msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-07-29 12:54:50 +02:00
parent e9f3297cd1
commit f4fb74f689
16 changed files with 994 additions and 341 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
func/system/4040_generate_fstab.sh
View File

@@ -13,7 +13,7 @@
guard_sourcing
#######################################
# '/etc/fstab' entry writer and logger.
# Wrapper to write '/etc/fstab' entries.
# Globals:
# TARGET
# Arguments:
@@ -26,9 +26,9 @@ guard_sourcing
# 0: on success
#######################################
write_fstab() {
declare _uuid="$1" _path="$2" _fs="$3" _opts="$4" _pass="$5"
printf "%-43s%-28s%-8s%-74s0 %s\n" "UUID=${_uuid}" "${_path}" "${_fs}" "${_opts}" "${_pass}" >> "${TARGET}/etc/fstab"
do_log "info" "file_only" "4040() fstab entry generated: [UUID=${_uuid} ${_path} ${_fs} ${_opts} 0 ${_pass}]."
declare write_uuid="$1" write_path="$2" write_type="$3" write_opts="$4" write_pass="$5"
printf "%-43s%-28s%-8s%-74s0 %s\n" "UUID=${write_uuid}" "${write_path}" "${write_type}" "${write_opts}" "${write_pass}" >> "${TARGET}/etc/fstab"
do_log "info" "file_only" "4040() fstab entry generated: [UUID=${write_uuid} ${write_path} ${write_type} ${write_opts} 0 ${write_pass}]."
return 0
}
@@ -63,7 +63,7 @@ generate_fstab() {
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# /etc/fstab: static file system information.
# Static file system information '/etc/fstab'.
#
# Use 'blkid' to print the universally unique identifier for a device; this may be used with [UUID=] as a more robust way to
# name devices that work even if disks are added and removed. See fstab(5).
@@ -71,28 +71,40 @@ generate_fstab() {
# 'systemd' generates mount units based on this file. See systemd.mount(5). Please run 'systemctl daemon-reload' after making
# changes here.
#
# <file system> <mount point> <type> <options> <dump> <pass>
# <file system UUID> <mount point> <type> <options> <dump> <pass>
### Secure tmpfs mounts for a hardened system
# Mount the proc filesystem to provide process and kernel information
proc /proc proc nodev,nosuid,noexec,hidepid=2 0 0
proc /proc proc nodev,nosuid,noexec,hidepid=2 0 0
# Mount sysfs to expose kernel device information to user space
sysfs /sys sysfs defaults 0 0
sysfs /sys sysfs defaults 0 0
# Mount the devpts filesystem to enable pseudo-terminal support for user sessions
devpts /dev/pts devpts gid=5,mode=620 0 0
devpts /dev/pts devpts gid=5,mode=620 0 0
# Restrict /dev/shm to shared memory, limit size, prevent code execution
tmpfs /dev/shm tmpfs rw,nodev,noexec,nosuid,relatime,size=1G 0 0
tmpfs /dev/shm tmpfs rw,nodev,noexec,nosuid,relatime,size=1G 0 0
# System runtime directory in RAM; do not set noexec here for compatibility
tmpfs /run tmpfs mode=0755,nodev,nosuid 0 0
tmpfs /run tmpfs mode=0755,nodev,nosuid 0 0
EOF
### Generate '${TARGET}/etc/fstab' special entries '/' '/boot' '/boot/efi'.
### Define the order of the special paths.
declare -a ary_path_order; ary_path_order=("/" "/boot" "/boot/efi")
declare -a ary_path_order=("/" "/boot" "/boot/efi")
declare -a ary_skip=("/" "/boot" "/boot/efi" "/recovery")
declare var_path="" var_fs_uuid="" var_fs_path="" var_fs_type="" var_fs_opts=""
for var_path in "${ary_path_order[@]}"; do
var_fs_uuid="${HMP_PATH_FSUUID["${var_path}"]}"
var_fs_path="${var_path}"
var_fs_type="${HMP_FSTAB_MOUNT_FTYPE["${var_path}"]}"
var_fs_opts="${HMP_FSTAB_MOUNT_OPTS["${var_path}"]}"
done
declare var_path var_entry var_part var_dev var_key var_uuid var_fs_btrfs_compress var_fs_btrfs_level var_fs_btrfs_subvolume \
var_fs_version var_mount_options var_mount_optsnap var_btrfs_compression
@@ -104,6 +116,9 @@ EOF
continue
fi
var_part=$(echo "${var_entry}" | yq e 'path | .[-2]' -)
var_dev=$(echo "${var_entry}" | yq e 'path | .[-3]' -)
var_key="UUID_${var_path}"
@@ -154,6 +169,10 @@ EOF
done
for var_path in "${ARY_FSTAB_MOUNT_PATHS[@]}"; do
:
done
### Generate '${TARGET}/etc/fstab' remaining entries.
for var_path in "${!MAP_MOUNTPATH_DEV[@]}"; do

4
func/system/4150_setup_grub.sh
View File

@@ -204,7 +204,7 @@ EOF
# Detects and collects all boot devices for GRUB installation.
# Supports /dev/sdX, /dev/vdX, /dev/hdX, /dev/nvmeXn1, /dev/mmcblkX.
# Globals:
# VAR_RECIPE_DEV_COUNTER
# VAR_RECIPE_HIGHEST_DEVICE
# ary_bootdev_all
# grub_bootdev
# Arguments:
@@ -223,7 +223,7 @@ get_all_boot_devs() {
case "${dev_prefix}" in
sd|vd|hd)
ascii_start=$(printf '%d' "'a")
ascii_end=$(printf '%d' "'${VAR_RECIPE_DEV_COUNTER}")
ascii_end=$(printf '%d' "'${VAR_RECIPE_HIGHEST_DEVICE}")
for ((ascii = ascii_start; ascii <= ascii_end; ascii++)); do
letter=$(printf "%b" "\\$(printf '%03o' "${ascii}")")
dev_path="/dev/${dev_prefix}${letter}"