V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4000_debootstrap/4010_prepare_mounts.sh

@@ -17,8 +17,7 @@ guard_sourcing
 # Globals:
 #   TARGET
 #   VAR_CHROOT_ACTIVATED
-#   VAR_CHROOT_SYS_MASK_ENTER
-#   VAR_CHROOT_SYS_MASK_LEAVE
+#   VAR_CHROOT_SYS_MASK_HELPER
 #   VAR_NEED_RUN_IN_TARGET
 # Arguments:
 #   None
@@ -55,69 +54,158 @@ prepare_mounts() {
   declare     var_path="" var_fs="" var_src="" var_opts=""
 
   # shellcheck disable=SC2034
-  declare -g  VAR_CHROOT_SYS_MASK_ENTER=""
+  declare -g  VAR_CHROOT_SYS_MASK_HELPER=""
   # shellcheck disable=SC2034
-  VAR_CHROOT_SYS_MASK_ENTER=$(cat <<'EOF'
-declare var_had_sys="0"
+  VAR_CHROOT_SYS_MASK_HELPER=$(cat <<'EOF'
+#-------------------------------------------------------------------------------
+# Helpers: mount detection and conditional umount (idempotent).
 
-if mountpoint -q /sys/fs/cgroup; then
-  umount -l /sys/fs/cgroup || {
-    printf 'ERROR: cannot umount /sys/fs/cgroup\n' >&2
-    return 128
-  }
-fi
+cdi_is_mounted() {
+  declare path="${1:?target path required}"
 
-if mountpoint -q /sys; then
-  var_had_sys="1"
-  umount -l /sys || {
-    printf 'ERROR: cannot umount /sys\n' >&2
-    return 129
-  }
-fi
+  # Prefer findmnt, fall back to mountpoint, then /proc/self/mountinfo.
+  if command -v findmnt >/dev/null 2>&1; then
 
-mkdir -p /run
-printf '%s\n' "${var_had_sys}" >| /run/.ciss_sysmask  ### 1 = had sysfs, 0 = none
+    if findmnt -rn --target "${path}" >/dev/null 2>&1; then
 
-mkdir -p /sys
-### Empty, read-only directory so tools that expect /sys to exist don't fail.
-if ! mount -t tmpfs -o ro,nosuid,nodev,noexec,mode=0555,size=1M tmpfs /sys; then
-  printf 'ERROR: cannot mount tmpfs on /sys\n' >&2
-  return 130
-fi
-EOF
-  )
+      return 0
 
-  # shellcheck disable=SC2034
-  declare -g  VAR_CHROOT_SYS_MASK_LEAVE=""
-  # shellcheck disable=SC2034
-  VAR_CHROOT_SYS_MASK_LEAVE=$(cat <<'EOF'
-declare var_had_sys="0"
+    else
 
-if [[ -f /run/.ciss_sysmask ]]; then
-  # shellcheck disable=SC2155
-  declare var_had_sys="$(cat /run/.ciss_sysmask 2>/dev/null || printf '0')"
-fi
+      return 1
 
-if mountpoint -q /sys; then
-  umount -l /sys || {
-    printf 'ERROR: cannot unmount masked /sys\n' >&2
+    fi
+
+  fi
+
+  if command -v mountpoint >/dev/null 2>&1; then
+
+    if mountpoint -q -- "${path}"; then
+
+      return 0
+
+    else
+
+      return 1
+
+    fi
+
+  fi
+
+  # Last resort: grep mountinfo.
+  if grep -Fq " $(readlink -f -- "${path}") " /proc/self/mountinfo 2>/dev/null; then
+
+    return 0
+
+  fi
+
+  return 1
+}
+
+cdi_umount_if_mounted() {
+  declare path="${1:?target path required}"
+
+  if cdi_is_mounted "${path}"; then
+
+    # Lazy umount to avoid EBUSY in edge cases.
+    if ! umount -l -- "${path}"; then
+
+      printf 'ERROR: cannot umount %s\n' "${path}" >&2
+      return 128
+
+    fi
+
+  fi
+
+  return 0
+}
+
+# ENTER: mask '/sys' without a host hardware view.
+cdi_sys_mask_enter() {
+  declare state="/run/.ciss_sysmask"
+  mkdir -p /run
+
+  # Remember the pre-state, so we can restore exactly what was present.
+  declare had_sys="0"
+  declare had_cg="0"
+
+  if cdi_is_mounted /sys; then
+    had_sys="1"
+  fi
+
+  if cdi_is_mounted /sys/fs/cgroup; then
+    had_cg="1"
+  fi
+
+  printf 'HAD_SYS=%s\nHAD_CG=%s\n' "${had_sys}" "${had_cg}" >| "${state}"
+
+  # Unmount existing mounts if present; do not error if they were absent.
+  cdi_umount_if_mounted /sys/fs/cgroup || return 129
+  cdi_umount_if_mounted /sys || return 130
+
+  # Mask '/sys' with a tiny read-only tmpfs; directory must exist.
+  mkdir -p /sys
+
+  if ! mount -t tmpfs -o ro,nosuid,nodev,noexec,mode=0555,size=1M tmpfs /sys; then
+
+    printf 'ERROR: cannot mount tmpfs on /sys\n' >&2
     return 131
-  }
-fi
 
-### Restore sysfs and cgroup2.
-if ! mount -t sysfs -o nosuid,noexec,nodev sysfs /sys; then
-  printf 'ERROR: cannot mount sysfs on /sys\n' >&2
-  return 132
-fi
+  fi
 
-mkdir -p /sys/fs/cgroup
-if ! mount -t cgroup2 -o rw,nosuid,nodev,noexec,relatime cgroup2 /sys/fs/cgroup; then
-  printf 'ERROR: cannot mount cgroup2 on /sys/fs/cgroup\n' >&2
-  return 133
-fi
+  return 0
+}
 
-rm -f /run/.ciss_sysmask
+# LEAVE: restore pre-enter state exactly as it was.
+cdi_sys_mask_leave() {
+  declare state="/run/.ciss_sysmask"
+  declare had_sys="0"
+  declare had_cg="0"
+
+  if [[ -f "${state}" ]]; then
+
+    # shellcheck disable=SC2155
+    declare had_sys="$(grep -Eo '^HAD_SYS=[01]' "${state}" 2>/dev/null | cut -d= -f2 || printf '0')"
+
+    # shellcheck disable=SC2155
+    declare had_cg="$(grep -Eo '^HAD_CG=[01]' "${state}" 2>/dev/null | cut -d= -f2 || printf '0')"
+
+  fi
+
+  # Drop the mask (tmpfs on /sys) if still mounted.
+  cdi_umount_if_mounted /sys || return 132
+
+  # Restore '/sys' only if it was mounted before entering.
+  if [[ "${had_sys}" == "1" ]]; then
+
+    if ! mount -t sysfs -o nosuid,nodev,noexec sysfs /sys; then
+
+      printf 'ERROR: cannot mount sysfs on /sys\n' >&2
+      return 133
+
+    fi
+
+  fi
+
+  # Restore 'cgroup2' only if it was mounted before entering.
+  if [[ "${had_cg}" == "1" ]]; then
+
+    mkdir -p /sys/fs/cgroup
+
+    if ! mount -t cgroup2 -o rw,nosuid,nodev,noexec,relatime cgroup2 /sys/fs/cgroup; then
+
+      printf 'ERROR: cannot mount cgroup2 on /sys/fs/cgroup\n' >&2
+      return 134
+
+    fi
+
+  fi
+
+  rm -f -- "${state}"
+
+  return 0
+}
+#-------------------------------------------------------------------------------
 EOF
   )
 

func/cdi_4200_boot/4210_generate_crypttab.sh

@@ -98,7 +98,7 @@ EOF
           ;;
 
         "/boot")
-          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "pw_boot" "check,discard,initramfs,loud,luks,same-cpu-crypt,tries=1"
+          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "pw_boot" "check,discard,initramfs,keyscript=decrypt_keyctl,loud,luks,same-cpu-crypt,tries=1"
           ;;
 
         *)
@@ -132,8 +132,6 @@ EOF
         write_crypttab "${var_ephemeral_enclabel}" "PARTUUID=${var_host_partuuid}" "/dev/urandom" "cipher=aes-xts-plain64,size=512,discard,loud,tmp=ext4"
         chroot_script "${TARGET}" "systemctl unmask tmp.mount"
         do_log "info" "file_only" "4210() Executed: [systemctl unmask tmp.mount]"
-        chroot_script "${TARGET}" "systemctl disable tmp.mount"
-        do_log "info" "file_only" "4210() Executed: [systemctl disable tmp.mount]"
         ;;
 
       *)

func/cdi_4300_network/4320_update_initramfs.sh

@@ -15,8 +15,7 @@ guard_sourcing
 #######################################
 # Deploy all changes made using the 'update-grub' and 'update-initramfs' commands.
 # Globals:
-#   VAR_CHROOT_SYS_MASK_ENTER
-#   VAR_CHROOT_SYS_MASK_LEAVE
+#   VAR_CHROOT_SYS_MASK_HELPEr
 #   VAR_KERNEL
 # Arguments:
 #   None
@@ -32,36 +31,34 @@ update_initramfs() {
   chroot_logger "${TARGET}${var_logfile}"
 
   chroot_script "${TARGET}" "
-      update-grub 2>&1 | tee -a ${var_logfile}
-      echo ExitCode: \$? >> ${var_logfile}
-    "
+    update-grub 2>&1 | tee -a ${var_logfile}
+    echo ExitCode: \$? >> ${var_logfile}
+  "
 
   chroot_script "${TARGET}" "
-    ### Write the two helpers verbatim (no host-side expansion).
-    cat >/tmp/.ciss_sysmask_enter.sh <<'EOS_ENTER'
-${VAR_CHROOT_SYS_MASK_ENTER}
+    ### Write the helper verbatim (no host-side expansion).
+    cat >| /tmp/.ciss_sysmask_helper.sh << 'EOS_ENTER'
+${VAR_CHROOT_SYS_MASK_HELPER}
 EOS_ENTER
 
-    cat >/tmp/.ciss_sysmask_leave.sh <<'EOS_LEAVE'
-${VAR_CHROOT_SYS_MASK_LEAVE}
-EOS_LEAVE
+    source /tmp/.ciss_sysmask_helper.sh
 
     ### run: mask sys, build, unmask.
-    bash -e /tmp/.ciss_sysmask_enter.sh
+    cdi_sys_mask_enter
 
     depmod -a ${var_kernel} 2>&1 | tee -a ${var_logfile}
 
     update-initramfs -c -v -k all 2>&1 | tee -a ${var_logfile}
     echo ExitCode: \$? >> ${var_logfile}
 
-    bash -e /tmp/.ciss_sysmask_leave.sh
-    rm -f /tmp/.ciss_sysmask_{enter,leave}.sh
+    cdi_sys_mask_leave
+    rm -f /tmp/.ciss_sysmask_helper.sh
   "
 
   chroot_script "${TARGET}" "
-        update-grub 2>&1 | tee -a ${var_logfile}
-        echo ExitCode: \$? >> ${var_logfile}
-      "
+    update-grub 2>&1 | tee -a ${var_logfile}
+    echo ExitCode: \$? >> ${var_logfile}
+  "
 
   guard_dir && return 0
 }