V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

includes/initramfs-tools/files/unlock_wrapper_advanced.sh

@@ -13,17 +13,143 @@
 
 set -Ceuo pipefail
 
-### Variable declaration
+#######################################
+# Variable declaration
+#######################################
 declare -ir MAX_RETRIES=2
+declare -r ASKPASS='/lib/cryptsetup/askpass'
 # shellcheck disable=SC2155
 declare -r CURRENTDATE=$(date +"%F %T")
 # shellcheck disable=SC2155
 declare -r IFS=$(printf ' \n\t')
-declare -r GRN='\e[0;92m'
+declare -r GRE='\e[0;92m'
 declare -r MAG='\e[0;95m'
 declare -r RED='\e[0;91m'
 declare -r RES='\e[0m'
 declare -r NL='\n'
+declare -g NUKE_ENABLED='false'
+declare -g NUKE_HASH=''
+declare -g PASSPHRASE=''
+
+#######################################
+# Print-colored text.
+# Arguments:
+#   $1 - color code
+#   $@ - text to print
+#######################################
+color_echo() { declare c="$1"; shift; printf "%s%s %s%s" "${c}" "${*}" "${RES}" "${NL}"; }
+
+#######################################
+# Die helper: print and exit hard.
+# Globals:
+#   NC
+#   RED
+# Arguments:
+#   1: Message string to print.
+#######################################
+die() { printf "%s✘ %s%s\n" "${RED}" "$1" "${RES}" >&2; power_off 3; }
+
+#######################################
+# Drop to bash environment.
+# Arguments:
+#   None
+#######################################
+drop_bash() { prompt_string; exec /bin/bash -i; }
+
+#######################################
+# Extract the 'nuke='-parameter from '/proc/cmdline'.
+# Globals:
+#   NL
+#   NUKE_ENABLED
+#   NUKE_HASH
+#   RED
+#   RES
+# Arguments:
+#   None
+# Returns:
+#   0: if 'nuke=' was found and extracted.
+#   1: if not found.
+#######################################
+extract_nuke_hash() {
+  declare ARG="" CMDLINE="" REGEX='(\$[^$]+){3,}'
+
+  ### Read '/proc/cmdline' into a single line safely.
+  read -r CMDLINE < /proc/cmdline
+  for ARG in ${CMDLINE}; do
+    case "${ARG}" in
+      nuke=*)
+        NUKE_HASH="${ARG#nuke=}"
+        if echo "${NUKE_HASH}" | grep -qE "${REGEX}"; then
+          NUKE_ENABLED="true"
+          return 0
+        else
+          ### If there is a malformed Grub Bootparameter 'nuke=HASH', drop to bash.
+          color_echo "${RED}" "✘ Nuke Hash Malformat : [${REGEX}] [${NUKE_HASH}]." >&2
+          color_echo "${RED}" "✘ Dropping to bash ...:" >&2
+          drop_bash
+        fi
+      ;;
+    esac
+  done
+  ### No 'nuke=HASH' entry found.
+  return 1
+}
+
+#######################################
+# Gather information of all LUKS Devices available on the system.
+# Arguments:
+#   None
+#######################################
+gather_luks_devices() {
+  declare prev=() curr=()
+  declare -i tries=0
+
+  while ((tries < 10)); do
+
+    mapfile -t curr < <(blkid -t TYPE=crypto_LUKS -o device | sort)
+
+    if cmp <(printf '%s\n' "${curr[@]}") <(printf '%s\n' "${prev[@]}") >/dev/null; then
+      break
+    fi
+
+    prev=("${curr[@]}")
+    tries=$((tries + 1))
+    sleep 1
+
+  done
+
+  printf '%s\n' "${curr[@]}"
+}
+
+#######################################
+# Erase LUKS headers on all LUKS devices and shutdown system.
+# Globals:
+#   NUKE_DEVICES
+#######################################
+nuke() {
+  declare dev=""
+  for dev in "${DEVICES_LUKS[@]}"; do
+    cryptsetup erase --batch-mode "${dev}" || true
+    color_echo "${RED}" "✘ Error: LUKS Device Header malfunction: [${dev}]."
+  done
+  secure_unset_pass
+  color_echo "${RED}" "✘ Error: LUKS Device malfunction. System Power Off in 16 seconds."
+  power_off 16
+}
+
+#######################################
+# Unified power-off routine.
+# Arguments:
+#   1: Sleep time before power-off in seconds (Default to 0 seconds).
+#######################################
+power_off() {
+  declare -r wait="${1:-0}"
+  sleep "${wait}"
+  sync
+  echo 1 >| /proc/sys/kernel/sysrq
+  echo o >| /proc/sysrq-trigger
+  # The System powers off immediately; no further code is executed.
+}
 
 #######################################
 # Generates informative shell prompt.
@@ -47,33 +173,6 @@ fi)\
 |~\$ "
 }
 
-#######################################
-# Die helper: print and exit hard.
-# Globals:
-#   NC
-#   RED
-# Arguments:
-#   1: Message string to print.
-#######################################
-die() {
-  printf "%s✘ %s%s\n" "${RED}" "$1" "${RES}" >&2
-  power_off 3
-}
-
-#######################################
-# Unified power-off routine.
-# Arguments:
-#   1: Sleep time before power-off in seconds.
-#######################################
-power_off() {
-  declare -r wait="${1:-0}"
-  sleep "${wait}"
-  sync
-  echo 1 >| /proc/sys/kernel/sysrq
-  echo o >| /proc/sysrq-trigger
-  # The System powers off immediately; no further code is executed.
-}
-
 #######################################
 # Trap function to be called on 'ERR'.
 # Arguments:
@@ -96,7 +195,7 @@ trap_on_err() {
 }
 
 #######################################
-# Security Trap on 'INT' and 'TERM' to provide a deterministic way to not circumvent the Nuke Routine.
+# Security Trap on 'INT' and 'TERM' to provide a deterministic way to not circumvent the nuke routine.
 # Globals:
 #   NL
 #   RED
@@ -108,7 +207,7 @@ trap_on_term() {
   trap - ERR INT TERM
   stty echo
   printf "%s" "${NL}"
-  printf "%s✘ System caught a 'SIGINT'. System Power Off in 3 seconds. %s%s" "${RED}" "${RES}" "${NL}" >&2
+  color_echo "${RED}" "✘ System caught a 'SIGINT'. System Power Off in 3 seconds." >&2
   power_off 3
 }
 
@@ -132,182 +231,132 @@ print_scr_err() {
   declare -r scr_err_errfunc="$4"
   declare -r scr_err_errcmmd="$5"
   printf "%s" "${NL}"
-  printf "%s✘ System caught an 'ERROR'. System Power Off in 15 seconds. %s%s" "${RED}" "${RES}" "${NL}" >&2
+  color_echo "${RED}" "✘ System caught an 'ERROR'. System Power Off in 16 seconds." >&2
   printf "%s" "${NL}"
-  printf "%s✘ Error               : %s %s%s" "${RED}" "${scr_err_errcode}" "${RES}" "${NL}" >&2
+  color_echo "${RED}" "✘ Error               : [${scr_err_errcode}]" >&2
-  printf "%s✘ Line                : %s %s%s" "${RED}" "${scr_err_errline}" "${RES}" "${NL}" >&2
+  color_echo "${RED}" "✘ Line                : [${scr_err_errline}]" >&2
-  printf "%s✘ Script              : %s %s%s" "${RED}" "${scr_err_errscrt}" "${RES}" "${NL}" >&2
+  color_echo "${RED}" "✘ Script              : [${scr_err_errscrt}]" >&2
-  printf "%s✘ Function            : %s %s%s" "${RED}" "${scr_err_errfunc}" "${RES}" "${NL}" >&2
+  color_echo "${RED}" "✘ Function            : [${scr_err_errfunc}]" >&2
-  printf "%s✘ Command             : %s %s%s" "${RED}" "${scr_err_errcmmd}" "${RES}" "${NL}" >&2
+  color_echo "${RED}" "✘ Command             : [${scr_err_errcmmd}]" >&2
   printf "%s" "${NL}"
 }
 
 #######################################
-# Print Error Message for '0'-Exit-Code Trap on 'ERR' on Terminal.
+# Print Error Message for '0'-Exit-Code on Terminal.
 # Arguments:
 #   none
 #######################################
-print_scr_scc() {
+print_scr_scc() { color_echo "${GRE}" "✅ Script exited successfully. Proceeding with booting."; }
-  printf "%s✅ Script exited successfully. Proceeding with booting. %s%s" "${GRN}" "${RES}" "${NL}"
-}
 
 #######################################
-# Gather information of all LUKS Devices available on the system.
+# Read Passphrase interactively.
+# Globals:
+#   ASKPASS
+#   NUKE_ENABLED
+#   NUKE_HASH
+#   PASSPHRASE
 # Arguments:
 #   None
+# Returns:
+#   0: on success
 #######################################
-gather_luks_devices() {
+read_passphrase() {
-  declare prev=() curr=() tries=0
+  declare -a METHODS=("sha512crypt" "yescrypt" "scrypt" "bcrypt")
+  declare METHOD="" SALT=""
 
-  while ((tries < 10)); do
+  PASSPHRASE="$(${ASKPASS} "Enter passphrase: ")"
-    mapfile -t curr < <(blkid -t TYPE=crypto_LUKS -o device | sort)
 
-    if cmp <(printf '%s\n' "${curr[@]}") <(printf '%s\n' "${prev[@]}") >/dev/null; then
+  if [[ "${NUKE_ENABLED,,}" == 'true' ]]; then
-      break
+    ### Validate NUKE_HASH format (e.g., $id$salt$hash)
+    if [[ "${NUKE_HASH}" =~ ^\$[a-z0-9]+\$[a-zA-Z0-9./]+\$ ]]; then
+      SALT="$(cut -d'$' -f3 <<< "${NUKE_HASH}")"
+      for METHOD in "${METHODS[@]}"; do
+        if mkpasswd -m "${METHOD}" -S "${SALT}" "${PASSPHRASE}" 2>/dev/null | grep -qF -- "${NUKE_HASH}"; then
+          nuke
+        fi
+      done
+    fi
   fi
 
-    prev=("${curr[@]}")
+  printf "%s" "${PASSPHRASE}"
-    tries=$((tries + 1))
-    sleep 1
-  done
 
-  printf '%s\n' "${curr[@]}"
+  return 0
 }
 
 #######################################
-# Extract the 'nuke='-parameter from '/proc/cmdline'.
+# Securely unset the passphrase variable.
 # Globals:
-#   VAR_NUKE_HASH
+#   PASSPHRASE
-# Returns:
-#   0: if nuke= was found and extracted.
-#   1: if not found.
 #######################################
-extract_nuke_hash() {
+secure_unset_pass() { unset PASSPHRASE; PASSPHRASE=""; }
-  declare ARG="" CMDLINE=""
-  ### Read /proc/cmdline into a single line safely
-  read -r CMDLINE < /proc/cmdline
-  for ARG in ${CMDLINE}; do
-    case "${ARG}" in
-      nuke=*) declare -gr VAR_NUKE_HASH="${ARG#nuke=}"; return 0 ;;
-    esac
-  done
-  ### Not found
-  return 1
-}
-
-
-
-#######################################
-# Read passphrase interactively.
-# Arguments:
-#  None
-#######################################
-passphrase_ask() {
-  declare -g PASSPHRASE=""
-  printf "\n"
-  stty -echo
-  printf "\e[0;95m🔐 Enter passphrase for decryption: \e[0m\n"
-  read -r PASSPHRASE
-  stty echo
-  printf "\n"
-}
-
-#######################################
-# Test the entered passphrase against the dedicated Nuke Keyslot #31.
-# Arguments:
-#   $1: DEVICE
-#   $2: PASSWD
-#######################################
-passphrase_test() {
-  declare -r DEVICE="$1"
-  declare -r PASPHR="$2"
-  printf '%s' "${PASPHR}" | cryptsetup open --batch-mode --test-passphrase --key-slot 31 "${DEVICE}" > /dev/null 2>&1
-}
 
 #######################################
 # Check the integrity and authenticity of this script itself.
 # Arguments:
-#   $0: Script Name
+#   0: Script Name
 #######################################
-verify_coresecret() {
+verify_script() {
-  ### Directory of this script
+  declare dir; dir="$(dirname "$(readlink -f "${0}")")"
-  # shellcheck disable=SC2155
+  declare script; script="$(basename "${0}")"
-  declare dir="$(dirname "$(readlink -f "${0}")")"
+  declare -a algo=("sha512" "sha384")
-  # shellcheck disable=SC2155
+  declare cmd="" computed="" expected="" hashfile="" item="" sigfile=""
-  declare script="$(basename "${0}")"
-  declare algo
 
-  for algo in sha512 sha384; do
+  for item in "${algo[@]}"; do
-    # shellcheck disable=SC2155
+    hashfile="${dir}/${script}.${item}"
-    declare hashfile="${dir}/${script}.${algo}"
+    sigfile="${hashfile}.sig"
-    # shellcheck disable=SC2155
+    cmd="${item}sum"
-    declare sigfile="${hashfile}.sig"
-    # shellcheck disable=SC2155
-    declare cmd="${algo}sum"
 
-    printf "\e[0;95m🔏 Verifying signature of: [%s] \e[0m\n" "${hashfile}"
+    color_echo "${MAG}" "🔏 Verifying signature of: [${hashfile}]"
     gpgv --keyring /etc/keys/pubring.gpg "${sigfile}" "${hashfile}" || {
-      printf "\e[0;91m✘ Signature verification failed for: [%s] \e[0m\n" "${hashfile}" >&2
+      color_echo "${RED}" "✘ Signature verification failed for: [${hashfile}]"
-      printf "\e[0;91m✘ System Power Off in 3 seconds. \e[0m\n" >&2
+      color_echo "${RED}" "✘ System Power Off in 3 seconds ...."
-      sync
+      power_off 3
-      sleep 3
-      set +C
-      echo 1 > /proc/sys/kernel/sysrq
-      echo o > /proc/sysrq-trigger
     }
-    printf "\e[0;92m🔏 Verifying signature of: [%s] successful. \e[0m\n" "${hashfile}"
+    color_echo "${GRE}" "🔏 Verifying signature of: [${hashfile}] successful."
 
-    printf "\e[0;95m🔢 Recomputing Hash: [%s] \e[0m\n" "${algo}"
+    color_echo "${MAG}" "🔢 Recomputing Hash: [${item}]"
-    # shellcheck disable=SC2155
+    computed=$(${cmd} "${dir}/${script}" | awk '{print $1}')
-    declare computed=$($cmd "${dir}/${script}" | awk '{print $1}')
+    expected=$(cat "${hashfile}")
-    # shellcheck disable=SC2155
-    declare expected=$(cat "${hashfile}")
 
-    if [[ ${computed} != "${expected}" ]]; then
+    if [[ "${computed}" != "${expected}" ]]; then
-      printf "\e[0;91m✘ Hash mismatch for: [%s] \e[0m\n" "${algo}" >&2
+      color_echo "${RED}" "✘ Recomputed hash mismatch for     : [${item}]" >&2
-      printf "\e[0;91m✘ System Power Off in 3 seconds. \e[0m\n" >&2
+      color_echo "${RED}" "✘ System Power Off in 3 seconds ...." >&2
-      sync
+      power_off 3
-      sleep 3
-      set +C
-      echo 1 > /proc/sys/kernel/sysrq
-      echo o > /proc/sysrq-trigger
     fi
-    printf "\e[0;92m🔢 Recomputing Hash: [%s] successful. \e[0m\n" "${algo}"
+    color_echo "${GRE}" "🔢 Recomputing Hash: [${item}] successful."
   done
 
-  printf "\e[0;92m🔏 All signatures and hashes verified successfully. Proceeding. \e[0m\n"
+  color_echo "${GRE}" "🔏 All signatures and hashes verified successfully. Proceeding."
 }
 
-### Main Programm
+### Main Programm Sequence ###
-trap 'trap_on_err "$?" "${BASH_SOURCE[0]}" "${LINENO}" "${FUNCNAME[0]:-main}" "${BASH_COMMAND}"' ERR
+main() {
-trap 'trap_on_term' INT TERM
+  trap 'trap_on_err "$?" "${BASH_SOURCE[0]}" "${LINENO}" "${FUNCNAME[0]:-main}" "${BASH_COMMAND}"' ERR
+  trap 'trap_on_term' INT TERM
 
-printf "\e[0;91mCoresecret Connection established.\e[0m\n"
+  color_echo "${RED}" "Coresecret Connection established."
-printf "\e[0;91mStarting Time: %s\e[0m\n" "${CURRENTDATE}"
+  color_echo "${RED}" "Starting Time: ${CURRENTDATE}"
-printf "\n"
+  color_echo "${MAG}" "Integrity self-check ..."
+  printf "%s" "${NL}"
 
-verify_coresecret
+  verify_script
 
-### Read newline-separated output into an array
+  ### Read newline-separated output into an array.
-mapfile -t DEVICES_LUKS < <(gather_luks_devices)
+  color_echo "${MAG}" "Scanning for LUKS devices ..."
-mapfile -t DEVICES_NUKE < <(gather_nuke_devices)
+  printf "%s" "${NL}"
+  mapfile -t DEVICES_LUKS < <(gather_luks_devices)
 
-### Debug output: list each element with its index
+  ### If there are no LUKS devices at all, drop to bash.
-#for idx in "${!DEVICES_LUKS[@]}"; do
+  if (( ${#DEVICES_LUKS[@]} == 0 )); then
-#  printf 'Luks[%d]: %s\n' "${idx}" "${DEVICES_LUKS[${idx}]}"
+    printf "%s✘ No LUKS Devices found. Dropping to bash ... %s %s" "${RED}" "${RES}" "${NC}"
-#done
+    drop_bash
+  fi
 
-### Debug output: list each element with its index
+  ### Extract the 'nuke='-parameter from '/proc/cmdline'.
-#for idx in "${!DEVICES_NUKE[@]}"; do
+  extract_nuke_hash
-#  printf 'Nuke[%d]: %s\n' "${idx}" "${DEVICES_NUKE[${idx}]}"
-#done
 
-### # If there are no LUKS devices at all, drop to bash
+  ### Read passphrase interactively.
-[[ -n ${DEVICES_LUKS[*]} ]] || {
+  read_passphrase
-  printf "\e[0;92m✘ No LUKS Devices found. Dropping to bash ... \e[0m\n"
-  prompt_string
-  exec /bin/bash -i
-}
 
 ### If there are LUKS devices but no Nuke devices, try unlocking flow
 if [[ -n ${DEVICES_LUKS[*]} ]] && [[ -z ${DEVICES_NUKE[*]} ]]; then
@@ -392,4 +441,7 @@ elif [[ -n ${DEVICES_LUKS[*]} ]] && [[ -n ${DEVICES_NUKE[*]} ]]; then
   fi
 
 fi
+}
+
+main "$@"
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh