "${var_mount_path}" == "SWAP" ]]; then

+        var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
+
        cryptsetup open --type plain --key-file /dev/random \
          --offset 2048 --cipher aes-xts-plain64 --key-size 512 \
          --sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
+
        mkswap "/dev/mapper/${var_encryption_label}"
-        swapon "/dev/mapper/${var_encryption_label}"
+        do_log "debug" "file_only" "3280() [mkswap /dev/mapper/${var_encryption_label}]."
        do_log "info" "file_only" "3280() Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
+
+        swapon "/dev/mapper/${var_encryption_label}"
+        do_log "debug" "file_only" "3280() [swapon /dev/mapper/${var_encryption_label}]."
+        do_log "info" "file_only" "3280() Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
+
        continue

      elif [[ "${var_mount_path}" == "/tmp" ]]; then

+        var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
+
        cryptsetup open --type plain --key-file /dev/random \
          --offset 2048 --cipher aes-xts-plain64 --key-size 512 \
          --sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
+
        mkdir -p "${TARGET}/tmp"

        # TODO: Remove Debug
@@ -190,10 +200,10 @@ mount_partition() {
        [[ -b "/dev/mapper/${var_encryption_label}" ]] || {
          do_log "error" "file_only" "Mapper-Device: '/dev/mapper/${var_encryption_label}' non-existing."
        }
+
        echo "lsblk -o NAME,SIZE,TYPE,FSTYPE,LABEL /dev/mapper/${var_encryption_label}"
        lsblk -o NAME,SIZE,TYPE,FSTYPE,LABEL /dev/mapper/"${var_encryption_label}"
-        echo "/dev/mapper/${var_encryption_label}"
-        blkid /dev/mapper/"${var_encryption_label}"
+
        echo "safe_exec mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 /dev/mapper/${var_encryption_label} ${ERR_MOUNTING_DEV}"
        safe_exec mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 "/dev/mapper/${var_encryption_label}" "${ERR_MOUNTING_DEV}" || return "${ERR_MOUNTING_DEV}"
        #mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 "/dev/mapper/${var_encryption_label}"
@@ -203,11 +213,13 @@ mount_partition() {

        ### Build the command in an array to keep word boundaries intact
        declare -a ary_cmd2=(mount)
-        [[ -n "${var_mount_options}" ]] && ary_cmd2+=("-o" "${var_mount_options}")
+
+        #[[ -n "${var_mount_options}" ]] && ary_cmd2+=("-o" "${var_mount_options}")
        ary_cmd2+=("/dev/mapper/${var_encryption_label}" "${TARGET}${var_mount_path}")

        safe_exec "${ary_cmd2[@]}" "${ERR_MOUNTING_DEV}" || return "${ERR_MOUNTING_DEV}"
        do_log "info" "file_only" "3280() Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
+
        continue

      fi
@@ -217,16 +229,23 @@ mount_partition() {

      if [[ "${var_fs_version,,}" == "btrfs" ]]; then

+        var_fs_btrfs_subvolume=$(get_label "${var_mount_path}" "${var_fs_version}" "sub")
+
        ### Mount toplevel (subvolid=0) without extra options.
        declare -a ary_cmd_mount=(mount -o "subvolid=0" "${var_resolved_dev}" "${VAR_SAFE_MNT_BASE}")
        safe_exec "${ary_cmd_mount[@]}" "${ERR_BTRFS_INITPH}" || return "${ERR_BTRFS_INITPH}"

-        btrfs subvolume create "${VAR_SAFE_MNT_BASE}"/"${var_fs_btrfs_subvolume}"
+        btrfs subvolume create "${VAR_SAFE_MNT_BASE}/${var_fs_btrfs_subvolume}"
+        do_log "debug" "file_only" "3280() [btrfs subvolume create ${VAR_SAFE_MNT_BASE}/${var_fs_btrfs_subvolume}]."
        do_log "info" "file_only" "3280() btrfs subvolid=0 created: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."

-        if [[ -n "${var_fs_btrfs_snapshot}" ]]; then
-          btrfs subvolume create "${VAR_SAFE_MNT_BASE}"/"${var_fs_btrfs_snapshot}" || return "${ERR_BTRFS_SUBVOL}"
-          do_log "info" "file_only" "3280() btrfs subvolid=${var_fs_btrfs_snapshot} created: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
+        if [[ "${var_fs_btrfs_snapshot}" == "true" ]]; then
+
+          var_snapshot=$(get_label "${var_mount_path}" "${var_fs_version}" "snap")
+
+          btrfs subvolume create "${VAR_SAFE_MNT_BASE}/${var_snapshot}" || return "${ERR_BTRFS_SUBVOL}"
+          do_log "debug" "file_only" "3280() [btrfs subvolume create ${VAR_SAFE_MNT_BASE}/${var_snapshot}]."
+          do_log "info" "file_only" "3280() btrfs subvolid=${var_snapshot} created: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
        fi

        umount "${VAR_SAFE_MNT_BASE}"
@@ -237,19 +256,32 @@ mount_partition() {
      case "${var_fs_version,,}:${var_encryption_enable,,}" in

        btrfs:*)
+
          validate_btrfs_compression "${var_fs_btrfs_compress}" "${var_fs_btrfs_level}" || return "${ERR_BTRFS_OPTION}"
+
          declare var_btrfs_compression_options="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
-          [[ -n "${var_mount_options}" ]] && var_btrfs_compression_options+=",${var_mount_options}"
+
+          [[ -n "${var_mount_options}" ]] && var_btrfs_compression_options+=",${var_mount_options},subvol=${var_fs_btrfs_subvolume}"
+
          mount_with_dir "${var_mount_path}" "${var_resolved_dev}" "${var_btrfs_compression_options}" || return "${ERR_MOUNTING_DEV}"
-          if [[ -n "${var_fs_btrfs_snapshot}" ]]; then
+
+          if [[ "${var_fs_btrfs_snapshot}" == "true" ]]; then
+
            mkdir -p "${TARGET}${var_mount_path}/.snapshots"
+
            do_log "info" "file_only" "3280() Created: '${TARGET}${var_mount_path}/.snapshots'."
-            mount -o "${var_mount_optsnap}" "${var_resolved_dev}" "${TARGET}${var_mount_path}/.snapshots"
+
+            var_mount_optsnap="${var_mount_optsnap},subvol=${var_snapshot}"
+
+            mount_with_dir "${var_mount_path}/.snapshots" "${var_resolved_dev}" "${var_mount_optsnap}"
+
            do_log "info" "file_only" "3280() Mounted: '${var_resolved_dev}' on: '${TARGET}${var_mount_path}/.snapshots' (Options='${var_mount_optsnap}')."
+
          fi
          ;;

        ext4:*)
+
          mount_with_dir "${var_mount_path}" "${var_resolved_dev}" "${var_mount_options}" || return "${ERR_MOUNTING_DEV}"
          ;;

@@ -260,6 +292,8 @@ mount_partition() {

    done

+    lsblk -o NAME,MAJ:MIN,FSTYPE,FSVER,SIZE,UUID,MOUNTPOINT,PATH "/dev/${var_dev}" >| "${DIR_LOG}/${var_dev}_overview_full.log"
+
  done

  return 0
--- a/func/partitioning/3295_get_label.sh
+++ b/func/partitioning/3295_get_label.sh
@@ -0,0 +1,118 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Returns standardized labels for the provided mount path depending on filesystem and art of label.
+# Globals:
+#   None
+# Arguments:
+#   1: Mount path (e.g., '/' '/boot' '/var/log/audit' 'SWAP' '/boot/efi')
+#   2: Filesystem type: one of: [BIOS, btrfs ext4 fat32, swap]
+#   3: Desired return label: one of: [part, luks, file, sub, snap]
+# Returns:
+#   Prints resulting label to stdout.
+#######################################
+get_label() {
+  declare -r var_path="${1}"
+  declare -r var_file="${2,,}"
+  declare -r var_kind="${3,,}"
+
+  ### Normalize 'mount.path': remove leading slash and replace slashes with underscore.
+  declare var_return_label=""
+  declare var_normalized="${var_path#/}"                # Strip leading "/".
+  var_normalized="${var_normalized//\//_}"              # Replace "/" with "_"
+  [[ -z "${var_normalized}" ]] && var_normalized="root" # Edge case "/".
+
+  case "${var_kind}" in
+
+    part)
+
+      case "${var_path}" in
+
+        SWAP)                var_return_label="part_ephem_swap" ;;
+        /tmp)                var_return_label="part_ephem_tmp" ;;
+        /boot/efi)           var_return_label="part_esp" ;;
+        /)                   var_return_label="part_root" ;;
+        *)                   var_return_label="part_${var_normalized}" ;;
+
+      esac
+      ;;
+
+    luks)
+
+      case "${var_path}" in
+
+        /tmp)                var_return_label="crypt_ephem_tmp" ;;
+        SWAP)                var_return_label="crypt_ephem_swap" ;;
+        /boot/efi)           var_return_label="" ;;
+        /)                   var_return_label="crypt_root" ;;
+        *)                   var_return_label="crypt_${var_normalized}" ;;
+
+      esac
+      ;;
+
+    file)
+
+      case "${var_path}:${var_file}" in
+
+        SWAP:*)              var_return_label="host_swap" ;;
+        /tmp:*)              var_return_label="host_tmp" ;;
+        /boot/efi:*)         var_return_label="ESP" ;;
+        /var/log/audit:ext4) var_return_label="ext4_var_audit" ;;
+        *:ext4)              var_return_label="ext4_${var_normalized}"
+                             var_return_label="${var_return_label:0:16}"
+                             do_log "warn" "file_only" "3295() Label: '${var_return_label}' of type: '${var_kind}' created for: '${var_path}' exceeds 16 chars, truncating."
+                             ;;
+        *:btrfs)             var_return_label="btrfs_${var_normalized}" ;;
+        *:*)                 var_return_label="${var_file}_${var_normalized}" ;;
+
+      esac
+      ;;
+
+    sub)
+
+      if [[ "${var_file}" == "btrfs" ]]; then
+        var_return_label="@${var_normalized}"
+      fi
+      ;;
+
+    snap)
+
+      if [[ "${var_file}" == "btrfs" ]]; then
+        var_return_label="@${var_normalized}_snap"
+      fi
+      ;;
+
+    *)
+
+      do_log "warn" "3295() File_only" "Unknown kind: ${var_kind}"
+      return 0
+      ;;
+
+  esac
+
+  if [[ -n "${var_return_label}" ]]; then
+
+    do_log "info" "file_only" "3295() Label: '${var_return_label}' of type: '${var_kind}' created for: '${var_path}'."
+    printf "%s\n" "${var_return_label}"
+    return 0
+
+  else
+
+    do_log "warn" "file_only" "3295() Label not resolved: of type: '${var_kind}' for: '${var_path}' and FS: '${var_file}'."
+    return 0
+
+  fi
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh