V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

ciss_debian_installer.sh

@@ -323,8 +323,6 @@ info_echo "4460_hardening_memory.sh"
 hardening_memory
 
 ### CDI_4500
-info_echo "4500_check_usr_merge.sh"
-check_final_usr_merge
 info_echo "4500_installation_accounts.sh"
 installation_accounts # TODO: Checks ongoing
 

func/cdi_4000_debootstrap/4000_debootstrap.sh

@@ -15,7 +15,6 @@ guard_sourcing
 #######################################
 # Install a minimal Debian environment using the 'debootstrap' command.
 # Globals:
-#   ERR_DEBOOTSTRAP
 #   LOG_DBS
 #   TARGET
 #   VAR_ARCHITECTURE
@@ -37,7 +36,7 @@ func_debootstrap() {
   declare -r var_includes="${debootstrap_includes}"
   declare -a ary_cmd=()
 
-  ary_cmd+=( "debootstrap" "--arch=${var_arch}" "--merged-usr" )
+  ary_cmd+=( "debootstrap" "--arch=${var_arch}" "--log-extra-deps" "--merged-usr" )
 
   if [[ -n "${var_includes}" ]]; then ary_cmd+=( "--include=${var_includes}" ); fi
 

func/cdi_4000_debootstrap/4005_check_usr_merge.sh

@@ -30,16 +30,16 @@ check_usr_merge() {
 
   # shellcheck disable=SC2312
   chroot_script "${TARGET}" "
-    test -L /bin  && test $(readlink -f /bin)  = '/usr/bin'  || echo 'UNMERGED:/bin'  | tee -a ${var_logfile}
+    test -L /bin  && test $(readlink -f /bin)  = '/usr/bin'  && echo 'MERGED:/bin'  || echo 'UNMERGED:/bin'  | tee -a ${var_logfile}
-    test -L /sbin && test $(readlink -f /sbin) = '/usr/sbin' || echo 'UNMERGED:/sbin' | tee -a ${var_logfile}
+    test -L /sbin && test $(readlink -f /sbin) = '/usr/sbin' && echo 'MERGED:/sbin' || echo 'UNMERGED:/sbin' | tee -a ${var_logfile}
-    test -L /lib  && test $(readlink -f /lib)  = '/usr/lib'  || echo 'UNMERGED:/lib'  | tee -a ${var_logfile}
+    test -L /lib  && test $(readlink -f /lib)  = '/usr/lib'  && echo 'MERGED:/lib'  || echo 'UNMERGED:/lib'  | tee -a ${var_logfile}
     echo ExitCode: \$? >> ${var_logfile}
   "
 
   if [[ "${architecture}" == "amd64" ]]; then
     # shellcheck disable=SC2312
     chroot_script "${TARGET}" "
-      test -L /lib64 && test $(readlink -f /lib64) = '/usr/lib64' || echo 'UNMERGED:/lib64' | tee -a ${var_logfile}
+      test -L /lib64 && test $(readlink -f /lib64) = '/usr/lib64' && echo 'MERGED:/lib64' || echo 'UNMERGED:/lib64' | tee -a ${var_logfile}
       echo ExitCode: \$? >> ${var_logfile}
     "
   fi

func/cdi_4100_base/4121_installation_initramfs.sh

@@ -30,6 +30,10 @@ installation_initramfs() {
   ### Declare Arrays, HashMaps, and Variables.
   declare     var_modules=""
 
+  ### Install the script to be called by 'update-initramfs' to enforce merged-/usr symlinks inside the initramfs image.
+  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/hooks/custom-usrmerge.sh" \
+    "${TARGET}/etc/initramfs-tools/hooks/"
+
   ### Install the script to be called by 'update-initramfs' for installing the necessary modules to load into initramfs environment.
   install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/modules" \
     "${TARGET}/etc/initramfs-tools/"

func/cdi_4300_network/4300_installation_network.sh

@@ -18,8 +18,6 @@ guard_sourcing
 #   ARY_IPV4_NS
 #   ARY_IPV6_NS
 #   TARGET
-#   VAR_ARCHITECTURE
-#   VAR_CODENAME
 #   VAR_FINAL_IPV4
 #   VAR_FINAL_IPV4_GW
 #   VAR_FINAL_IPV4_SUBNET
@@ -28,7 +26,6 @@ guard_sourcing
 #   VAR_FINAL_IPV6_SUBNET
 #   VAR_FINAL_NIC
 #   VAR_LINK_IPV6
-#   VAR_VERSION
 #   network_autoconfig_enable
 #   network_choose_interface_auto
 #   network_static_ipv4nameserver_0
@@ -42,8 +39,29 @@ guard_sourcing
 installation_network() {
   ### Declare Arrays, HashMaps, and Variables.
   declare     var_supersede="" var_supersede_ipv6=""
+  declare -r  var_logfile="/root/.ciss/cdi/log/4300_installation_network.log"
 
-  chroot_exec "${TARGET}" apt-get install -y dhcpcd-base
+  chroot_logger "${TARGET}${var_logfile}"
+
+  chroot_script "${TARGET}" "
+    export INITRD=No
+    apt-get purge -y dhcpcd isc-dhcp-client 2>&1 | tee -a ${var_logfile}
+    echo ExitCode: \$? >> ${var_logfile}
+  "
+
+  chroot_script "${TARGET}" "
+      export INITRD=No
+      apt-get install -y --no-install-suggests ifupdown dhcpcd-base 2>&1 | tee -a ${var_logfile}
+      echo ExitCode: \$? >> ${var_logfile}
+  "
+
+  chroot_script "${TARGET}" "
+    systemctl disable systemd-networkd NetworkManager 2>/dev/null | tee -a ${var_logfile} || true
+    systemctl disable dhcpcd.service 2>/dev/null | tee -a ${var_logfile} || true
+    echo ExitCode: \$? >> ${var_logfile}
+  "
+
+  chroot_exec "${TARGET}"
   mkdir -p "${TARGET}/etc/network/interfaces.d"
 
   ### Create a network configuration file header.
@@ -55,40 +73,6 @@ installation_network() {
 
   fi
 
-  cat << EOF >| "${TARGET}/etc/network/interfaces"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# This file describes the network interfaces available on your system
-# and how to activate them. For more information, see interfaces(5).
-
-source /etc/network/interfaces.d/*
-
-# The loopback network interface
-auto lo
-iface lo inet loopback
-
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
-EOF
-  chmod 0644 "${TARGET}/etc/network/interfaces"
-  do_log "info" "file_only" "4300() Header '${TARGET}/etc/network/interfaces' created."
-
-  ### Configure network interfaces based on 'preseed.yaml' and create network configuration files for IPv4.
-  if [[ "${network_autoconfig_enable}" == "true" && "${network_choose_interface_auto}" == "true" ]]; then
-
   ### Reminder ###
   # auto:
   # For servers or systems with static interfaces that should always be available (e.g., eth0 on a server).
@@ -97,25 +81,33 @@ EOF
   # For systems with dynamic or removable network devices (e.g., laptops or USB adapters).
   # To avoid boot delays when interfaces are unavailable.
 
-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+  insert_header   "${TARGET}/etc/network/interfaces"
-# SPDX-Version: 3.0
+  insert_comments "${TARGET}/etc/network/interfaces"
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
+  cat << EOF >>   "${TARGET}/etc/network/interfaces"
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# This file describes the network interfaces available on your system
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# and how to activate them. For more information, see interfaces(5).
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
 
-# Static file system information: /etc/network/interfaces.d/10-ipv4-dhcp
+source-directory /etc/network/interfaces.d/*
-# Generated by CISS.debian.installer ${VAR_VERSION}
+
-# Architecture: ${VAR_ARCHITECTURE}
+# The loopback network interface
-# Distribution: ${VAR_CODENAME}
+auto lo
+iface lo inet loopback
 
-# The primary network interface IPv4
 auto ${VAR_FINAL_NIC}
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
+EOF
+  chmod 0644 "${TARGET}/etc/network/interfaces"
+  do_log "info" "file_only" "4300() Header '${TARGET}/etc/network/interfaces' created."
+
+
+  ### Configure network interfaces based on 'preseed.yaml' and create network configuration files for IPv4.
+  if [[ "${network_autoconfig_enable}" == "true" && "${network_choose_interface_auto}" == "true" ]]; then
+
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+# The primary network interface: IPv4 via DHCP
 iface ${VAR_FINAL_NIC} inet dhcp
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
@@ -125,25 +117,10 @@ EOF
 
   elif [[ "${network_autoconfig_enable}" == "true" && "${network_choose_interface_auto}" == "false" ]]; then
 
-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
-# SPDX-Version: 3.0
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# The primary network interface: IPv4 via DHCP
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv4-dhcp
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv4
-auto ${VAR_FINAL_NIC}
 iface ${VAR_FINAL_NIC} inet dhcp
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
@@ -156,25 +133,10 @@ EOF
   if [[ "${network_autoconfig_enable}" == "false" ]]; then
 
     # shellcheck disable=SC2153
-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv4-static"
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv4-static"
-# SPDX-Version: 3.0
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv4-static"
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv4-static"
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# The primary network interface: IPv4 via static IP
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv4-static
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv4
-auto ${VAR_FINAL_NIC}
 iface ${VAR_FINAL_NIC} inet static
     address ${VAR_FINAL_IPV4}
     netmask ${VAR_FINAL_IPV4_SUBNET}
@@ -188,59 +150,29 @@ EOF
 
   fi
 
+
   ### Configure network interfaces based on 'preseed.yaml' and create network configuration files for IPv6.
-  if [[ "${network_autoconfig_enable}" == "true" && "${VAR_LINK_IPV6}" == "true" ]]; then
+  if [[ "${network_autoconfig_enable}" == "true" && "${VAR_LINK_IPV6}" == "true" &&  -z "${network_static_ipv6address}" ]]; then
 
-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
-# SPDX-Version: 3.0
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# The primary network interface: IPv6 via SLAAC (+ stateless DHCPv6 for DNS)
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+iface ${VAR_FINAL_NIC} inet6 auto
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+    accept_ra 2
-# SPDX-FileType: SOURCE
+    dhcp 1
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv6-dhcp
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv6
-auto ${VAR_FINAL_NIC}
-iface ${VAR_FINAL_NIC} inet6 dhcp
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
 EOF
     chmod 0644 "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
     do_log "info" "file_only" "4300() IPv6 on the primary NIC: '${VAR_FINAL_NIC}' configured with DHCP."
 
-  fi
+  elif [[ "${VAR_LINK_IPV6}" == "true" && -n "${network_static_ipv6address}" ]]; then
 
-  if [[ "${network_autoconfig_enable}" == "false" && -n "${network_static_ipv6address}" ]]; then
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv6-static"
-
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv6-static"
-    # shellcheck disable=SC2153
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv6-static"
-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv6-static"
+# The primary network interface: IPv6 via static IP
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv6-static
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv6
-auto ${VAR_FINAL_NIC}
 iface ${VAR_FINAL_NIC} inet6 static
     address ${VAR_FINAL_IPV6}/${VAR_FINAL_IPV6_SUBNET}
     gateway ${VAR_FINAL_IPV6_GW}
@@ -255,33 +187,47 @@ EOF
 
 
   ### Ensure 'dhcpcd-base' DHCP Client is not overwriting the static nameserver settings.
-  if [[ "${network_autoconfig_enable}" == "true" && -n "${network_static_ipv4nameserver_0}" ]]; then
-
   if [[ -f "${TARGET}/etc/dhcpcd.conf" ]]; then
 
     mkdir -p "${TARGET}/root/.ciss/cdi/backup/etc"
     mv "${TARGET}/etc/dhcpcd.conf" "${TARGET}/root/.ciss/cdi/backup/etc/dhcpcd.conf.bak"
-      do_log "info" "file_only" "4300() Existing '${TARGET}/etc/dhcpcd.con' copied."
+    do_log "info" "file_only" "4300() Existing '${TARGET}/etc/dhcpcd.conf' moved."
 
   fi
 
   insert_header   "${TARGET}/etc/dhcpcd.conf"
   insert_comments "${TARGET}/etc/dhcpcd.conf"
-    cat << EOF >> "${TARGET}/etc/dhcpcd.conf"
+  cat << 'EOF' >> "${TARGET}/etc/dhcpcd.conf"
-### Global defaults for all interfaces.
+### A ServerID is required by RFC2131.
+require dhcp_server_identifier
+
+### Respect the network MTU. This is applied to DHCP routes.
+option interface_mtu
+
+### A list of options to request from the DHCP server.
 option host_name
 option domain_name
 option domain_search
+option domain_name_servers
+
+### Most distributions have NTP support.
+option ntp_servers
 
 ### Ask server to update both A and PTR via FQDN (RFC 4702 semantics).
 fqdn both
 
-### Enforce static DNS and prevent dhcpcd from writing 'resolv.conf'.
+EOF
+
+
+  if [[ -n "${network_static_ipv4nameserver_0}" ]]; then
+
+    cat << EOF >>   "${TARGET}/etc/dhcpcd.conf"
+### Enforce static DNS
 nooption domain_name_servers
-nohook resolv.conf rdnssd
+nohook rdnssd
 
 ### Static resolvers (IPv4).
-### (This does NOT write '/etc/resolv.conf' because of nohook above.)
+interface ${VAR_FINAL_NIC}
 EOF
 
     var_supersede=$(printf "%s " "${ARY_IPV4_NS[@]}")
@@ -292,9 +238,12 @@ EOF
   fi
 
 
+  if [[ -n "${network_static_ipv6nameserver_0}" ]]; then
 
-  if [[ "${network_autoconfig_enable}" == "false" && -n "${network_static_ipv6nameserver_0}" ]]; then
+    cat << EOF >>   "${TARGET}/etc/dhcpcd.conf"
 
+### Static resolvers (IPv6).
+EOF
     var_supersede_ipv6=$(printf "%s " "${ARY_IPV6_NS[@]}")
     echo "  static domain_name_servers=${var_supersede_ipv6}" >> "${TARGET}/etc/dhcpcd.conf"
 
@@ -302,13 +251,9 @@ EOF
 
   fi
 
-  if [[ "${network_autoconfig_enable}" == "true" && -n "${network_static_ipv4nameserver_0}" ]]; then
+  ### Footer (always)
-
+  echo '' >> "${TARGET}/etc/dhcpcd.conf"
-    cat << EOF >> "${TARGET}/etc/dhcpcd.conf"
+  echo '# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf' >> "${TARGET}/etc/dhcpcd.conf"
-
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
-EOF
-  fi
 
   guard_dir && return 0
 }

func/cdi_4400_hardening/4400_kernel_modules.sh

@@ -24,23 +24,10 @@ guard_sourcing
 kernel_modules() {
   ### Entropy collection improvements
   mkdir -p "${TARGET}/usr/lib/modules-load.d"
-  cat << EOF >| "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /usr/lib/modules-load.d/30_security-misc.conf
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
 
+  insert_header   "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
+  insert_comments "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
+  cat << EOF >>   "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
 # The jitterentropy_rng kernel module provides a reliable and hardware-independent source of cryptographic entropy by measuring
 # minute variations in CPU execution timing (jitter). These microsecond-level differences are unpredictable and rooted in
 # physical randomness, making them suitable for high-quality entropy generation. Unlike other RNG methods that rely on hardware

func/cdi_4500_user/4500_installation_accounts.sh

@@ -76,11 +76,11 @@ installation_accounts() {
     fi
   fi
 
-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/etc/skel/.bashrc" "${TARGET}/root/"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.bashrc" "${TARGET}/root/"
-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/etc/skel/.zshrc" "${TARGET}/root/"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.zshrc" "${TARGET}/root/"
-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/root/.ciss/alias" "${TARGET}/root/.ciss/"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/alias" "${TARGET}/root/.ciss/"
-  install -D -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/root/.ciss/clean_logout.sh" "${TARGET}/root/.ciss/"
+  install -D -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/clean_logout.sh" "${TARGET}/root/.ciss/"
-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/root/.ciss/shortcuts" "${TARGET}/root/.ciss/"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/shortcuts" "${TARGET}/root/.ciss/"
   # To be able to copy/paste from vim, one needs to create a '.vimrc' with the following content:
   echo 'set clipboard=unnamed' >| "${TARGET}/root/.vimrc"
   chmod 0600 "${TARGET}/root/.vimrc"

func/cdi_4600_verification/4699_check_usr_merge.sh

@@ -24,7 +24,7 @@ guard_sourcing
 #######################################
 check_final_usr_merge() {
   ### Declare Arrays, HashMaps, and Variables.
-  declare -r  var_logfile="/root/.ciss/cdi/log/4500_check_usr_merge.log"
+  declare -r  var_logfile="/root/.ciss/cdi/log/4699_check_usr_merge.log"
 
   chroot_logger "${TARGET}${var_logfile}"
 

includes/target/etc/initramfs-tools/hooks/custom-usrmerge.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+# SPDX-Comment: Enforce merged-/usr symlinks inside the initramfs image.
+
+set -eu
+
+PREREQ=""
+prereqs() { echo "${PREREQ}"; }
+case $1 in
+  prereqs) prereqs; exit 0 ;;
+esac
+
+. /usr/share/initramfs-tools/hook-functions
+
+### Ensure target directories exist in the future initramfs root.
+mkdir -p "${DESTDIR}/usr/bin" "${DESTDIR}/usr/sbin" "${DESTDIR}/usr/lib"
+
+### Create/refresh the canonical symlinks (idempotent).
+ln -sfn usr/bin  "${DESTDIR}/bin"
+ln -sfn usr/sbin "${DESTDIR}/sbin"
+ln -sfn usr/lib  "${DESTDIR}/lib"
+
+### amd64 optional:
+# shellcheck disable=2292
+[ -d "${DESTDIR}/usr/lib64" ] && ln -sfn usr/lib64 "${DESTDIR}/lib64"
+
+printf "\e[92mSuccessfully executed: [/etc/initramfs-tools/hooks/custom-usrmerge.sh] \n\e[0m"
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

meta_loader_func.sh

@@ -90,7 +90,6 @@ source_guard "./func/cdi_4400_hardening/4450_hardening_haveged.sh"
 source_guard "./func/cdi_4400_hardening/4460_hardening_memory.sh"
 
 ### cdi_4500_user
-source_guard "./func/cdi_4500_user/4500_check_usr_merge.sh"
 source_guard "./func/cdi_4500_user/4500_installation_accounts.sh"
 
 ### cdi_4600_verification