msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m28s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-06-25 22:40:50 +02:00
parent 3eed07c67d
commit ab8c3a78b0
3 changed files with 137 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.preseed/partitioning.yaml
View File

@@ -187,8 +187,8 @@ recipe:
level: ""
dedup: true
format: true
# MUST be "SWAP" for "SWAP":
label: "SWAP"
# MUST be "crypt_swap_ephem" for "SWAP":
label: "crypt_swap_ephem"
options: ""
# MUST be "ext4" for ephemeral "SWAP":
version: "ext4"
@@ -228,14 +228,14 @@ recipe:
level: ""
dedup: true
format: true
# MUST be "ext4_tmp" for ephemeral "/tmp"
label: "ext4_tmp"
# MUST be "crypt_tmp_ephem" for ephemeral "/tmp"
label: "crypt_tmp_ephem"
options: ""
# MUST be "ext4" for ephemeral "/tmp"
version: "ext4"
mount:
enable: true
options: "defaults,rw,nodev,noexec,nosuid,noatime"
options: "defaults,rw,nodev,noexec,nosuid,noatime,mode=1777"
path: "/tmp"
# Only valid for filesystem version "btrfs":
subvolume: ""

201
func/3280_mount_partition.sh
View File

@@ -83,8 +83,8 @@ mount_partition() {
### Mount "/"-filesystem
declare -r var_mount_path_root="/"
if [[ -n ${MAP_MOUNTPATH_DEV[$var_mount_path_root]} ]]; then
mount_with_dir "${var_mount_path_root}" "${MAP_MOUNTPATH_DEV[$var_mount_path_root]}"
if [[ -n ${HMP_MOUNTPATH_DEV[$var_mount_path_root]} ]]; then
mount_with_dir "${var_mount_path_root}" "${HMP_MOUNTPATH_DEV[$var_mount_path_root]}"
else
do_log "error" "false" "Root-filesystem '${var_mount_path_root}' not found in Hashmap."
exit "${ERR_MOUNTING_ROOT}"
@@ -93,91 +93,150 @@ mount_partition() {
### Ensure order of "/boot" and "/boot/efi"
declare var_path
for var_path in "/boot" "/boot/efi"; do
if [[ -n ${MAP_MOUNTPATH_DEV[${var_path}]} ]]; then
mount_with_dir "${var_path}" "${MAP_MOUNTPATH_DEV[${var_path}]}"
if [[ -n ${HMP_MOUNTPATH_DEV[${var_path}]} ]]; then
mount_with_dir "${var_path}" "${HMP_MOUNTPATH_DEV[${var_path}]}"
else
do_log "info" "false" "Entry '${PATH}' not found in Hashmap."
do_log "info" "false" "Entry '${var_path}' not found in Hashmap."
fi
done
# Mounting all remaining keys of hashmap 'MAP_MOUNTPATH_DEV'.
declare KEY
declare TRANSFORMED_STRING
declare DEVICE_PATH
declare ENCRYPTION_LABEL
declare MATCHING_VAR
### Mounting all remaining keys of hashmap 'HMP_MOUNTPATH_DEV'.
for KEY in "${!MAP_MOUNTPATH_DEV[@]}"; do
# Initialize variables
DEVICE_PATH="${MAP_MOUNTPATH_DEV[${KEY}]}"
### Iterate over all devices in the recipe.
for var_dev in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}"); do
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
if [[ ${DEVICE_PATH} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
### Iterate over all partitions for this device.
for var_part in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}"); do
TRANSFORMED_STRING=$(echo "${DEVICE_PATH}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
### Extract parameters from YAML.
var_fs_btrfs_compress=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
var_fs_btrfs_level=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level" "${VAR_SETUP_PART}")
var_encryption_enable=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
var_encryption_label=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label" "${VAR_SETUP_PART}")
var_fs_label=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label" "${VAR_SETUP_PART}")
var_fs_version=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_path=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
var_mount_options=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options" "${VAR_SETUP_PART}")
var_mount_subvolume=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.subvolume" "${VAR_SETUP_PART}")
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
elif [[ ${DEVICE_PATH} =~ ^/dev/mapper/ ]]; then
### Skip already mounted paths ("/", "/boot", "/boot/efi") and ("/recovery")
if [[ "${var_mount_path}" == "/" || "${var_mount_path}" == "/boot" || "${var_mount_path}" == "/boot/efi" || "${var_mount_path}" == "/recovery" ]]; then
continue
fi
# Extract ENCRYPTION_LABEL
ENCRYPTION_LABEL="${DEVICE_PATH#/dev/mapper/}"
if [[ "${var_mount_path}" == "SWAP" ]]; then
# Search matching variable of sourced "${PRESEED}" variable file
MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${ENCRYPTION_LABEL}")
cryptsetup open --type plain --key-file /dev/random \
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
mkswap "/dev/mapper/${var_encryption_label}"
swapon "/dev/mapper/${var_encryption_label}"
do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
if [[ -n ${MATCHING_VAR} ]]; then
elif [[ ${var_mount_path} == "/tmp" ]]; then
# Extract third, fourth and fifth part of the respective variable
TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_([^_]+_[^_]+_[^_]+)_.*|\1|')
cryptsetup open --type plain --key-file /dev/random \
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
mkdir -p "${TARGET}/tmp"
mkfs.ext4 -L "${var_fs_label}" "/dev/mapper/${var_encryption_label}" "${var_fs_options:+ $var_fs_options}"
mount "${MOUNT_OPTIONS:+-o $MOUNT_OPTIONS}" "/dev/mapper/${var_encryption_label}" "${TARGET}/tmp"
do_log "info" "false" "Mounted: '${var_dev}' on: '/dev/mapper/${var_encryption_label}'."
else
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${ENCRYPTION_LABEL}'."
exit "${ERR_NO_ENCR_LABEL}"
done
done
declare var_key
declare var_transformed_string
declare var_device_path
declare var_encryption_label
declare var_matching_var
for var_key in "${!HMP_MOUNTPATH_DEV[@]}"; do
### Initialize variables.
var_device_path="${HMP_MOUNTPATH_DEV[${var_key}]}"
### If 'KEY:VALUE' equals "/dev/${DEV}${PARTITION}"
if [[ "${var_device_path}" =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
var_transformed_string=$(echo "${var_device_path}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
### If 'KEY:VALUE' equals "/dev/mapper/${ENCRYPTION_LABEL}"
elif [[ ${var_device_path} =~ ^/dev/mapper/ ]]; then
### Extract ENCRYPTION_LABEL
var_encryption_label="${var_device_path#/dev/mapper/}"
### Search matching variable of sourced "${PRESEED}" variable file
var_matching_var=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${var_encryption_label}")
if [[ -n ${var_matching_var} ]]; then
### Extract third, fourth and fifth part of the respective variable
var_transformed_string=$(echo "${var_matching_var}" | sed -E 's|recipe_([^_]+_[^_]+_[^_]+)_.*|\1|')
else
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${var_encryption_label}'."
exit "${ERR_MOUNTING_LUKS}"
fi
else
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${DEVICE_PATH}'."
exit "${ERR_NO_DEVIC_PATH}"
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${var_device_path}'."
exit "${ERR_UNKNOWN_DEV}"
fi
declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
declare ENCRYPTION_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_encryption_label"
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"
declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_filesystem_btrfs_compress"
declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_filesystem_btrfs_level"
declare ENCRYPTION_LABEL_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_encryption_label"
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_filesystem_label"
declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_filesystem_version"
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_mount_options"
declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_mount_subvolume"
declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
declare ENCRYPTION_LABEL=${!ENCRYPTION_LABEL_VAR}
declare var_encryption_label=${!ENCRYPTION_LABEL_VAR}
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
# Skip already mounted paths ("/", "/boot", "/boot/efi")
if [[ ${KEY} == "/" || ${KEY} == "/boot" || ${KEY} == "/boot/efi" ]]; then
if [[ ${var_key} == "/" || ${var_key} == "/boot" || ${var_key} == "/boot/efi" ]]; then
continue
fi
if [[ ${FILESYSTEM_VERSION,,} == "btrfs" ]]; then
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
mount_with_dir "${KEY}" "${DEVICE_PATH}" "${BTRFS_OPTIONS}"
[[ -n ${MOUNT_SUBVOLUME} ]] && create_btrfs_subvolume "${KEY}" "${MOUNT_SUBVOLUME}"
mount_with_dir "${var_key}" "${var_device_path}" "${BTRFS_OPTIONS}"
[[ -n ${MOUNT_SUBVOLUME} ]] && create_btrfs_subvolume "${var_key}" "${MOUNT_SUBVOLUME}"
elif [[ ${FILESYSTEM_VERSION,,} == "ext4" ]]; then
mount_with_dir "${KEY}" "${DEVICE_PATH}"
mount_with_dir "${var_key}" "${var_device_path}"
else
do_log "error" "false" "No valid filesystem: '${FILESYSTEM_VERSION}' found for ${KEY}."
do_log "error" "false" "No valid filesystem: '${FILESYSTEM_VERSION}' found for ${var_key}."
fi
@@ -185,74 +244,74 @@ mount_partition() {
# Reminder: MAP_EPHEMERALLABEL_DEV["${MOUNT_PATH}"]="/dev/${DEV}${PARTITION}"
# Mounting remaining entries of hashmap 'MAP_EPHEMERALLABEL_DEV'.
declare KEY
declare TRANSFORMED_STRING
declare DEVICE_PATH
declare var_key
declare var_transformed_string
declare var_device_path
for KEY in "${!MAP_EPHEMERAL_DEV[@]}"; do
for var_key in "${!MAP_EPHEMERAL_DEV[@]}"; do
# Initialize variables
DEVICE_PATH="${MAP_EPHEMERAL_DEV[${KEY}]}"
var_device_path="${MAP_EPHEMERAL_DEV[${var_key}]}"
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
if [[ ${DEVICE_PATH} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
if [[ ${var_device_path} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
TRANSFORMED_STRING=$(echo "${DEVICE_PATH}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
var_transformed_string=$(echo "${var_device_path}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
elif [[ ${DEVICE_PATH} =~ ^/dev/mapper/ ]]; then
elif [[ ${var_device_path} =~ ^/dev/mapper/ ]]; then
# Extract ENCRYPTION_LABEL
ENCRYPTION_LABEL="${DEVICE_PATH#/dev/mapper/}"
var_encryption_label="${var_device_path#/dev/mapper/}"
# Search matching variable of sourced "${PRESEED}" variable file
MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${ENCRYPTION_LABEL}")
var_matching_var=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${var_encryption_label}")
if [[ -n ${MATCHING_VAR} ]]; then
if [[ -n ${var_matching_var} ]]; then
# Extract third, fourth and fifth part of the respective variable
TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
var_transformed_string=$(echo "${var_matching_var}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
else
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${ENCRYPTION_LABEL}'."
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${var_encryption_label}'."
exit "${ERR_NO_ENCR_LABEL}"
fi
else
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${DEVICE_PATH}'."
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${var_device_path}'."
exit "${ERR_NO_DEVIC_PATH}"
fi
declare ENCRYPTION_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_encryption_label"
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
declare ENCRYPTION_LABEL=${!ENCRYPTION_LABEL_VAR}
declare ENCRYPTION_LABEL_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_encryption_label"
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_filesystem_label"
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_mount_options"
declare var_encryption_label=${!ENCRYPTION_LABEL_VAR}
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
if [[ ${KEY} == "SWAP" ]]; then
if [[ ${var_key} == "SWAP" ]]; then
cryptsetup open --type plain --key-file /dev/random \
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
--sector-size 4096 "/dev/disk/by-label/${FILESYSTEM_LABEL}" "${ENCRYPTION_LABEL}"
mkswap "/dev/mapper/${ENCRYPTION_LABEL}"
swapon "/dev/mapper/${ENCRYPTION_LABEL}"
do_log "info" "false" "Mounted: '${KEY}' on: '/dev/mapper/${ENCRYPTION_LABEL}'."
--sector-size 4096 "/dev/disk/by-label/${FILESYSTEM_LABEL}" "${var_encryption_label}"
mkswap "/dev/mapper/${var_encryption_label}"
swapon "/dev/mapper/${var_encryption_label}"
do_log "info" "false" "Mounted: '${var_key}' on: '/dev/mapper/${var_encryption_label}'."
elif [[ ${KEY} == "/tmp" ]]; then
elif [[ ${var_key} == "/tmp" ]]; then
cryptsetup open --type plain --key-file /dev/random \
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
--sector-size 4096 "/dev/disk/by-label/${FILESYSTEM_LABEL}" "${ENCRYPTION_LABEL}"
--sector-size 4096 "/dev/disk/by-label/${FILESYSTEM_LABEL}" "${var_encryption_label}"
mkdir -p "${TARGET}/tmp"
mount "${MOUNT_OPTIONS:+-o $MOUNT_OPTIONS}" "/dev/mapper/${ENCRYPTION_LABEL}" "${TARGET}/tmp"
do_log "info" "false" "Mounted: '${KEY}' on: '/dev/mapper/${ENCRYPTION_LABEL}'."
mount "${MOUNT_OPTIONS:+-o $MOUNT_OPTIONS}" "/dev/mapper/${var_encryption_label}" "${TARGET}/tmp"
do_log "info" "false" "Mounted: '${var_key}' on: '/dev/mapper/${var_encryption_label}'."
else
do_log "warn" "false" "Ephemeral configuration for ${KEY} is not valid or disabled."
do_log "warn" "false" "Ephemeral configuration for ${var_key} is not valid or disabled."
fi
done

3
var/errors.var.sh
View File

@@ -30,7 +30,8 @@ declare -girx ERR_READ_PARTTBL=240 # The partition could not be deleted, cr
declare -girx ERR_BTRFS_SUBVOL=239 # The btrfs subvolume could not be created.
declare -girx ERR_MOUNTING_DEV=238 # The Device could not be mounted.
declare -girx ERR_MOUNTING_ROOT=237 # The / Volume could not be mounted.
declare -girx ERR_MOUNTING_LUKS=236 # The LUKS Volume could not be mounted.
declare -girx ERR_UNKNOWN_DEV=235 # Unknown Device Path.