msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 59s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-09-02 15:22:39 +02:00
parent b7494af52a
commit ddf039b09f
6 changed files with 31 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
func/cdi_4200_boot/4210_generate_crypttab.sh
View File

@@ -85,29 +85,39 @@ EOF
if [[ "${VAR_DROPBEAR}" == "true" ]]; then
if [[ "${var_key}" == "/" ]]; then
case "${var_key,,}" in
mkdir -p "${TARGET}/etc/initramfs-tools/files"
mkdir -p "${TARGET}/usr/lib/cryptsetup/scripts"
"/")
mkdir -p "${TARGET}/etc/initramfs-tools/files"
mkdir -p "${TARGET}/usr/lib/cryptsetup/scripts"
### Install the script to be called inside initramfs environment for unlocking LUKS and NUKE Devices.
install -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/files/unlock_wrapper.sh" \
"${TARGET}/etc/initramfs-tools/files/"
install -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/files/unlock_wrapper.sh" \
"${TARGET}/lib/cryptsetup/scripts/"
### Install the script to be called inside initramfs environment for unlocking LUKS and NUKE Devices.
install -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/files/unlock_wrapper.sh" \
"${TARGET}/etc/initramfs-tools/files/"
install -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/files/unlock_wrapper.sh" \
"${TARGET}/lib/cryptsetup/scripts/"
#write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=/lib/cryptsetup/scripts/unlock_wrapper.sh"
write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=decrypt_keyctl,tries=1"
#write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=/lib/cryptsetup/scripts/unlock_wrapper.sh"
printf "### Early-unlocked (initramfs) - single passphrase via decrypt_keyctl\n" >> "${TARGET}/etc/crypttab"
write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=decrypt_keyctl,tries=1"
;;
elif [[ "${var_key}" == "/usr" ]]; then
"/usr")
printf "### Early-unlocked (initramfs) - single passphrase via decrypt_keyctl\n" >> "${TARGET}/etc/crypttab"
write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=decrypt_keyctl,tries=1"
;;
write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=decrypt_keyctl,tries=1"
"/boot")
printf "### LUKS encrypted '/boot' – different passphrase, not in initramfs\n" >> "${TARGET}/etc/crypttab"
write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard"
;;
else
*)
printf "### Late-unlocked (userspace) – no initramfs, independent prompts / tokens\n" >> "${TARGET}/etc/crypttab"
write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard"
;;
write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=decrypt_keyctl,tries=1"
fi
esac
else