V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-08-28 17:40:06 +02:00
parent 44b3d1fb60
commit d43638d262
10 changed files with 159 additions and 189 deletions
--- a/ciss_debian_installer.sh
+++ b/ciss_debian_installer.sh
@@ -323,8 +323,6 @@ info_echo "4460_hardening_memory.sh"
 hardening_memory

 ### CDI_4500
-info_echo "4500_check_usr_merge.sh"
-check_final_usr_merge
 info_echo "4500_installation_accounts.sh"
 installation_accounts # TODO: Checks ongoing

--- a/func/cdi_4000_debootstrap/4000_debootstrap.sh
+++ b/func/cdi_4000_debootstrap/4000_debootstrap.sh
@@ -15,7 +15,6 @@ guard_sourcing
 #######################################
 # Install a minimal Debian environment using the 'debootstrap' command.
 # Globals:
-#   ERR_DEBOOTSTRAP
 #   LOG_DBS
 #   TARGET
 #   VAR_ARCHITECTURE
@@ -37,7 +36,7 @@ func_debootstrap() {
  declare -r var_includes="${debootstrap_includes}"
  declare -a ary_cmd=()

-  ary_cmd+=( "debootstrap" "--arch=${var_arch}" "--merged-usr" )
+  ary_cmd+=( "debootstrap" "--arch=${var_arch}" "--log-extra-deps" "--merged-usr" )

  if [[ -n "${var_includes}" ]]; then ary_cmd+=( "--include=${var_includes}" ); fi

--- a/func/cdi_4000_debootstrap/4005_check_usr_merge.sh
+++ b/func/cdi_4000_debootstrap/4005_check_usr_merge.sh
@@ -30,16 +30,16 @@ check_usr_merge() {

  # shellcheck disable=SC2312
  chroot_script "${TARGET}" "
-    test -L /bin  && test $(readlink -f /bin)  = '/usr/bin'  || echo 'UNMERGED:/bin'  | tee -a ${var_logfile}
-    test -L /sbin && test $(readlink -f /sbin) = '/usr/sbin' || echo 'UNMERGED:/sbin' | tee -a ${var_logfile}
-    test -L /lib  && test $(readlink -f /lib)  = '/usr/lib'  || echo 'UNMERGED:/lib'  | tee -a ${var_logfile}
+    test -L /bin  && test $(readlink -f /bin)  = '/usr/bin'  && echo 'MERGED:/bin'  || echo 'UNMERGED:/bin'  | tee -a ${var_logfile}
+    test -L /sbin && test $(readlink -f /sbin) = '/usr/sbin' && echo 'MERGED:/sbin' || echo 'UNMERGED:/sbin' | tee -a ${var_logfile}
+    test -L /lib  && test $(readlink -f /lib)  = '/usr/lib'  && echo 'MERGED:/lib'  || echo 'UNMERGED:/lib'  | tee -a ${var_logfile}
    echo ExitCode: \$? >> ${var_logfile}
  "

  if [[ "${architecture}" == "amd64" ]]; then
    # shellcheck disable=SC2312
    chroot_script "${TARGET}" "
-      test -L /lib64 && test $(readlink -f /lib64) = '/usr/lib64' || echo 'UNMERGED:/lib64' | tee -a ${var_logfile}
+      test -L /lib64 && test $(readlink -f /lib64) = '/usr/lib64' && echo 'MERGED:/lib64' || echo 'UNMERGED:/lib64' | tee -a ${var_logfile}
      echo ExitCode: \$? >> ${var_logfile}
    "
  fi
--- a/func/cdi_4100_base/4121_installation_initramfs.sh
+++ b/func/cdi_4100_base/4121_installation_initramfs.sh
@@ -30,6 +30,10 @@ installation_initramfs() {
  ### Declare Arrays, HashMaps, and Variables.
  declare     var_modules=""

+  ### Install the script to be called by 'update-initramfs' to enforce merged-/usr symlinks inside the initramfs image.
+  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/hooks/custom-usrmerge.sh" \
+    "${TARGET}/etc/initramfs-tools/hooks/"
+
  ### Install the script to be called by 'update-initramfs' for installing the necessary modules to load into initramfs environment.
  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/modules" \
    "${TARGET}/etc/initramfs-tools/"
--- a/func/cdi_4300_network/4300_installation_network.sh
+++ b/func/cdi_4300_network/4300_installation_network.sh
@@ -18,8 +18,6 @@ guard_sourcing
 #   ARY_IPV4_NS
 #   ARY_IPV6_NS
 #   TARGET
-#   VAR_ARCHITECTURE
-#   VAR_CODENAME
 #   VAR_FINAL_IPV4
 #   VAR_FINAL_IPV4_GW
 #   VAR_FINAL_IPV4_SUBNET
@@ -28,7 +26,6 @@ guard_sourcing
 #   VAR_FINAL_IPV6_SUBNET
 #   VAR_FINAL_NIC
 #   VAR_LINK_IPV6
-#   VAR_VERSION
 #   network_autoconfig_enable
 #   network_choose_interface_auto
 #   network_static_ipv4nameserver_0
@@ -42,8 +39,29 @@ guard_sourcing
 installation_network() {
  ### Declare Arrays, HashMaps, and Variables.
  declare     var_supersede="" var_supersede_ipv6=""
+  declare -r  var_logfile="/root/.ciss/cdi/log/4300_installation_network.log"

-  chroot_exec "${TARGET}" apt-get install -y dhcpcd-base
+  chroot_logger "${TARGET}${var_logfile}"
+
+  chroot_script "${TARGET}" "
+    export INITRD=No
+    apt-get purge -y dhcpcd isc-dhcp-client 2>&1 | tee -a ${var_logfile}
+    echo ExitCode: \$? >> ${var_logfile}
+  "
+
+  chroot_script "${TARGET}" "
+      export INITRD=No
+      apt-get install -y --no-install-suggests ifupdown dhcpcd-base 2>&1 | tee -a ${var_logfile}
+      echo ExitCode: \$? >> ${var_logfile}
+  "
+
+  chroot_script "${TARGET}" "
+    systemctl disable systemd-networkd NetworkManager 2>/dev/null | tee -a ${var_logfile} || true
+    systemctl disable dhcpcd.service 2>/dev/null | tee -a ${var_logfile} || true
+    echo ExitCode: \$? >> ${var_logfile}
+  "
+
+  chroot_exec "${TARGET}"
  mkdir -p "${TARGET}/etc/network/interfaces.d"

  ### Create a network configuration file header.
@@ -55,40 +73,6 @@ installation_network() {

  fi

-  cat << EOF >| "${TARGET}/etc/network/interfaces"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# This file describes the network interfaces available on your system
-# and how to activate them. For more information, see interfaces(5).
-
-source /etc/network/interfaces.d/*
-
-# The loopback network interface
-auto lo
-iface lo inet loopback
-
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
-EOF
-  chmod 0644 "${TARGET}/etc/network/interfaces"
-  do_log "info" "file_only" "4300() Header '${TARGET}/etc/network/interfaces' created."
-
-  ### Configure network interfaces based on 'preseed.yaml' and create network configuration files for IPv4.
-  if [[ "${network_autoconfig_enable}" == "true" && "${network_choose_interface_auto}" == "true" ]]; then
-
  ### Reminder ###
  # auto:
  # For servers or systems with static interfaces that should always be available (e.g., eth0 on a server).
@@ -97,25 +81,33 @@ EOF
  # For systems with dynamic or removable network devices (e.g., laptops or USB adapters).
  # To avoid boot delays when interfaces are unavailable.

-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
+  insert_header   "${TARGET}/etc/network/interfaces"
+  insert_comments "${TARGET}/etc/network/interfaces"
+  cat << EOF >>   "${TARGET}/etc/network/interfaces"
+# This file describes the network interfaces available on your system
+# and how to activate them. For more information, see interfaces(5).

-# Static file system information: /etc/network/interfaces.d/10-ipv4-dhcp
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
+source-directory /etc/network/interfaces.d/*
+
+# The loopback network interface
+auto lo
+iface lo inet loopback

-# The primary network interface IPv4
 auto ${VAR_FINAL_NIC}
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
+EOF
+  chmod 0644 "${TARGET}/etc/network/interfaces"
+  do_log "info" "file_only" "4300() Header '${TARGET}/etc/network/interfaces' created."
+
+
+  ### Configure network interfaces based on 'preseed.yaml' and create network configuration files for IPv4.
+  if [[ "${network_autoconfig_enable}" == "true" && "${network_choose_interface_auto}" == "true" ]]; then
+
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+# The primary network interface: IPv4 via DHCP
 iface ${VAR_FINAL_NIC} inet dhcp

 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
@@ -125,25 +117,10 @@ EOF

  elif [[ "${network_autoconfig_enable}" == "true" && "${network_choose_interface_auto}" == "false" ]]; then

-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv4-dhcp
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv4
-auto ${VAR_FINAL_NIC}
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv4-dhcp"
+# The primary network interface: IPv4 via DHCP
 iface ${VAR_FINAL_NIC} inet dhcp

 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
@@ -156,25 +133,10 @@ EOF
  if [[ "${network_autoconfig_enable}" == "false" ]]; then

    # shellcheck disable=SC2153
-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv4-static"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv4-static
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv4
-auto ${VAR_FINAL_NIC}
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv4-static"
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv4-static"
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv4-static"
+# The primary network interface: IPv4 via static IP
 iface ${VAR_FINAL_NIC} inet static
    address ${VAR_FINAL_IPV4}
    netmask ${VAR_FINAL_IPV4_SUBNET}
@@ -188,59 +150,29 @@ EOF

  fi

+
  ### Configure network interfaces based on 'preseed.yaml' and create network configuration files for IPv6.
-  if [[ "${network_autoconfig_enable}" == "true" && "${VAR_LINK_IPV6}" == "true" ]]; then
+  if [[ "${network_autoconfig_enable}" == "true" && "${VAR_LINK_IPV6}" == "true" &&  -z "${network_static_ipv6address}" ]]; then

-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv6-dhcp
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv6
-auto ${VAR_FINAL_NIC}
-iface ${VAR_FINAL_NIC} inet6 dhcp
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
+# The primary network interface: IPv6 via SLAAC (+ stateless DHCPv6 for DNS)
+iface ${VAR_FINAL_NIC} inet6 auto
+    accept_ra 2
+    dhcp 1

 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
 EOF
    chmod 0644 "${TARGET}/etc/network/interfaces.d/10-ipv6-dhcp"
    do_log "info" "file_only" "4300() IPv6 on the primary NIC: '${VAR_FINAL_NIC}' configured with DHCP."

-  fi
+  elif [[ "${VAR_LINK_IPV6}" == "true" && -n "${network_static_ipv6address}" ]]; then

-  if [[ "${network_autoconfig_enable}" == "false" && -n "${network_static_ipv6address}" ]]; then
-
-    # shellcheck disable=SC2153
-    cat << EOF >| "${TARGET}/etc/network/interfaces.d/10-ipv6-static"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/network/interfaces.d/10-ipv6-static
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
-# The primary network interface IPv6
-auto ${VAR_FINAL_NIC}
+    insert_header   "${TARGET}/etc/network/interfaces.d/10-ipv6-static"
+    insert_comments "${TARGET}/etc/network/interfaces.d/10-ipv6-static"
+    cat << EOF >>   "${TARGET}/etc/network/interfaces.d/10-ipv6-static"
+# The primary network interface: IPv6 via static IP
 iface ${VAR_FINAL_NIC} inet6 static
    address ${VAR_FINAL_IPV6}/${VAR_FINAL_IPV6_SUBNET}
    gateway ${VAR_FINAL_IPV6_GW}
@@ -255,60 +187,73 @@ EOF


  ### Ensure 'dhcpcd-base' DHCP Client is not overwriting the static nameserver settings.
-  if [[ "${network_autoconfig_enable}" == "true" && -n "${network_static_ipv4nameserver_0}" ]]; then
-
  if [[ -f "${TARGET}/etc/dhcpcd.conf" ]]; then

    mkdir -p "${TARGET}/root/.ciss/cdi/backup/etc"
    mv "${TARGET}/etc/dhcpcd.conf" "${TARGET}/root/.ciss/cdi/backup/etc/dhcpcd.conf.bak"
-      do_log "info" "file_only" "4300() Existing '${TARGET}/etc/dhcpcd.con' copied."
+    do_log "info" "file_only" "4300() Existing '${TARGET}/etc/dhcpcd.conf' moved."

  fi

  insert_header   "${TARGET}/etc/dhcpcd.conf"
  insert_comments "${TARGET}/etc/dhcpcd.conf"
-    cat << EOF >> "${TARGET}/etc/dhcpcd.conf"
-### Global defaults for all interfaces.
+  cat << 'EOF' >> "${TARGET}/etc/dhcpcd.conf"
+### A ServerID is required by RFC2131.
+require dhcp_server_identifier
+
+### Respect the network MTU. This is applied to DHCP routes.
+option interface_mtu
+
+### A list of options to request from the DHCP server.
 option host_name
 option domain_name
 option domain_search
+option domain_name_servers
+
+### Most distributions have NTP support.
+option ntp_servers

 ### Ask server to update both A and PTR via FQDN (RFC 4702 semantics).
 fqdn both

-### Enforce static DNS and prevent dhcpcd from writing 'resolv.conf'.
+EOF
+
+
+  if [[ -n "${network_static_ipv4nameserver_0}" ]]; then
+
+    cat << EOF >>   "${TARGET}/etc/dhcpcd.conf"
+### Enforce static DNS
 nooption domain_name_servers
-nohook resolv.conf rdnssd
+nohook rdnssd

 ### Static resolvers (IPv4).
-### (This does NOT write '/etc/resolv.conf' because of nohook above.)
+interface ${VAR_FINAL_NIC}
 EOF

    var_supersede=$(printf "%s " "${ARY_IPV4_NS[@]}")
-    echo "static domain_name_servers=${var_supersede}" >> "${TARGET}/etc/dhcpcd.conf"
+    echo "  static domain_name_servers=${var_supersede}" >> "${TARGET}/etc/dhcpcd.conf"

    do_log "info" "file_only" "4300() DHCP client configuration for IPv4: '${TARGET}/etc/dhcpcd.conf' configured."

  fi


+  if [[ -n "${network_static_ipv6nameserver_0}" ]]; then

-  if [[ "${network_autoconfig_enable}" == "false" && -n "${network_static_ipv6nameserver_0}" ]]; then
+    cat << EOF >>   "${TARGET}/etc/dhcpcd.conf"

+### Static resolvers (IPv6).
+EOF
    var_supersede_ipv6=$(printf "%s " "${ARY_IPV6_NS[@]}")
-    echo "static domain_name_servers=${var_supersede_ipv6}" >> "${TARGET}/etc/dhcpcd.conf"
+    echo "  static domain_name_servers=${var_supersede_ipv6}" >> "${TARGET}/etc/dhcpcd.conf"

    do_log "info" "file_only" "4300() DHCP client configuration for IPv6: '${TARGET}/etc/dhcpcd.conf' configured."

  fi

-  if [[ "${network_autoconfig_enable}" == "true" && -n "${network_static_ipv4nameserver_0}" ]]; then
-
-    cat << EOF >> "${TARGET}/etc/dhcpcd.conf"
-
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
-EOF
-  fi
+  ### Footer (always)
+  echo '' >> "${TARGET}/etc/dhcpcd.conf"
+  echo '# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf' >> "${TARGET}/etc/dhcpcd.conf"

  guard_dir && return 0
 }
--- a/func/cdi_4400_hardening/4400_kernel_modules.sh
+++ b/func/cdi_4400_hardening/4400_kernel_modules.sh
@@ -24,23 +24,10 @@ guard_sourcing
 kernel_modules() {
  ### Entropy collection improvements
  mkdir -p "${TARGET}/usr/lib/modules-load.d"
-  cat << EOF >| "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /usr/lib/modules-load.d/30_security-misc.conf
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}

+  insert_header   "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
+  insert_comments "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
+  cat << EOF >>   "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
 # The jitterentropy_rng kernel module provides a reliable and hardware-independent source of cryptographic entropy by measuring
 # minute variations in CPU execution timing (jitter). These microsecond-level differences are unpredictable and rooted in
 # physical randomness, making them suitable for high-quality entropy generation. Unlike other RNG methods that rely on hardware
--- a/func/cdi_4500_user/4500_installation_accounts.sh
+++ b/func/cdi_4500_user/4500_installation_accounts.sh
@@ -76,11 +76,11 @@ installation_accounts() {
    fi
  fi

-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/etc/skel/.bashrc" "${TARGET}/root/"
-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/etc/skel/.zshrc" "${TARGET}/root/"
-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/root/.ciss/alias" "${TARGET}/root/.ciss/"
-  install -D -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/root/.ciss/clean_logout.sh" "${TARGET}/root/.ciss/"
-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/root/.ciss/shortcuts" "${TARGET}/root/.ciss/"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.bashrc" "${TARGET}/root/"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.zshrc" "${TARGET}/root/"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/alias" "${TARGET}/root/.ciss/"
+  install -D -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/clean_logout.sh" "${TARGET}/root/.ciss/"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/shortcuts" "${TARGET}/root/.ciss/"
  # To be able to copy/paste from vim, one needs to create a '.vimrc' with the following content:
  echo 'set clipboard=unnamed' >| "${TARGET}/root/.vimrc"
  chmod 0600 "${TARGET}/root/.vimrc"
--- a/func/cdi_4600_verification/4699_check_usr_merge.sh
+++ b/func/cdi_4600_verification/4699_check_usr_merge.sh
@@ -24,7 +24,7 @@ guard_sourcing
 #######################################
 check_final_usr_merge() {
  ### Declare Arrays, HashMaps, and Variables.
-  declare -r  var_logfile="/root/.ciss/cdi/log/4500_check_usr_merge.log"
+  declare -r  var_logfile="/root/.ciss/cdi/log/4699_check_usr_merge.log"

  chroot_logger "${TARGET}${var_logfile}"

--- a/includes/target/etc/initramfs-tools/hooks/custom-usrmerge.sh
+++ b/includes/target/etc/initramfs-tools/hooks/custom-usrmerge.sh
@@ -0,0 +1,38 @@
+#!/bin/sh
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+# SPDX-Comment: Enforce merged-/usr symlinks inside the initramfs image.
+
+set -eu
+
+PREREQ=""
+prereqs() { echo "${PREREQ}"; }
+case $1 in
+  prereqs) prereqs; exit 0 ;;
+esac
+
+. /usr/share/initramfs-tools/hook-functions
+
+### Ensure target directories exist in the future initramfs root.
+mkdir -p "${DESTDIR}/usr/bin" "${DESTDIR}/usr/sbin" "${DESTDIR}/usr/lib"
+
+### Create/refresh the canonical symlinks (idempotent).
+ln -sfn usr/bin  "${DESTDIR}/bin"
+ln -sfn usr/sbin "${DESTDIR}/sbin"
+ln -sfn usr/lib  "${DESTDIR}/lib"
+
+### amd64 optional:
+# shellcheck disable=2292
+[ -d "${DESTDIR}/usr/lib64" ] && ln -sfn usr/lib64 "${DESTDIR}/lib64"
+
+printf "\e[92mSuccessfully executed: [/etc/initramfs-tools/hooks/custom-usrmerge.sh] \n\e[0m"
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/meta_loader_func.sh
+++ b/meta_loader_func.sh
@@ -90,7 +90,6 @@ source_guard "./func/cdi_4400_hardening/4450_hardening_haveged.sh"
 source_guard "./func/cdi_4400_hardening/4460_hardening_memory.sh"

 ### cdi_4500_user
-source_guard "./func/cdi_4500_user/4500_check_usr_merge.sh"
 source_guard "./func/cdi_4500_user/4500_installation_accounts.sh"

 ### cdi_4600_verification