V8.00.000.2025.06.17
All checks were successful
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 34s
🔁 Render Graphviz Diagrams. / 🔁 Render Graphviz Diagrams. (push) Successful in 24s
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m35s
All checks were successful
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 34s
🔁 Render Graphviz Diagrams. / 🔁 Render Graphviz Diagrams. (push) Successful in 24s
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m35s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
325
source/func/3.7.2.functions_installation_generate_fstab.sh
Normal file
325
source/func/3.7.2.functions_installation_generate_fstab.sh
Normal file
@@ -0,0 +1,325 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-02-13; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-ExternalRef: GIT https://cendev.eu/marc.weidner/CISS.2025.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.2025.hardened.installer framework.
|
||||
# SPDX-PackageName: CISS.2025.hardened.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
###########################################################################################
|
||||
# 3.7.2. Functions - installation - generate fstab #
|
||||
###########################################################################################
|
||||
|
||||
###########################################################################################
|
||||
# Generate target '/etc/fstab' entries.
|
||||
# Globals:
|
||||
# ERR_NO_DEVIC_PATH
|
||||
# ERR_NO_ENCR_LABEL
|
||||
# MAP_EPHEMERAL_ENCLABEL
|
||||
# MAP_MOUNTPATH_DEV
|
||||
# MODULE_ERR
|
||||
# MODULE_TXT
|
||||
# RECIPE_STRING
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
###########################################################################################
|
||||
3_7_2_functions_installation_generate_fstab() {
|
||||
declare -g -x MODULE_ERR="3_7_2_functions_installation_generate_fstab"
|
||||
declare -g -x MODULE_TXT="Generating '${TARGET}/etc/fstab'"
|
||||
do_show_header "${MODULE_TXT}"
|
||||
|
||||
# Generate '${TARGET}/etc/fstab' header
|
||||
touch "${TARGET}"/etc/fstab
|
||||
chmod 0644 "${TARGET}"/etc/fstab
|
||||
|
||||
# shellcheck disable=SC2129
|
||||
cat << 'EOF' >> "${TARGET}"/etc/fstab
|
||||
# /etc/fstab: static file system information.
|
||||
#
|
||||
# Use 'blkid' to print the universally unique identifier for a
|
||||
# device; this may be used with UUID= as a more robust way to name devices
|
||||
# that works even if disks are added and removed. See fstab(5).
|
||||
#
|
||||
# systemd generates mount units based on this file, see systemd.mount(5).
|
||||
# Please run 'systemctl daemon-reload' after making changes here.
|
||||
#
|
||||
# <file system> <mount point> <type> <options> <dump> <pass>
|
||||
|
||||
EOF
|
||||
|
||||
### Reminder ###
|
||||
# MAP_MOUNTPATH_DEV["${MOUNT_PATH}"]="/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
# MAP_MOUNTPATH_DEV["${MOUNT_PATH}"]="/dev/${DEV}${PARTITION}"
|
||||
|
||||
# Generate '${TARGET}/etc/fstab' special entries '/' '/boot' '/boot/efi'.
|
||||
# Define the order of the special keys.
|
||||
declare -a KEY_ORDER
|
||||
KEY_ORDER=("/" "/boot" "/boot/efi")
|
||||
|
||||
declare DEVICE_PATH
|
||||
declare DEVICE_UUID
|
||||
declare ENCRYPTION_LABEL
|
||||
declare KEY
|
||||
declare MATCHING_VAR
|
||||
declare TRANSFORMED_STRING
|
||||
|
||||
for KEY in "${KEY_ORDER[@]}"; do
|
||||
# Initialize variables
|
||||
DEVICE_PATH="${MAP_MOUNTPATH_DEV[${KEY}]}"
|
||||
DEVICE_UUID=$(blkid -s UUID -o value "${DEVICE_PATH}")
|
||||
|
||||
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
|
||||
if [[ ${DEVICE_PATH} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
|
||||
|
||||
TRANSFORMED_STRING=$(echo "${DEVICE_PATH}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
|
||||
|
||||
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
elif [[ ${DEVICE_PATH} =~ ^/dev/mapper/ ]]; then
|
||||
|
||||
# Extract ENCRYPTION_LABEL
|
||||
ENCRYPTION_LABEL="${DEVICE_PATH#/dev/mapper/}"
|
||||
|
||||
# Search matching variable of a sourced "${PRESEED}" variable file
|
||||
MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${ENCRYPTION_LABEL}")
|
||||
|
||||
if [[ -n ${MATCHING_VAR} ]]; then
|
||||
|
||||
# Extract third, fourth and fifth part of the respective variable
|
||||
TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${ENCRYPTION_LABEL}'."
|
||||
exit "${ERR_NO_ENCR_LABEL}"
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${DEVICE_PATH}'."
|
||||
exit "${ERR_NO_DEVIC_PATH}"
|
||||
|
||||
fi
|
||||
|
||||
declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
|
||||
declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
|
||||
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
|
||||
declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
|
||||
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
|
||||
declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"
|
||||
|
||||
declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
|
||||
declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
|
||||
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
|
||||
declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
|
||||
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
|
||||
declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
|
||||
|
||||
if [[ ${KEY} == "/" ]]; then
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
|
||||
|
||||
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "${MAP_MOUNTPATH_DEV[${KEY}]} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 1" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: '${MAP_MOUNTPATH_DEV[${KEY}]} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 1'."
|
||||
|
||||
elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "${MAP_MOUNTPATH_DEV[${KEY}]} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 1" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: '${MAP_MOUNTPATH_DEV[${KEY}]} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 1'."
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${KEY}'."
|
||||
|
||||
fi
|
||||
|
||||
elif [[ ${KEY} == "/boot" ]]; then
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
|
||||
|
||||
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2'."
|
||||
|
||||
elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2'."
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${KEY}'."
|
||||
|
||||
fi
|
||||
|
||||
elif [[ ${KEY} == "/boot/efi" ]]; then
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION} == "fat32" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${DEVICE_UUID} ${KEY} vfat umask=0077 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${DEVICE_UUID} ${KEY} vfat umask=0077 0 2'."
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${KEY}'."
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid '${KEY}' for '/', '/boot', '/boot/efi' found."
|
||||
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
# Generate '${TARGET}/etc/fstab' remaining entries
|
||||
for KEY in "${!MAP_MOUNTPATH_DEV[@]}"; do
|
||||
|
||||
# Initialize variables
|
||||
DEVICE_PATH="${MAP_MOUNTPATH_DEV[${KEY}]}"
|
||||
DEVICE_UUID=$(blkid -s UUID -o value "${DEVICE_PATH}")
|
||||
|
||||
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
|
||||
if [[ ${DEVICE_PATH} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
|
||||
|
||||
TRANSFORMED_STRING=$(echo "${DEVICE_PATH}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
|
||||
|
||||
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
|
||||
elif [[ ${DEVICE_PATH} =~ ^/dev/mapper/ ]]; then
|
||||
|
||||
# Extract ENCRYPTION_LABEL
|
||||
ENCRYPTION_LABEL="${DEVICE_PATH#/dev/mapper/}"
|
||||
|
||||
# Search matching variable of a sourced "${PRESEED}" variable file
|
||||
MATCHING_VAR=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${ENCRYPTION_LABEL}")
|
||||
|
||||
if [[ -n ${MATCHING_VAR} ]]; then
|
||||
|
||||
# Extract third, fourth and fifth part of the respective variable
|
||||
TRANSFORMED_STRING=$(echo "${MATCHING_VAR}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${ENCRYPTION_LABEL}'."
|
||||
exit "${ERR_NO_ENCR_LABEL}"
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${DEVICE_PATH}'."
|
||||
exit "${ERR_NO_DEVIC_PATH}"
|
||||
|
||||
fi
|
||||
|
||||
declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_compress"
|
||||
declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_btrfs_level"
|
||||
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_label"
|
||||
declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_filesystem_version"
|
||||
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_options"
|
||||
declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${TRANSFORMED_STRING}_mount_subvolume"
|
||||
|
||||
declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
|
||||
declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
|
||||
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
|
||||
declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
|
||||
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
|
||||
declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
|
||||
|
||||
# Skip already mounted paths ("/", "/boot", "/boot/efi")
|
||||
if [[ " ${KEY_ORDER[*]} " == *" ${KEY} "* ]]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [[ ${FILESYSTEM_VERSION} == "btrfs" ]]; then
|
||||
|
||||
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS},${BTRFS_OPTIONS},subvol=${MOUNT_SUBVOLUME} 0 2'."
|
||||
|
||||
elif [[ ${FILESYSTEM_VERSION} == "ext4" ]]; then
|
||||
|
||||
# shellcheck disable=2129
|
||||
echo "# ${KEY} was on ${MAP_MOUNTPATH_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "# ${KEY} was on ${DEVICE_UUID} during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'UUID=${DEVICE_UUID} ${KEY} ${FILESYSTEM_VERSION} ${MOUNT_OPTIONS} 0 2'."
|
||||
|
||||
else
|
||||
|
||||
do_log "error" "false" "fstab entry - no valid filesystem: '${FILESYSTEM_VERSION}' found for '${KEY}'."
|
||||
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
# TODO: flexible entries for more than one CD-ROM drives.
|
||||
# Add entry for CD-ROM device
|
||||
# shellcheck disable=2129
|
||||
echo "# /media/cdrom0 was on /dev/sr0 during installation" >> "${TARGET}"/etc/fstab
|
||||
echo "/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: '/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0'."
|
||||
|
||||
# Add entry for proc and tmpfs device
|
||||
# shellcheck disable=2129
|
||||
echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
|
||||
echo "proc /proc proc nodev,nosuid,noexec,hidepid=2 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,relatime,size=1G 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: 'proc /proc proc nodev,nosuid,noexec,hidepid=2 0 0'."
|
||||
do_log "info" "false" "fstab entry generated: 'tmpfs /dev/shm tmpfs rw,nodev,nosuid,noexec,relatime,size=1G 0 0'."
|
||||
|
||||
# TODO: flexible 'SWAP' entry, not only ephemeral SWAP.
|
||||
# Add entry for SWAP device
|
||||
declare MOUNT_PATH="SWAP"
|
||||
# shellcheck disable=2129
|
||||
echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
|
||||
echo "${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} none swap defaults 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: '${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} none swap defaults 0 0'."
|
||||
|
||||
# TODO: flexible '/tmp' entry, not only ephemeral SWAP.
|
||||
# Add entry for '/tmp' device
|
||||
declare MOUNT_PATH="/tmp"
|
||||
# shellcheck disable=2129
|
||||
echo "##### Added by CISS.2025.debian.installer" >> "${TARGET}"/etc/fstab
|
||||
echo "${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} /tmp ext4 defaults,rw,nodev,nosuid,relatime 0 0" >> "${TARGET}"/etc/fstab
|
||||
echo "" >> "${TARGET}"/etc/fstab
|
||||
do_log "info" "false" "fstab entry generated: '${MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]} /tmp ext4 defaults,rw,nodev,nosuid,relatime 0 0'."
|
||||
|
||||
do_show_footer "${MODULE_TXT}"
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
|
||||
Reference in New Issue
Block a user