msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-07-29 12:54:50 +02:00
parent e9f3297cd1
commit f4fb74f689
16 changed files with 994 additions and 341 deletions
Download Patch File Download Diff File Expand all files Collapse all files

164
.archive/func/1251_yaml_reader_highest_device.sh Normal file
View File

@@ -0,0 +1,164 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
guard_sourcing
#######################################
# Reading and extracting variables from "${PRESEED}".
# Globals:
# HMP_RECIPE_DEV_PARTITIONS
# VAR_ARCHITECTURE
# VAR_NUKE
# VAR_PRESEED
# VAR_RECIPE_FIRMWARE
# VAR_RECIPE_HIGHEST_DEVICE
# VAR_RECIPE_STRING
# VAR_RECIPE_TABLE
# architecture
# Arguments:
# None
# Returns:
# 0: on success
# ERR_NO_VALID_RECIPE
#######################################
yaml_reader() {
### Declare Arrays, HashMaps, and Variables.
declare -Ag HMP_RECIPE_DEV_PARTITIONS=()
declare -gx VAR_RECIPE_STRING="" VAR_RECIPE_HIGHEST_DEVICE="" VAR_ARCHITECTURE="" VAR_RECIPE_FIRMWARE="" VAR_NUKE="" \
VAR_RECIPE_TABLE=""
### Declare and substitute input files
declare -r var_if="${VAR_PRESEED}"
### Search pattern for variables (recipe_<string>_active='true')
declare -r var_search_pattern="^recipe_.*_active='true'"
declare var_line="" var_middle_part="" var_highest_dev="" var_device="" var_fields="" var_partition="" \
recipe_firmware_var="" recipe_nuke_var="" recipe_table_var=""
### Read "${var_if}" line by line
while IFS= read -r var_line; do
### Check, if line matches the search pattern
if [[ "${var_line}" =~ ^recipe_([^_]+)_active=\'true\' ]]; then
var_middle_part="${BASH_REMATCH[1]}"
VAR_RECIPE_STRING="${var_middle_part}"
break
fi
#if [[ "${var_line}" =~ ${var_search_pattern} ]]; then
# ### Extract the middle part or second position
# var_middle_part=$(echo "${var_line}" | sed -E "s/^recipe_([^_]+)_active='true'/\1/")
# VAR_RECIPE_STRING="${var_middle_part}"
# ### Exit after first occurrence
# break
#fi
done < "${var_if}"
if [[ -n "${VAR_RECIPE_STRING}" ]]; then
do_log "info" "file_only" "1251() Found active recipe string: '${VAR_RECIPE_STRING}'."
else
do_log "fatal" "file_only" "1251() Found NO active recipe string: '${VAR_RECIPE_STRING}'."
exit "${ERR_NO_VALID_RECIPE}"
fi
### Search "${var_if}" for matching recipe_${VAR_RECIPE_STRING}_dev_* entries and find the highest dev letter.
# shellcheck disable=SC2312
var_highest_dev=$(grep -E "^recipe_${VAR_RECIPE_STRING}_dev_" "${var_if}" | awk -F'_' '
{
if (NF >= 4) {
### Extract 4th position (e.g., "recipe_${VAR_RECIPE_STRING}_dev_sda" or "recipe_${VAR_RECIPE_STRING}_dev_vda")
device_field = $4
### Check, if field is at least 3 char wide and last char contains a letter
if (length(device_field) >= 3) {
last_char = substr(device_field, length(device_field), 1) ### Extract last letter of respective field
if (last_char ~ /^[a-z]$/ && last_char > max) {
max = last_char
}
}
}
}
END { print max }
')
### Save the result in VAR_RECIPE_HIGHEST_DEVICE.
VAR_RECIPE_HIGHEST_DEVICE="${var_highest_dev}"
if [[ -n "${VAR_RECIPE_HIGHEST_DEVICE}" ]]; then
do_log "info" "file_only" "1251() Found highest recipe device: '${VAR_RECIPE_HIGHEST_DEVICE}'."
else
do_log "fatal" "file_only" "1251() Found NO highest recipe device: '${VAR_RECIPE_HIGHEST_DEVICE}'."
exit "${ERR_NO_VALID_RECIPE}"
fi
### Read var_if and iterate through all matching entries without executing in a subshell
# shellcheck disable=SC2312
while read -r var_line; do
### Extract fields of line
IFS='_' read -ra var_fields <<< "${var_line}"
### Check that enough fields are available
if [[ "${#var_fields[@]}" -ge 5 ]]; then
var_device="${var_fields[3]}" ### The fourth position includes the device (e.g., sda, vda, xvda)
var_partition="${var_fields[4]}" ### The fifth position includes the partition (e.g., 13)
### Check, if the partition is a number and higher than the current value
if [[ "${var_partition}" =~ ^[0-9]+$ ]]; then
declare -i cur="${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-0}"
if (( var_partition > cur )); then
#if [[ -z "${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-}" || "${var_partition}" -gt ${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-0} ]]; then
# shellcheck disable=SC2004
HMP_RECIPE_DEV_PARTITIONS[${var_device}]="${var_partition}"
fi
fi
fi
done < <(grep -E "^recipe_${VAR_RECIPE_STRING}_dev_" "${var_if}")
for var_device in "${!HMP_RECIPE_DEV_PARTITIONS[@]}"; do
do_log "info" "file_only" "1251() Highest number of partitions: [${var_device}:${HMP_RECIPE_DEV_PARTITIONS[${var_device}]}]."
done
### Extract architecture.
VAR_ARCHITECTURE="${architecture}"
### Extract chosen firmware.
recipe_firmware_var="recipe_${VAR_RECIPE_STRING}_control_firmware"
VAR_RECIPE_FIRMWARE="${!recipe_firmware_var}"
### Extract the chosen Nuke mechanism.
recipe_nuke_var="recipe_${VAR_RECIPE_STRING}_control_nuke"
VAR_NUKE="${!recipe_nuke_var}"
### Extract chosen partition table.
recipe_table_var="recipe_${VAR_RECIPE_STRING}_control_table"
VAR_RECIPE_TABLE="${!recipe_table_var}"
if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP 'EF00' necessary."
elif [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > BIOS Boot Partition 'EF02' necessary."
elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > No special firmware partition necessary."
fi
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

200
.archive/func/3220_partition_encryption_double_loop.sh Normal file
View File

@@ -0,0 +1,200 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
guard_sourcing
#######################################
# Function to encrypt the respective partition on each device according to the chosen recipe string.
# Globals:
# DIR_BAK
# DIR_CNF
# DIR_LOG
# HMP_EPHEMERAL_ENCLABEL
# HMP_EPHEMERAL_FS_LABEL
# HMP_PATH_ENCLABEL
# HMP_PATH_LUKSUUID
# VAR_CRYPT_RECOVERY
# VAR_CRYPT_ROOT
# VAR_ITER_TIME
# VAR_KDF_ITERATIONS
# VAR_KDF_MEMORY
# VAR_KDF_THREADS
# VAR_RECIPE_STRING
# VAR_SETUP_PART
# Arguments:
# None
# Returns:
# 0: on success
#######################################
partition_encryption() {
### Declare Arrays, HashMaps, and Variables.
declare -Ag HMP_PATH_LUKSUUID # Used in: 3290() - [Mount Path:LUKS UUID].
# Used in: 4060() - [Mount Path:LUKS UUID].
declare -Ag HMP_EPHEMERAL_ENCLABEL
declare -Ag HMP_EPHEMERAL_FS_LABEL
declare -Ag HMP_PATH_ENCLABEL
declare -gx VAR_CRYPT_ROOT="" # LUKS UUID of '/'.
declare -gx VAR_CRYPT_RECOVERY="" # LUKS UUID of '/recovery'.
declare var_dev="" var_part="" \
var_encryption_enable="" var_encryption_ephemeral="" var_encryption_integrity="" var_encryption_cipher="" \
var_encryption_hash="" var_encryption_key="" var_encryption_label="" var_encryption_meta="" var_encryption_slot="" \
var_encryption_pbkdf="" var_encryption_rng="" var_filesystem_label="" var_mount_path="" var_uuid="" var_fs=""
declare -a ary_devs=() ary_parts=() ary_luks_opts=()
### Iterate over all devices in the recipe.
# shellcheck disable=SC2312
readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
for var_dev in "${ary_devs[@]}"; do
touch "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
chmod 0600 "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
### Iterate over all partitions for this device.
# shellcheck disable=SC2312
readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
for var_part in "${ary_parts[@]}"; do
### Extract parameters from YAML.
var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
var_encryption_ephemeral=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.ephemeral" "${VAR_SETUP_PART}")
var_encryption_integrity=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.integrity" "${VAR_SETUP_PART}")
var_encryption_cipher=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.cipher" "${VAR_SETUP_PART}")
var_encryption_hash=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.hash" "${VAR_SETUP_PART}")
var_encryption_key=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.key" "${VAR_SETUP_PART}")
var_encryption_slot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.keyslotssize" "${VAR_SETUP_PART}")
var_encryption_meta=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.metadatasize" "${VAR_SETUP_PART}")
var_encryption_pbkdf=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdf" "${VAR_SETUP_PART}")
var_encryption_rng=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.rng" "${VAR_SETUP_PART}")
var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
if [[ "${var_encryption_enable,,}" != "true" ]]; then
continue
fi
var_encryption_label=$(get_label "${var_mount_path}" "${var_fs}" "luks")
if [[ "${var_mount_path,,}" == "/boot" ]]; then
ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_boot.txt" )
ary_luks_opts+=(
--iter-time "${VAR_ITER_TIME:-3000}"
)
else
ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_common.txt" )
ary_luks_opts+=(
--pbkdf-parallel "${VAR_KDF_THREADS:-1}"
--pbkdf-memory "${VAR_KDF_MEMORY:-4}"
--pbkdf-force-iterations "${VAR_KDF_ITERATIONS:-4}"
)
fi
ary_luks_opts+=(
--type luks2
--cipher "${var_encryption_cipher:-aes-xts-plain64}"
--hash "${var_encryption_hash:-sha512}"
--key-size "${var_encryption_key:-512}"
--label "${var_encryption_label}"
--luks2-keyslots-size "${var_encryption_slot:-16777216}"
--luks2-metadata-size "${var_encryption_meta:-4194304}"
--pbkdf "${var_encryption_pbkdf:-argon2id}"
"--${var_encryption_rng}"
--batch-mode
--verbose
)
[[ "${var_encryption_integrity,,}" == "true" ]] && ary_luks_opts+=( --integrity hmac-sha512 )
if [[ "${var_encryption_ephemeral,,}" == "true" ]]; then
case "${var_mount_path,,}" in
swap|/tmp)
var_filesystem_label=$(get_label "${var_mount_path}" "${var_fs}" "file")
mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
do_log "info" "file_only" "3220() Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."
HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]="${var_filesystem_label}"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]}'"
continue
;;
*)
do_log "error" "file_only" "3220() Invalid mount path: '${var_mount_path}' for partition: '/dev/${var_dev}${var_part}'."
continue
;;
esac
fi
cryptsetup luksFormat "${ary_luks_opts[@]}" "/dev/${var_dev}${var_part}"
if [[ "${var_encryption_integrity,,}" == "true" ]]; then
do_log "debug" "file_only" "3220() [cryptsetup luksFormat ${ary_luks_opts[*]} /dev/${var_dev}${var_part}]."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' dm-integrity encrypted."
else
do_log "debug" "file_only" "3220() [cryptsetup luksFormat ${ary_luks_opts[*]} /dev/${var_dev}${var_part}]."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' encrypted."
fi
cryptsetup luksHeaderBackup --header-backup-file="${DIR_BAK}/luks_header_${var_dev}${var_part}.bak" "/dev/${var_dev}${var_part}"
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
### Opening encrypted container.
if [[ "${var_mount_path,,}" == "/boot" ]]; then
cryptsetup luksOpen "/dev/${var_dev}${var_part}" \
--key-file="${DIR_CNF}/password_luks_boot.txt" \
"${var_encryption_label}"
else
cryptsetup luksOpen "/dev/${var_dev}${var_part}" \
--key-file="${DIR_CNF}/password_luks_common.txt" \
"${var_encryption_label}"
fi
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."
### Create luksDump log entry.
printf "#------------------------------------------------------------------#\n" >> "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
cryptsetup luksDump "/dev/${var_dev}${var_part}" >> "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
### Store UUID of the LUKS container.
var_uuid=$(blkid -s UUID -o value "/dev/${var_dev}${var_part}")
[[ "${var_mount_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
[[ "${var_mount_path}" == "/recovery" ]] && declare -grx VAR_CRYPT_RECOVERY="${var_uuid}"
HMP_PATH_LUKSUUID["${var_mount_path}"]="${var_uuid}"
HMP_PATH_ENCLABEL["LABEL_${var_mount_path}"]="${var_encryption_label}"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_PATH_LUKSUUID] : '${var_mount_path}' -> '${HMP_PATH_LUKSUUID["${var_mount_path}"]}'"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_PATH_ENCLABEL] : '${var_mount_path}' -> '${HMP_PATH_ENCLABEL["LABEL_${var_mount_path}"]}'"
done
done
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

138
.archive/func/3240_partition_formatting_double_loop.sh Normal file
View File

@@ -0,0 +1,138 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
guard_sourcing
#######################################
# Function to format the respective partition on each device according to the recipe string chosen.
# Globals:
# DIR_LOG
# HMP_PATH_FSUUID
# VAR_RECIPE_STRING
# VAR_SETUP_PART
# Arguments:
# None
# Returns:
# 0: on success
#######################################
partition_formatting() {
### Declare Arrays, HashMaps, and Variables.
declare -Ag HMP_PATH_FSUUID # Used in: 3290() - [Mount Path:Filesystem UUID].
# Used in: 4060() - [Mount Path:Filesystem UUID].
declare var_dev="" var_part="" \
var_encryption_enable="" var_encryption_label="" var_fs_btrfs_checksum="" var_fs_btrfs_compress="" var_fs_btrfs_mdup="" \
var_fs_format="" var_fs_label="" var_fs_options="" var_fs_version="" var_mount_path="" var_node="" var_fs_uuid=""
declare -a ary_devs=() ary_parts=() ary_opts=() ary_fmt_opts=()
### Iterate over all devices in the recipe.
# shellcheck disable=SC2312
readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
for var_dev in "${ary_devs[@]}"; do
### Iterate over all partitions for this device.
# shellcheck disable=SC2312
readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
for var_part in "${ary_parts[@]}"; do
### Extract parameters from YAML.
var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
var_fs_btrfs_checksum=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.checksum" "${VAR_SETUP_PART}")
var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
var_fs_btrfs_mdup=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.mdup" "${VAR_SETUP_PART}")
var_fs_format=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.format" "${VAR_SETUP_PART}")
var_fs_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.options" "${VAR_SETUP_PART}")
var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
[[ "${var_fs_format,,}" != "true" ]] && continue
### Preparation of Ephemeral 'SWAP' and '/tmp' as per https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption#UUID_and_LABEL
case "${var_mount_path,,}" in
swap|/tmp)
do_log "info" "file_only" "3240() Partition: '/dev/${var_dev}${var_part}' ephemeral encryption already prepared in 3220(): '${var_mount_path}'."
continue
;;
esac
if [[ "${var_encryption_enable,,}" == "true" ]]; then
var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
var_node="/dev/mapper/${var_encryption_label}"
else
var_node="/dev/${var_dev}${var_part}"
fi
var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
case "${var_fs_version,,}" in
btrfs)
ary_opts=( -L "${var_fs_label}" -f --csum "${var_fs_btrfs_checksum}" )
[[ "${var_fs_btrfs_mdup,,}" == "true" ]] && ary_opts+=( -m dup )
mkfs.btrfs "${ary_opts[@]}" "${var_node}"
do_log "debug" "file_only" "3240() [mkfs.btrfs ${ary_opts[*]} ${var_node}]."
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'btrfs' options: '${ary_opts[*]}'."
echo "Partition: '${var_node}':" >> "${DIR_LOG}/btrfs.log"
btrfs filesystem show "${var_node}" >> "${DIR_LOG}/btrfs.log"
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
### Gathering information for '/etc/fstab'-generation in 4040().
HMP_PATH_FSUUID["${var_mount_path}"]="${var_fs_uuid}"
;;
ext4)
read -r -a ary_fmt_opts <<< "${var_fs_options}"
mkfs.ext4 -L "${var_fs_label}" "${ary_fmt_opts[@]}" "${var_node}"
do_log "debug" "file_only" "3240() [mkfs.ext4 -L ${var_fs_label} ${ary_fmt_opts[*]} ${var_node}]."
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'ext4' options: '${ary_fmt_opts[*]}'."
echo "Partition: '${var_node}':" >> "${DIR_LOG}/ext4.log"
tune2fs -l "${var_node}" >> "${DIR_LOG}/ext4.log"
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
### Gathering information for '/etc/fstab'-generation in 4040().
HMP_PATH_FSUUID["${var_mount_path}"]="${var_fs_uuid}"
;;
fat32)
mkfs.fat -F 32 -n "${var_fs_label}" "${var_node}"
do_log "debug" "file_only" "3240() [mkfs.fat -F 32 -n ${var_fs_label} ${var_node}]."
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'FAT32'."
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
### Gathering information for '/etc/fstab'-generation in 4040().
HMP_PATH_FSUUID["${var_mount_path}"]="${var_fs_uuid}"
;;
*)
do_log "error" "file_only" "3240() Unsupported filesystem format: '${var_fs_version}'."
;;
esac
done
lsblk -o NAME,MAJ:MIN,FSTYPE,FSVER,SIZE,UUID,MOUNTPOINT,PATH "/dev/${var_dev}" >| "${DIR_LOG}/${var_dev}_overview.log"
printf "%b" "${NL}" >> "${DIR_LOG}/${var_dev}_overview.log"
lsblk "/dev/${var_dev}" >> "${DIR_LOG}/${var_dev}_overview.log"
done
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

34
func/helper/1250_yaml_parser.sh
View File

@@ -18,28 +18,32 @@ guard_sourcing
# ARY_BOOTPARAM
# ARY_NTPSRVR
# ARY_PACKAGES
# BASH_REMATCH
# DIR_CNF
# DIR_TMP
# VAR_PRESEED
# VAR_USER_MAX
# Arguments:
# None
# Returns:
# 0: on success
#######################################
yaml_parser() {
cat "${DIR_CNF}/preseed.yaml" "${DIR_CNF}/partitioning.yaml" >| "${DIR_TMP}/combined.yaml"
yq -o=shell "${DIR_TMP}/combined.yaml" >| "${VAR_PRESEED}"
### Declare Arrays, HashMaps, and Variables.
# shellcheck disable=SC2034
declare -ag ARY_BOOTPARAM=() ARY_NTPSRVR=() ARY_PACKAGES=()
declare -gix VAR_USER_MAX=0
declare var_index var_key var_value
declare var_index="" var_key="" var_value=""
cat "${DIR_CNF}/preseed.yaml" "${DIR_CNF}/partitioning.yaml" >| "${DIR_TMP}/combined.yaml"
yq -o=shell "${DIR_TMP}/combined.yaml" >| "${VAR_PRESEED}"
### Generate Arrays for Grub Parameter, NTPSec Server FQDN, Software Packages
while IFS='=' read -r var_key var_value; do
var_value=${var_value#\'}
var_value=${var_value%\'}
# shellcheck disable=SC2034
case "${var_key}" in
grub_parameter_[0-9]*) ARY_BOOTPARAM+=("${var_value}") ;;
ntp_server_[0-9]*) ARY_NTPSRVR+=("${var_value}") ;;
@@ -57,14 +61,24 @@ yaml_parser() {
done < <(compgen -v)
### Delete the respective 'key:value'-variables in the global variable set.
sed -i '/^grub_parameter_[0-9]\+=/d' "${VAR_PRESEED}"
sed -i '/^ntp_server_[0-9]\+=/d' "${VAR_PRESEED}"
sed -i '/^software_[0-9]\+=/d' "${VAR_PRESEED}"
### Substitute all key= by key=""
### Wrap each key=value by '' e.g., key='value'
awk '
/^grub_parameter_[0-9]+=|^ntp_server_[0-9]+=|^software_[0-9]+=/ { next }
/=\s*$/ { sub(/=\s*$/, "=\"\"") }
!/'"'"'/ && /=/ { sub(/=([^'\''\"]+)$/, "='\''\\1'\''") }
{ print }
' "${VAR_PRESEED}" >| "${VAR_PRESEED}.tmp" && mv -- "${VAR_PRESEED}.tmp" "${VAR_PRESEED}"
### Delete the respective 'key:value'-variables in the global variable set.
#sed -i '/^grub_parameter_[0-9]\+=/d' "${VAR_PRESEED}"
#sed -i '/^ntp_server_[0-9]\+=/d' "${VAR_PRESEED}"
#sed -i '/^software_[0-9]\+=/d' "${VAR_PRESEED}"
### Substitute all key= by key=""
sed -i -E 's/^(.*)=\s*$/\1=""/' "${VAR_PRESEED}"
#sed -i -E 's/^(.*)=\s*$/\1=""/' "${VAR_PRESEED}"
### Wrap each key=value by '' e.g., key='value'
sed -i -E "s/^(.*)=([^'\"]+)$/\1='\2'/" "${VAR_PRESEED}"
#sed -i -E "s/^(.*)=([^'\"]+)$/\1='\2'/" "${VAR_PRESEED}"
# shellcheck disable=SC1090
. "${VAR_PRESEED}"

89
func/helper/1251_yaml_reader.sh
View File

@@ -15,49 +15,59 @@ guard_sourcing
#######################################
# Reading and extracting variables from "${PRESEED}".
# Globals:
# ERR_NO_VALID_RECIPE
# HMP_RECIPE_DEV_PARTITIONS
# VAR_ARCHITECTURE
# VAR_NUKE
# VAR_PRESEED
# VAR_RECIPE_DEV_COUNTER
# VAR_RECIPE_FIRMWARE
# VAR_RECIPE_HIGHEST_DEVICE
# VAR_RECIPE_STRING
# VAR_RECIPE_TABLE
# architecture
# Arguments:
# None
# Returns:
# 0: on success
# ERR_NO_VALID_RECIPE
#######################################
yaml_reader() {
### Declare Arrays, HashMaps, and Variables.
declare -Ag HMP_RECIPE_DEV_PARTITIONS=()
declare -gx VAR_RECIPE_STRING="" VAR_RECIPE_HIGHEST_DEVICE="" VAR_ARCHITECTURE="" VAR_RECIPE_FIRMWARE="" VAR_NUKE="" \
VAR_RECIPE_TABLE=""
### Declare and substitute input files
declare -r var_if="${VAR_PRESEED}"
### Search pattern for variables (recipe_<string>_active='true')
declare -r var_search_pattern="^recipe_.*_active='true'"
declare var_line="" var_middle_part="" var_highest_dev="" var_device="" var_fields="" var_partition="" \
recipe_firmware_var="" recipe_nuke_var="" recipe_table_var=""
declare var_line=""
declare var_middle_part=""
### Read "${var_if}" line by line
while IFS= read -r var_line; do
### Check, if line matches the search pattern
if [[ "${var_line}" =~ ${var_search_pattern} ]]; then
### Extract the middle part or second position
var_middle_part=$(echo "${var_line}" | sed -E "s/^recipe_([^_]+)_active='true'/\1/")
declare -gx VAR_RECIPE_STRING="${var_middle_part}"
### Exit after first occurrence
if [[ "${var_line}" =~ ^recipe_([^_]+)_active=\'true\' ]]; then
var_middle_part="${BASH_REMATCH[1]}"
VAR_RECIPE_STRING="${var_middle_part}"
break
fi
#if [[ "${var_line}" =~ ${var_search_pattern} ]]; then
# ### Extract the middle part or second position
# var_middle_part=$(echo "${var_line}" | sed -E "s/^recipe_([^_]+)_active='true'/\1/")
# VAR_RECIPE_STRING="${var_middle_part}"
# ### Exit after first occurrence
# break
#fi
done < "${var_if}"
if [[ -n "${VAR_RECIPE_STRING}" ]]; then
do_log "info" "file_only" "Found active recipe string: '${VAR_RECIPE_STRING}'."
do_log "info" "file_only" "1251() Found active recipe string: '${VAR_RECIPE_STRING}'."
else
do_log "fatal" "file_only" "Found NO active recipe string: '${VAR_RECIPE_STRING}'."
do_log "fatal" "file_only" "1251() Found NO active recipe string: '${VAR_RECIPE_STRING}'."
exit "${ERR_NO_VALID_RECIPE}"
fi
### Variable for highest device count e.g., /dev/sdf = "f"
declare var_highest_dev
### Search "${var_if}" for matching recipe_${VAR_RECIPE_STRING}_dev_* entries and find the highest dev letter
### Search "${var_if}" for matching recipe_${VAR_RECIPE_STRING}_dev_* entries and find the highest dev letter.
# shellcheck disable=SC2312
var_highest_dev=$(grep -E "^recipe_${VAR_RECIPE_STRING}_dev_" "${var_if}" | awk -F'_' '
{
@@ -76,19 +86,16 @@ yaml_reader() {
END { print max }
')
### Save the result in VAR_RECIPE_DEV_COUNTER
declare -gx VAR_RECIPE_DEV_COUNTER="${var_highest_dev}"
### Save the result in VAR_RECIPE_HIGHEST_DEVICE.
VAR_RECIPE_HIGHEST_DEVICE="${var_highest_dev}"
if [[ -n "${VAR_RECIPE_DEV_COUNTER}" ]]; then
do_log "info" "file_only" "Found highest recipe device: '${VAR_RECIPE_DEV_COUNTER}'."
if [[ -n "${VAR_RECIPE_HIGHEST_DEVICE}" ]]; then
do_log "info" "file_only" "1251() Found highest recipe device: '${VAR_RECIPE_HIGHEST_DEVICE}'."
else
do_log "fatal" "file_only" "Found NO highest recipe device: '${VAR_RECIPE_DEV_COUNTER}'."
do_log "fatal" "file_only" "1251() Found NO highest recipe device: '${VAR_RECIPE_HIGHEST_DEVICE}'."
exit "${ERR_NO_VALID_RECIPE}"
fi
declare var_device="" var_fields="" var_line="" var_partition=""
declare -Ag HMP_RECIPE_DEV_PARTITIONS=()
### Read var_if and iterate through all matching entries without executing in a subshell
# shellcheck disable=SC2312
while read -r var_line; do
@@ -102,8 +109,10 @@ END { print max }
### Check, if the partition is a number and higher than the current value
if [[ "${var_partition}" =~ ^[0-9]+$ ]]; then
declare -i cur="${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-0}"
if (( var_partition > cur )); then
if [[ -z "${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-}" || "${var_partition}" -gt ${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-0} ]]; then
#if [[ -z "${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-}" || "${var_partition}" -gt ${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-0} ]]; then
# shellcheck disable=SC2004
HMP_RECIPE_DEV_PARTITIONS[${var_device}]="${var_partition}"
fi
@@ -114,39 +123,39 @@ END { print max }
done < <(grep -E "^recipe_${VAR_RECIPE_STRING}_dev_" "${var_if}")
for var_device in "${!HMP_RECIPE_DEV_PARTITIONS[@]}"; do
do_log "info" "file_only" "Highest number of partitions: [${var_device}:${HMP_RECIPE_DEV_PARTITIONS[${var_device}]}]."
do_log "info" "file_only" "1251() Highest number of partitions: [${var_device}:${HMP_RECIPE_DEV_PARTITIONS[${var_device}]}]."
done
### Extract architecture
declare -gx VAR_ARCHITECTURE="${architecture}"
### Extract architecture.
VAR_ARCHITECTURE="${architecture}"
### Extract chosen firmware
declare recipe_firmware_var="recipe_${VAR_RECIPE_STRING}_control_firmware"
declare -gx VAR_RECIPE_FIRMWARE="${!recipe_firmware_var}"
### Extract chosen firmware.
recipe_firmware_var="recipe_${VAR_RECIPE_STRING}_control_firmware"
VAR_RECIPE_FIRMWARE="${!recipe_firmware_var}"
### Extract the chosen Nuke mechanism
declare recipe_nuke_var="recipe_${VAR_RECIPE_STRING}_control_nuke"
declare -gx VAR_NUKE="${!recipe_nuke_var}"
### Extract the chosen Nuke mechanism.
recipe_nuke_var="recipe_${VAR_RECIPE_STRING}_control_nuke"
VAR_NUKE="${!recipe_nuke_var}"
### Extract chosen partition table
declare recipe_table_var="recipe_${VAR_RECIPE_STRING}_control_table"
declare -gx VAR_RECIPE_TABLE="${!recipe_table_var}"
### Extract chosen partition table.
recipe_table_var="recipe_${VAR_RECIPE_STRING}_control_table"
VAR_RECIPE_TABLE="${!recipe_table_var}"
if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
do_log "info" "file_only" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP 'EF00' necessary."
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP 'EF00' necessary."
elif [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
do_log "info" "file_only" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > BIOS Boot Partition 'EF02' necessary."
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > BIOS Boot Partition 'EF02' necessary."
elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
do_log "info" "file_only" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
do_log "info" "file_only" "Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > No special firmware partition necessary."
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > No special firmware partition necessary."
fi

67
func/partitioning/3200_partitioning.sh
View File

@@ -20,9 +20,14 @@ guard_sourcing
#######################################
#######################################
# Function that generates each partition on each device according to the chosen recipe string.
# Function that generates each partition on each device according to the chosen recipe string and collects information about:
# - the mount path and whether to mount or not and in which order mounting must be done.
# - LUKS encryption enabled.
# - Specific device partition data for each mount path.
# Globals:
# ARY_FSTAB_MOUNT_PATHS
# DIR_LOG
# HMP_FSTAB_MOUNT_FTYPE
# HMP_PATH_PARTUUID
# VAR_RECIPE_FIRMWARE
# VAR_RECIPE_STRING
@@ -39,10 +44,22 @@ guard_sourcing
# 0: on success
#######################################
partitioning() {
### Declare Arrays and Variables.
declare -Ag HMP_PATH_PARTUUID
declare var_dev var_part var_end_arg var_begin var_end var_fs var_boot var_pri var_uuid var_mount_path var_label var_end_mib
declare -a ary_devs ary_parts
### Declare Arrays, HashMaps, and Variables.
declare -Ag HMP_PATH_PARTUUID # Used in: 3290() - [Mount Path:Partition UUID].
declare -Ag HMP_FSTAB_MOUNT_FTYPE # Used in: 4040() - [Mount Path:Filesystem type].
declare -Ag HMP_PATH_DEV_PART # Used in: 3220() - [Mount Path:DEV.PARTITION].
# Used in: 3240() - [Mount Path:DEV.PARTITION].
declare -ag ARY_CRYPT_MOUNT_PATHS=() # Used in: 3220() - Only entries [/paths] for encryption.
declare -ag ARY_FORMT_MOUNT_PATHS=() # Used in: 3240() - Only entries [/paths] for filesystem generation.
declare -ag ARY_FSTAB_MOUNT_PATHS=() # Used in: 4040() - Only entries [/paths] for '/etc/fstab' generation.
declare -ag ARY_PATHS_SORTED=() # Used in: - All entries [/paths] in a mount ordering scheme.
declare var_dev="" var_part="" \
var_begin="" var_boot="" var_encryption="" var_end="" var_end_arg="" var_end_mib="" var_format="" var_fs="" var_label="" \
var_mount_path="" var_mount_true="" var_pri="" var_uuid=""
declare -a ary_devs=() ary_parts=() ary_paths_unsorted=()
declare -i i=0 var_dev_size=0 var_dev_end=0
### Iterate over all devices in the recipe.
@@ -57,10 +74,12 @@ partitioning() {
if command -v sgdisk >/dev/null && sgdisk --zap-all "/dev/${var_dev}"; then
do_log "debug" "file_only" "3200() [command -v sgdisk >/dev/null && sgdisk --zap-all]."
do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' wiped with 'sgdisk --zap-all'."
elif dd if=/dev/zero of="/dev/${var_dev}" bs=1M count=8 status=none; then
do_log "debug" "file_only" "3200() [dd if=/dev/zero of=/dev/${var_dev} bs=1M count=8 status=none]."
do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' overwritten with zeros."
else
@@ -72,7 +91,7 @@ partitioning() {
else
do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' discarded (blkdiscard)."
do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' discarded [blkdiscard -f /dev/${var_dev}]."
fi
@@ -106,9 +125,12 @@ partitioning() {
var_begin=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.begin" "${VAR_SETUP_PART}")
var_end=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.end" "${VAR_SETUP_PART}")
var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_format=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.format" "${VAR_SETUP_PART}")
var_boot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.bootable" "${VAR_SETUP_PART}")
var_pri=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.primary" "${VAR_SETUP_PART}")
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
var_mount_true=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.enable" "${VAR_SETUP_PART}")
var_encryption=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
### Assign the start zone of the first partition and skip the first 2 MiB as best practice.
if [[ "${var_begin,,}" == "min" ]]; then
@@ -215,9 +237,33 @@ partitioning() {
do_log "fatal" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' could not read PARTUUID."
return "${ERR_PART_READ}"
else
HMP_PATH_PARTUUID["PARTUUID_${var_mount_path}"]="${var_uuid}"
HMP_PATH_PARTUUID["${var_mount_path}"]="${var_uuid}"
do_log "debug" "file_only" "3200() Stored in HashMap [HMP_PATH_PARTUUID] : '${var_mount_path}' -> '${HMP_PATH_PARTUUID["${var_mount_path}"]}'."
fi
### Gathering information for encryption module 3220().
if [[ "${var_encryption}" == "true" ]]; then
ARY_CRYPT_MOUNT_PATHS+=("${var_mount_path}")
fi
### Gathering information for filesystem module 3240().
if [[ "${var_format}" == "true" ]]; then
ARY_FORMT_MOUNT_PATHS+=("${var_mount_path}")
fi
### Gathering information for mounting module 3280().
HMP_PATH_DEV_PART["${var_mount_path}"]="${var_dev}.${var_part}"
ary_paths_unsorted+=("${var_mount_path}")
### Gathering information for '/etc/fstab'-generation in 4040().
if [[ "${var_mount_true}" == "true" ]]; then
ARY_FSTAB_MOUNT_PATHS+=("${var_mount_path}")
do_log "debug" "file_only" "3200() Stored in Array [ARY_FSTAB_MOUNT_PATHS] : '${var_mount_path}'."
HMP_FSTAB_MOUNT_FTYPE["${var_mount_path}"]="${var_fs}"
do_log "debug" "file_only" "3200() Stored in HashMap [HMP_FSTAB_MOUNT_FTYPE] : '${var_mount_path}' -> '${HMP_FSTAB_MOUNT_FTYPE["${var_mount_path}"]}'."
fi
done
lsblk -o NAME,START,SIZE,PHY-SEC,LOG-SEC,ALIGNMENT "/dev/${var_dev}" >| "${DIR_LOG}/${var_dev}_alignment.log"
@@ -225,6 +271,13 @@ partitioning() {
done
### Prepare mount ordering scheme.
# shellcheck disable=SC2312
IFS=$'\n' read -r -d '' -a ARY_PATHS_SORTED < <(printf "%s\n" "${ary_paths_unsorted[@]}" | sort -u | awk 'BEGIN{FS="/"}{print NF, $0}' | sort -n | cut -d' ' -f2- && printf '\0')
printf "%s\n" "${ary_paths_unsorted[@]}" >| "${DIR_LOG}/mount_paths_unsorted.log"
printf "%s\n" "${ARY_PATHS_SORTED[@]}" >| "${DIR_LOG}/mount_paths_sorted.log"
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

140
func/partitioning/3220_partition_encryption.sh
View File

@@ -13,14 +13,15 @@
guard_sourcing
#######################################
# Function to encrypt the respective partition on each device according to the chosen recipe string.
# Function to encrypt the respective partition on each entry of 'ARY_CRYPT_MOUNT_PATHS'.
# Globals:
# ARY_CRYPT_MOUNT_PATHS
# DIR_BAK
# DIR_CNF
# DIR_LOG
# HMP_EPHEMERAL_DEV
# HMP_EPHEMERAL_ENCLABEL
# HMP_EPHEMERAL_FS_LABEL
# HMP_PATH_DEV_PART
# HMP_PATH_ENCLABEL
# HMP_PATH_LUKSUUID
# VAR_CRYPT_RECOVERY
@@ -37,48 +38,45 @@ guard_sourcing
# 0: on success
#######################################
partition_encryption() {
### Declare Arrays and Variables.
declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_EPHEMERAL_FS_LABEL HMP_PATH_LUKSUUID HMP_PATH_ENCLABEL
declare var_dev var_part \
var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_cipher \
var_encryption_hash var_encryption_key var_encryption_label var_encryption_meta \
var_encryption_slot var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path var_uuid var_fs
declare -a ary_devs=() ary_parts=() ary_luks_opts=()
### Declare Arrays, HashMaps, and Variables.
declare -Ag HMP_PATH_LUKSUUID # Used in: 3290() - [Mount Path:LUKS UUID].
# Used in: 4060() - [Mount Path:LUKS UUID].
declare -Ag HMP_EPHEMERAL_ENCLABEL
declare -Ag HMP_EPHEMERAL_FS_LABEL
### Iterate over all devices in the recipe.
# shellcheck disable=SC2312
readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
for var_dev in "${ary_devs[@]}"; do
declare -Ag HMP_PATH_ENCLABEL
touch "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
chmod 0600 "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
declare -gx VAR_CRYPT_ROOT="" # LUKS UUID of '/'.
declare -gx VAR_CRYPT_RECOVERY="" # LUKS UUID of '/recovery'.
### Iterate over all partitions for this device.
# shellcheck disable=SC2312
readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
for var_part in "${ary_parts[@]}"; do
declare var_encryption_path="" var_dev_part="" \
var_encryption_ephemeral="" var_encryption_integrity="" var_encryption_cipher="" \
var_encryption_hash="" var_encryption_key="" var_encryption_label="" var_encryption_meta="" var_encryption_slot="" \
var_encryption_pbkdf="" var_encryption_rng="" var_filesystem_label="" var_mount_path="" var_uuid="" var_fs=""
declare -a ary_luks_opts=()
for var_encryption_path in "${ARY_CRYPT_MOUNT_PATHS[@]}"; do
### Generates physical device location.
var_dev_part="${HMP_PATH_DEV_PART[${var_encryption_path}]}"
### Extract parameters from YAML.
var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
var_encryption_ephemeral=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.ephemeral" "${VAR_SETUP_PART}")
var_encryption_integrity=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.integrity" "${VAR_SETUP_PART}")
var_encryption_cipher=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.cipher" "${VAR_SETUP_PART}")
var_encryption_hash=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.hash" "${VAR_SETUP_PART}")
var_encryption_key=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.key" "${VAR_SETUP_PART}")
var_encryption_slot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.keyslotssize" "${VAR_SETUP_PART}")
var_encryption_meta=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.metadatasize" "${VAR_SETUP_PART}")
var_encryption_pbkdf=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdf" "${VAR_SETUP_PART}")
var_encryption_rng=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.rng" "${VAR_SETUP_PART}")
var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
var_encryption_ephemeral=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.ephemeral" "${VAR_SETUP_PART}")
var_encryption_integrity=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.integrity" "${VAR_SETUP_PART}")
var_encryption_cipher=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.cipher" "${VAR_SETUP_PART}")
var_encryption_hash=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.hash" "${VAR_SETUP_PART}")
var_encryption_key=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.key" "${VAR_SETUP_PART}")
var_encryption_slot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.keyslotssize" "${VAR_SETUP_PART}")
var_encryption_meta=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.metadatasize" "${VAR_SETUP_PART}")
var_encryption_pbkdf=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.pbkdf" "${VAR_SETUP_PART}")
var_encryption_rng=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.encryption.rng" "${VAR_SETUP_PART}")
var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev_part}.mount.path" "${VAR_SETUP_PART}")
if [[ "${var_encryption_enable,,}" != "true" ]]; then
continue
fi
var_encryption_label=$(get_label "${var_encryption_path}" "${var_fs}" "luks")
var_encryption_label=$(get_label "${var_mount_path}" "${var_fs}" "luks")
if [[ "${var_mount_path,,}" == "/boot" ]]; then
if [[ "${var_encryption_path,,}" == "/boot" ]]; then
ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_boot.txt" )
ary_luks_opts+=(
--iter-time "${VAR_ITER_TIME:-3000}"
@@ -110,27 +108,30 @@ partition_encryption() {
if [[ "${var_encryption_ephemeral,,}" == "true" ]]; then
case "${var_mount_path}" in
case "${var_encryption_path,,}" in
SWAP|/tmp)
swap|/tmp)
var_filesystem_label=$(get_label "${var_mount_path}" "${var_fs}" "file")
var_filesystem_label=$(get_label "${var_encryption_path}" "${var_fs}" "file")
mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
do_log "info" "file_only" "3220() Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."
mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev_part}" 1M
do_log "info" "file_only" "3220() Ephemeral: '${var_encryption_path}' prepared on: '/dev/${var_dev_part}'."
HMP_EPHEMERAL_DEV["${var_mount_path}"]="/dev/${var_dev}${var_part}"
HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]="${var_filesystem_label}"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_DEV] : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]}'"
HMP_EPHEMERAL_ENCLABEL["${var_encryption_path}"]="${var_encryption_label}"
HMP_EPHEMERAL_FS_LABEL["${var_encryption_path}"]="${var_filesystem_label}"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_encryption_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_encryption_path}"]}'"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_encryption_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_encryption_path}"]}'"
### The setup of ephemeral devices MUST stop here.
continue
;;
*)
do_log "error" "file_only" "3220() Invalid mount path: '${var_mount_path}' for partition: '/dev/${var_dev}${var_part}'."
do_log "error" "file_only" "3220() Invalid mount path: '${var_encryption_path}' for partition: '/dev/${var_dev_part}'."
### There is no other need to implement ephemeral devices.
continue
;;
@@ -138,48 +139,49 @@ partition_encryption() {
fi
cryptsetup luksFormat "${ary_luks_opts[@]}" "/dev/${var_dev}${var_part}"
cryptsetup luksFormat "${ary_luks_opts[@]}" "/dev/${var_dev_part}"
if [[ "${var_encryption_integrity,,}" == "true" ]]; then
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' dm-integrity encrypted."
do_log "debug" "file_only" "3220() [cryptsetup luksFormat ${ary_luks_opts[*]} /dev/${var_dev_part}]."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev_part}' dm-integrity encrypted."
else
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' encrypted."
do_log "debug" "file_only" "3220() [cryptsetup luksFormat ${ary_luks_opts[*]} /dev/${var_dev_part}]."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev_part}' encrypted."
fi
cryptsetup luksHeaderBackup --header-backup-file="${DIR_BAK}/luks_header_${var_dev}${var_part}.bak" "/dev/${var_dev}${var_part}"
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
cryptsetup luksHeaderBackup --header-backup-file="${DIR_BAK}/luks_header_${var_dev_part}.bak" "/dev/${var_dev_part}"
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev_part}.bak'."
### Opening encrypted container.
if [[ "${var_mount_path,,}" == "/boot" ]]; then
cryptsetup luksOpen "/dev/${var_dev}${var_part}" \
if [[ "${var_encryption_path,,}" == "/boot" ]]; then
cryptsetup luksOpen "/dev/${var_dev_part}" \
--key-file="${DIR_CNF}/password_luks_boot.txt" \
"${var_encryption_label}"
else
cryptsetup luksOpen "/dev/${var_dev}${var_part}" \
cryptsetup luksOpen "/dev/${var_dev_part}" \
--key-file="${DIR_CNF}/password_luks_common.txt" \
"${var_encryption_label}"
fi
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev_part}' opened as '/dev/mapper/${var_encryption_label}'."
### Create luksDump log entry.
printf "#------------------------------------------------------------------#\n" >> "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
cryptsetup luksDump "/dev/${var_dev}${var_part}" >> "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
cryptsetup luksDump "/dev/${var_dev_part}" >> "${DIR_LOG}/cryptsetup_luksdump_${var_dev_part}.log"
### Store UUID of the LUKS container.
var_uuid=$(blkid -s UUID -o value "/dev/${var_dev}${var_part}")
# shellcheck disable=SC2155
[[ "${var_mount_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
[[ "${var_mount_path}" == "/recovery" ]] && declare -grx VAR_CRYPT_RECOVERY="${var_uuid}"
HMP_PATH_LUKSUUID["UUID_${var_mount_path}"]="${var_uuid}"
HMP_PATH_ENCLABEL["LABEL_${var_mount_path}"]="${var_encryption_label}"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_PATH_LUKSUUID] : '${var_mount_path}' -> '${HMP_PATH_LUKSUUID["UUID_${var_mount_path}"]}'"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_PATH_ENCLABEL] : '${var_mount_path}' -> '${HMP_PATH_ENCLABEL["LABEL_${var_mount_path}"]}'"
var_uuid=$(blkid -s UUID -o value "/dev/${var_dev_part}")
done
[[ "${var_encryption_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
[[ "${var_encryption_path}" == "/recovery" ]] && declare -grx VAR_CRYPT_RECOVERY="${var_uuid}"
HMP_PATH_LUKSUUID["${var_encryption_path}"]="${var_uuid}"
HMP_PATH_ENCLABEL["${var_encryption_path}"]="${var_encryption_label}"
do_log "debug" "file_only" "3220() [HMP_PATH_LUKSUUID] : '${var_encryption_path}' -> '${HMP_PATH_LUKSUUID["${var_encryption_path}"]}'"
do_log "debug" "file_only" "3220() [HMP_PATH_ENCLABEL] : '${var_encryption_path}' -> '${HMP_PATH_ENCLABEL["${var_encryption_path}"]}'"
done

55
func/partitioning/3240_partition_formatting.sh
View File

@@ -25,22 +25,21 @@ guard_sourcing
# 0: on success
#######################################
partition_formatting() {
### Declare Arrays and Variables.
declare -Ag HMP_PATH_FSUUID
declare var_dev var_part \
var_encryption_enable var_encryption_label var_fs_btrfs_checksum var_fs_btrfs_compress var_fs_btrfs_mdup \
var_fs_format var_fs_label var_fs_options var_fs_version var_mount_path var_node var_fs_uuid
declare -a ary_devs ary_parts ary_opts ary_fmt_opts
### Declare Arrays, HashMaps, and Variables.
declare -Ag HMP_PATH_FSUUID # Used in: 3290() - [Mount Path:Filesystem UUID].
# Used in: 4060() - [Mount Path:Filesystem UUID].
declare var_dev="" var_part="" \
var_encryption_enable="" var_encryption_label="" var_fs_btrfs_checksum="" var_fs_btrfs_compress="" var_fs_btrfs_mdup="" \
var_fs_format="" var_fs_label="" var_fs_options="" var_fs_version="" var_mount_path="" var_node="" var_fs_uuid=""
### Iterate over all devices in the recipe.
# shellcheck disable=SC2312
readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
for var_dev in "${ary_devs[@]}"; do
declare -a ary_devs=() ary_parts=() ary_opts=() ary_fmt_opts=()
### Iterate over all partitions for this device.
# shellcheck disable=SC2312
readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
for var_part in "${ary_parts[@]}"; do
for var_format_path in "${ARY_FORMT_MOUNT_PATHS[@]}"; do
### Generates physical device location.
var_dev_part="${HMP_PATH_DEV_PART[${var_format_path}]}"
### Extract parameters from YAML.
### Extract parameters from YAML.
var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
@@ -76,32 +75,45 @@ partition_formatting() {
btrfs)
ary_opts=( -L "${var_fs_label}" -f --csum "${var_fs_btrfs_checksum}" )
[[ "${var_fs_btrfs_mdup,,}" == "true" ]] && ary_opts+=( -m dup )
mkfs.btrfs "${ary_opts[@]}" "${var_node}"
do_log "debug" "file_only" "3240() [mkfs.btrfs ${ary_opts[*]} ${var_node}]."
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'btrfs' options: '${ary_opts[*]}'."
echo "Partition: '${var_node}':" >> "${DIR_LOG}/btrfs.log"
btrfs filesystem show "${var_node}" >> "${DIR_LOG}/btrfs.log"
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"
### Gathering information for '/etc/fstab'-generation in 4040().
HMP_PATH_FSUUID["${var_mount_path}"]="${var_fs_uuid}"
;;
ext4)
read -r -a ary_fmt_opts <<< "${var_fs_options}"
mkfs.ext4 -L "${var_fs_label}" "${ary_fmt_opts[@]}" "${var_node}"
do_log "debug" "file_only" "3240() [mkfs.ext4 -L ${var_fs_label} ${ary_fmt_opts[*]} ${var_node}]."
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'ext4' options: '${ary_fmt_opts[*]}'."
echo "Partition: '${var_node}':" >> "${DIR_LOG}/ext4.log"
tune2fs -l "${var_node}" >> "${DIR_LOG}/ext4.log"
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"
### Gathering information for '/etc/fstab'-generation in 4040().
HMP_PATH_FSUUID["${var_mount_path}"]="${var_fs_uuid}"
;;
fat32)
mkfs.fat -F 32 -n "${var_fs_label}" "${var_node}"
do_log "debug" "file_only" "3240() [mkfs.fat -F 32 -n ${var_fs_label} ${var_node}]."
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'FAT32'."
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"
### Gathering information for '/etc/fstab'-generation in 4040().
HMP_PATH_FSUUID["${var_mount_path}"]="${var_fs_uuid}"
;;
*)
@@ -112,7 +124,14 @@ partition_formatting() {
done
done
lsblk -o NAME,MAJ:MIN,FSTYPE,FSVER,SIZE,UUID,MOUNTPOINT,PATH "/dev/${var_dev}" >| "${DIR_LOG}/${var_dev}_overview.log"
printf "%b" "${NL}" >> "${DIR_LOG}/${var_dev}_overview.log"
lsblk "/dev/${var_dev}" >> "${DIR_LOG}/${var_dev}_overview.log"
return 0
}

13
func/partitioning/3260_setup_filesystem.sh
View File

@@ -24,9 +24,12 @@ guard_sourcing
# 0: on success
#######################################
setup_filesystem() {
### Declare Arrays and Variables.
declare -Ag HMP_MOUNTPATH_DEV
declare var_dev var_part var_encryption_enable var_encryption_label var_fs_version var_mount_enable var_mount_path var_node
### Declare Arrays, HashMaps, and Variables.
declare -Ag HMP_MOUNTPATH_DEV # HMP_MOUNTPATH_DEV["${var_mount_path}"]="${var_node}"
declare var_dev="" var_part="" \
var_encryption_enable="" var_encryption_label="" var_fs_version="" var_mount_enable="" var_mount_path="" var_node=""
declare -a ary_devs ary_parts
### Iterate over all devices in the recipe.
@@ -72,10 +75,6 @@ setup_filesystem() {
done
lsblk -o NAME,MAJ:MIN,FSTYPE,FSVER,SIZE,UUID,MOUNTPOINT,PATH "/dev/${var_dev}" >| "${DIR_LOG}/${var_dev}_overview.log"
printf "%b" "${NL}" >> "${DIR_LOG}/${var_dev}_overview.log"
lsblk "/dev/${var_dev}" >> "${DIR_LOG}/${var_dev}_overview.log"
done
return 0

132
func/partitioning/3280_mount_partition.sh
View File

@@ -22,13 +22,13 @@ guard_sourcing
#######################################
skip_path() {
declare -a ary_skip=( "/" "/boot" "/boot/efi" "/recovery" )
declare p
declare p=""
for p in "${ary_skip[@]}"; do [[ "$1" == "${p}" ]] && return 0; done
return 1
}
#######################################
# Function to create the mount path and mount the respective device on it.
# Function to create the mount command, incl. mount path and options, and mount the respective device.
# Globals:
# ERR_MOUNTING_DEV
# TARGET
@@ -36,23 +36,45 @@ skip_path() {
# 1: MOUNT_PATH
# 2: MOUNT_DEVICE
# 3: MOUNT_OPTIONS
# Returns:
# 0: on success
#######################################
mount_with_dir() {
declare var_mount_path="$1" var_mount_device="$2" var_mount_options="${3:-}"
declare -a ary_cmd=(mount)
if [[ "${var_mount_device}" =~ ^[0-9a-fA-F-]{8,}$ ]]; then
if [[ -e "/dev/disk/by-uuid/${var_mount_device}" ]]; then
var_mount_device="/dev/disk/by-uuid/${var_mount_device}"
else
do_log "error" "file_only" "3280() FS-UUID for mount path: '${var_mount_device}' not found by '/dev/disk/by-uuid/${var_mount_device}'."
return "${ERR_MOUNTING_DEV}"
fi
fi
[[ "${var_mount_path}" != "/" ]] && mkdir -p "${TARGET}${var_mount_path}"
### Build the command in an array to keep word boundaries intact
declare -a ary_cmd=(mount)
### Build the command in an array to keep word boundaries intact.
[[ -n "${var_mount_options}" ]] && ary_cmd+=("-o" "${var_mount_options}")
ary_cmd+=("${var_mount_device}" "${TARGET}${var_mount_path}")
safe_exec "${ary_cmd[@]}" "${ERR_MOUNTING_DEV}" || return
do_log "debug" "file_only" "3280() [safe_exec ${ary_cmd[*]} ${ERR_MOUNTING_DEV}]."
do_log "info" "file_only" "3280() Mounted: '${var_mount_device}' on: '${TARGET}${var_mount_path}' (Options='${var_mount_options}')."
return 0
}
#######################################
# Device Path Resolver
# Device Path Resolver.
# Outputs '/dev/mapper/<encryption_label>'
# Outputs '/dev/<dev><partition>'
# Arguments:
# 1: Device
# 2: Partition
@@ -81,7 +103,7 @@ validate_btrfs_compression() {
declare var_algo="$1" var_level="$2"
case "${var_algo}:${var_level}" in
zstd:|zstd:[0-9]|zstd:1[0-9]|zstd:2[0-2]|lzo:) return 0 ;;
*) do_log "error" "file_only" "3280() Invalid btrfs compression '${var_algo}:${var_level}'"; return "${ERR_BTRFS_OPTION}" ;;
*) do_log "error" "file_only" "3280() Invalid btrfs compression: '${var_algo}:${var_level}'"; return "${ERR_BTRFS_OPTION}" ;;
esac
}
@@ -96,50 +118,56 @@ validate_btrfs_compression() {
# Arguments:
# None
# Returns:
# 0: on success
# ERR_BTRFS_INITPH
# ERR_BTRFS_OPTION
# ERR_BTRFS_SUBVOL
# ERR_MOUNTING_DEV
# ERR_MOUNTING_ROOT
# 0: on success
#######################################
mount_partition() {
### Mount "/"-filesystem
### Declare Arrays, HashMaps, and Variables.
declare -Ag HMP_FSTAB_MOUNT_OPTS # Used in: 4040() - [Mount Path:Mount Options].
declare -r var_mount_path_root="/"
if [[ -n "${HMP_MOUNTPATH_DEV[${var_mount_path_root}]}" ]]; then
declare var_path="" var_dev="" var_part="" \
var_fs_btrfs_compress="" var_fs_btrfs_level="" var_fs_btrfs_subvolume="" var_fs_btrfs_snapshot="" \
var_encryption_enable="" var_encryption_label="" var_fs_options="" var_fs_version="" var_mount_path="" \
var_mount_options="" var_snapshot="" var_mount_optsnap="" var_fs_uuid=""
mount_with_dir "${var_mount_path_root}" "${HMP_MOUNTPATH_DEV[${var_mount_path_root}]}" || return "${ERR_MOUNTING_DEV}"
declare -a ary_devs=() ary_parts=()
### Mount "/"-filesystem
if [[ -n "${HMP_PATH_FSUUID["${var_mount_path_root}"]}" ]]; then
mount_with_dir "${var_mount_path_root}" "${HMP_PATH_FSUUID["${var_mount_path_root}"]}" || return "${ERR_MOUNTING_DEV}"
else
do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap: 'HMP_PATH_FSUUID'."
return "${ERR_MOUNTING_ROOT}"
fi
#if [[ -n "${HMP_MOUNTPATH_DEV[${var_mount_path_root}]}" ]]; then
# mount_with_dir "${var_mount_path_root}" "${HMP_MOUNTPATH_DEV[${var_mount_path_root}]}" || return "${ERR_MOUNTING_DEV}"
#else
# do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
# return "${ERR_MOUNTING_ROOT}"
#fi
### Ensure order of "/boot" and "/boot/efi"
declare var_path
for var_path in "/boot" "/boot/efi"; do
if [[ -n "${HMP_MOUNTPATH_DEV[${var_path}]}" ]]; then
mount_with_dir "${var_path}" "${HMP_MOUNTPATH_DEV[${var_path}]}" || return "${ERR_MOUNTING_DEV}"
if [[ -n "${HMP_PATH_FSUUID["${var_path}"]}" ]]; then
mount_with_dir "${var_path}" "${HMP_PATH_FSUUID["${var_path}"]}" || return "${ERR_MOUNTING_DEV}"
else
do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap: 'HMP_PATH_FSUUID'."
fi
done
declare var_dev var_part \
var_fs_btrfs_compress var_fs_btrfs_level var_fs_btrfs_subvolume var_fs_btrfs_snapshot \
var_encryption_enable var_encryption_label \
var_fs_label var_fs_options var_fs_version var_mount_path var_mount_options var_snapshot var_mount_optsnap
declare -a ary_devs ary_parts
#for var_path in "/boot" "/boot/efi"; do
# if [[ -n "${HMP_MOUNTPATH_DEV[${var_path}]}" ]]; then
# mount_with_dir "${var_path}" "${HMP_MOUNTPATH_DEV[${var_path}]}" || return "${ERR_MOUNTING_DEV}"
# else
# do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
# fi
#done
### Iterate over all devices in the recipe.
# shellcheck disable=SC2312
@@ -166,14 +194,16 @@ mount_partition() {
skip_path "${var_mount_path}" && continue
var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
var_fs_uuid="${HMP_PATH_FSUUID["${var_path}"]}"
if [[ "${var_mount_path}" == "SWAP" ]]; then
if [[ "${var_mount_path,,}" == "swap" ]]; then
var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
#var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
cryptsetup open --type plain --key-file /dev/random \
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
--sector-size 4096 "/dev/disk/by-uuid/${var_fs_uuid}" "${var_encryption_label}"
#--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
mkswap "/dev/mapper/${var_encryption_label}"
do_log "debug" "file_only" "3280() [mkswap /dev/mapper/${var_encryption_label}]."
@@ -184,27 +214,16 @@ mount_partition() {
continue
elif [[ "${var_mount_path}" == "/tmp" ]]; then
var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
elif [[ "${var_mount_path,,}" == "/tmp" ]]; then
cryptsetup open --type plain --key-file /dev/random \
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
--sector-size 4096 "/dev/disk/by-uuid/${var_fs_uuid}" "${var_encryption_label}"
mkdir -p "${TARGET}/tmp"
# TODO: Remove Debug
#[[ -b "/dev/mapper/${var_encryption_label}" ]] || {
# do_log "error" "file_only" "Mapper-Device: '/dev/mapper/${var_encryption_label}' non-existing."
#}
#echo "lsblk -o NAME,SIZE,TYPE,FSTYPE,LABEL /dev/mapper/${var_encryption_label}"
#lsblk -o NAME,SIZE,TYPE,FSTYPE,LABEL /dev/mapper/"${var_encryption_label}"
echo "safe_exec mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 /dev/mapper/${var_encryption_label} ${ERR_MOUNTING_DEV}"
safe_exec mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 "/dev/mapper/${var_encryption_label}" "${ERR_MOUNTING_DEV}" || return "${ERR_MOUNTING_DEV}"
# TODO: Remove Debug
### Build the command in an array to keep word boundaries intact
declare -a ary_cmd2=(mount)
@@ -218,15 +237,14 @@ mount_partition() {
fi
declare var_resolved_dev
var_resolved_dev=$(resolve_device "${var_dev}" "${var_part}" "${var_encryption_enable}" "${var_encryption_label}")
#var_resolved_dev=$(resolve_device "${var_dev}" "${var_part}" "${var_encryption_enable}" "${var_encryption_label}")
if [[ "${var_fs_version,,}" == "btrfs" ]]; then
var_fs_btrfs_subvolume=$(get_label "${var_mount_path}" "${var_fs_version}" "sub")
### Mount toplevel (subvolid=0) without extra options.
declare -a ary_cmd_mount=(mount -o "subvolid=0" "${var_resolved_dev}" "${VAR_SAFE_MNT_BASE}")
declare -a ary_cmd_mount=(mount -o "subvolid=0" "${var_fs_uuid}" "${VAR_SAFE_MNT_BASE}")
safe_exec "${ary_cmd_mount[@]}" "${ERR_BTRFS_INITPH}" || return "${ERR_BTRFS_INITPH}"
btrfs subvolume create "${VAR_SAFE_MNT_BASE}/${var_fs_btrfs_subvolume}"
@@ -257,26 +275,34 @@ mount_partition() {
[[ -n "${var_mount_options}" ]] && var_btrfs_compression_options+=",${var_mount_options},subvol=${var_fs_btrfs_subvolume}"
mount_with_dir "${var_mount_path}" "${var_resolved_dev}" "${var_btrfs_compression_options}" || return "${ERR_MOUNTING_DEV}"
### Gathering information for '/etc/fstab'-generation in 4040().
HMP_FSTAB_MOUNT_OPTS["${var_mount_path}"]="${var_btrfs_compression_options[*]}"
do_log "debug" "file_only" "3280() Stored in HashMap [HMP_FSTAB_MOUNT_OPTS] : '${var_mount_path}' -> '${HMP_FSTAB_MOUNT_OPTS["${var_mount_path}"]}'."
mount_with_dir "${var_mount_path}" "${var_fs_uuid}" "${var_btrfs_compression_options}" || return "${ERR_MOUNTING_DEV}"
if [[ "${var_fs_btrfs_snapshot}" == "true" ]]; then
### Preparing "/.snapshot"-directory
mkdir -p "${TARGET}${var_mount_path}/.snapshots"
do_log "info" "file_only" "3280() Created: '${TARGET}${var_mount_path}/.snapshots'."
var_mount_optsnap="${var_mount_optsnap},subvol=${var_snapshot}"
mount_with_dir "${var_mount_path}/.snapshots" "${var_resolved_dev}" "${var_mount_optsnap}"
### Gathering information for '/etc/fstab'-generation in 4040().
HMP_FSTAB_MOUNT_OPTS["${var_mount_path}/.snapshots"]="${var_mount_optsnap[*]}"
do_log "debug" "file_only" "3280() Stored in HashMap [HMP_FSTAB_MOUNT_OPTS] : '${var_mount_path}/.snapshots' -> '${HMP_FSTAB_MOUNT_OPTS["${var_mount_path}/.snapshots"]}'."
do_log "info" "file_only" "3280() Mounted: '${var_resolved_dev}' on: '${TARGET}${var_mount_path}/.snapshots' (Options='${var_mount_optsnap}')."
mount_with_dir "${var_mount_path}/.snapshots" "${var_fs_uuid}" "${var_mount_optsnap}"
do_log "info" "file_only" "3280() Mounted: '${var_fs_uuid}' on: '${TARGET}${var_mount_path}/.snapshots' (Options='${var_mount_optsnap}')."
fi
;;
ext4:*)
mount_with_dir "${var_mount_path}" "${var_resolved_dev}" "${var_mount_options}" || return "${ERR_MOUNTING_DEV}"
mount_with_dir "${var_mount_path}" "${var_fs_uuid}" "${var_mount_options}" || return "${ERR_MOUNTING_DEV}"
;;
*) do_log "error" "file_only" "3280() Unsupported fs/encryption combination."

11
func/partitioning/3290_uuid_logger.sh
View File

@@ -15,8 +15,8 @@ guard_sourcing
#######################################
# Logger for all generated partition, LUKS container and file system UUIDs.
# Globals:
# HMP_PATH_ENCLABEL
# HMP_PATH_FSUUID
# HMP_PATH_LUKSUUID
# HMP_PATH_PARTUUID
# LOG_UID
# Arguments:
@@ -29,8 +29,7 @@ uuid_logger() {
printf 'PARTITION UUID Partition:\n' >> "${LOG_UID}"
for var_key in "${!HMP_PATH_PARTUUID[@]}"; do
### Remove Prefix "PARTUUID_"
var_mountpoint="${var_key#PARTUUID_}"
var_mountpoint="${var_key}"
var_uuid="${HMP_PATH_PARTUUID[${var_key}]}"
### Left-aligned field width 63; "UUID=" starts directly after column 64.
printf '%-63sUUID=%s\n' "${var_mountpoint}" "${var_uuid}" >> "${LOG_UID}"
@@ -39,8 +38,7 @@ uuid_logger() {
printf '\n' >> "${LOG_UID}"
printf 'LUKS CONTAINER UUID:\n' >> "${LOG_UID}"
for var_key in "${!HMP_PATH_LUKSUUID[@]}"; do
### Remove Prefix "PARTUUID_"
var_mountpoint="${var_key#UUID_}"
var_mountpoint="${var_key}"
var_uuid="${HMP_PATH_LUKSUUID[${var_key}]}"
### Left-aligned field width 63; "UUID=" starts directly after column 64.
printf '%-63sUUID=%s\n' "${var_mountpoint}" "${var_uuid}" >> "${LOG_UID}"
@@ -49,8 +47,7 @@ uuid_logger() {
printf '\n' >> "${LOG_UID}"
printf 'FILESYSTEM UUID:\n' >> "${LOG_UID}"
for var_key in "${!HMP_PATH_FSUUID[@]}"; do
### Remove Prefix "UUID_"
var_mountpoint="${var_key#UUID_}"
var_mountpoint="${var_key}"
var_uuid="${HMP_PATH_FSUUID[${var_key}]}"
### Left-aligned field width 63; "UUID=" starts directly after column 64.
printf '%-63sUUID=%s\n' "${var_mountpoint}" "${var_uuid}" >> "${LOG_UID}"

10
func/partitioning/3295_get_label.sh
View File

@@ -18,13 +18,13 @@ guard_sourcing
# None
# Arguments:
# 1: Mount path (e.g., '/' '/boot' '/var/log/audit' 'SWAP' '/boot/efi')
# 2: Filesystem type: one of: [BIOS, btrfs ext4 fat32, swap]
# 2: Filesystem type: one of: [BIOS, btrfs, ext4, fat32, swap]
# 3: Desired return label: one of: [part, luks, file, sub, snap]
# Returns:
# Prints resulting label to stdout.
#######################################
get_label() {
declare -r var_path="${1}"
declare -r var_path="${1,,}"
declare -r var_file="${2,,}"
declare -r var_kind="${3,,}"
@@ -40,7 +40,7 @@ get_label() {
case "${var_path}" in
SWAP) var_return_label="part_ephem_swap" ;;
swap) var_return_label="part_ephem_swap" ;;
/tmp) var_return_label="part_ephem_tmp" ;;
/boot/efi) var_return_label="part_esp" ;;
/) var_return_label="part_root" ;;
@@ -54,7 +54,7 @@ get_label() {
case "${var_path}" in
/tmp) var_return_label="crypt_ephem_tmp" ;;
SWAP) var_return_label="crypt_ephem_swap" ;;
swap) var_return_label="crypt_ephem_swap" ;;
/boot/efi) var_return_label="" ;;
/) var_return_label="crypt_root" ;;
*) var_return_label="crypt_${var_normalized}" ;;
@@ -66,7 +66,7 @@ get_label() {
case "${var_path}:${var_file}" in
SWAP:*) var_return_label="host_swap" ;;
swap:*) var_return_label="host_swap" ;;
/tmp:*) var_return_label="host_tmp" ;;
/boot/efi:*) var_return_label="ESP" ;;
/var/log/audit:ext4) var_return_label="ext4_var_audit" ;;

33
func/system/4040_generate_fstab.sh
View File

@@ -13,7 +13,7 @@
guard_sourcing
#######################################
# '/etc/fstab' entry writer and logger.
# Wrapper to write '/etc/fstab' entries.
# Globals:
# TARGET
# Arguments:
@@ -26,9 +26,9 @@ guard_sourcing
# 0: on success
#######################################
write_fstab() {
declare _uuid="$1" _path="$2" _fs="$3" _opts="$4" _pass="$5"
printf "%-43s%-28s%-8s%-74s0 %s\n" "UUID=${_uuid}" "${_path}" "${_fs}" "${_opts}" "${_pass}" >> "${TARGET}/etc/fstab"
do_log "info" "file_only" "4040() fstab entry generated: [UUID=${_uuid} ${_path} ${_fs} ${_opts} 0 ${_pass}]."
declare write_uuid="$1" write_path="$2" write_type="$3" write_opts="$4" write_pass="$5"
printf "%-43s%-28s%-8s%-74s0 %s\n" "UUID=${write_uuid}" "${write_path}" "${write_type}" "${write_opts}" "${write_pass}" >> "${TARGET}/etc/fstab"
do_log "info" "file_only" "4040() fstab entry generated: [UUID=${write_uuid} ${write_path} ${write_type} ${write_opts} 0 ${write_pass}]."
return 0
}
@@ -63,7 +63,7 @@ generate_fstab() {
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# /etc/fstab: static file system information.
# Static file system information '/etc/fstab'.
#
# Use 'blkid' to print the universally unique identifier for a device; this may be used with [UUID=] as a more robust way to
# name devices that work even if disks are added and removed. See fstab(5).
@@ -71,7 +71,7 @@ generate_fstab() {
# 'systemd' generates mount units based on this file. See systemd.mount(5). Please run 'systemctl daemon-reload' after making
# changes here.
#
# <file system> <mount point> <type> <options> <dump> <pass>
# <file system UUID> <mount point> <type> <options> <dump> <pass>
### Secure tmpfs mounts for a hardened system
@@ -91,8 +91,20 @@ EOF
### Generate '${TARGET}/etc/fstab' special entries '/' '/boot' '/boot/efi'.
### Define the order of the special paths.
declare -a ary_path_order; ary_path_order=("/" "/boot" "/boot/efi")
declare -a ary_path_order=("/" "/boot" "/boot/efi")
declare -a ary_skip=("/" "/boot" "/boot/efi" "/recovery")
declare var_path="" var_fs_uuid="" var_fs_path="" var_fs_type="" var_fs_opts=""
for var_path in "${ary_path_order[@]}"; do
var_fs_uuid="${HMP_PATH_FSUUID["${var_path}"]}"
var_fs_path="${var_path}"
var_fs_type="${HMP_FSTAB_MOUNT_FTYPE["${var_path}"]}"
var_fs_opts="${HMP_FSTAB_MOUNT_OPTS["${var_path}"]}"
done
declare var_path var_entry var_part var_dev var_key var_uuid var_fs_btrfs_compress var_fs_btrfs_level var_fs_btrfs_subvolume \
var_fs_version var_mount_options var_mount_optsnap var_btrfs_compression
@@ -104,6 +116,9 @@ EOF
continue
fi
var_part=$(echo "${var_entry}" | yq e 'path | .[-2]' -)
var_dev=$(echo "${var_entry}" | yq e 'path | .[-3]' -)
var_key="UUID_${var_path}"
@@ -154,6 +169,10 @@ EOF
done
for var_path in "${ARY_FSTAB_MOUNT_PATHS[@]}"; do
:
done
### Generate '${TARGET}/etc/fstab' remaining entries.
for var_path in "${!MAP_MOUNTPATH_DEV[@]}"; do

4
func/system/4150_setup_grub.sh
View File

@@ -204,7 +204,7 @@ EOF
# Detects and collects all boot devices for GRUB installation.
# Supports /dev/sdX, /dev/vdX, /dev/hdX, /dev/nvmeXn1, /dev/mmcblkX.
# Globals:
# VAR_RECIPE_DEV_COUNTER
# VAR_RECIPE_HIGHEST_DEVICE
# ary_bootdev_all
# grub_bootdev
# Arguments:
@@ -223,7 +223,7 @@ get_all_boot_devs() {
case "${dev_prefix}" in
sd|vd|hd)
ascii_start=$(printf '%d' "'a")
ascii_end=$(printf '%d' "'${VAR_RECIPE_DEV_COUNTER}")
ascii_end=$(printf '%d' "'${VAR_RECIPE_HIGHEST_DEVICE}")
for ((ascii = ascii_start; ascii <= ascii_end; ascii++)); do
letter=$(printf "%b" "\\$(printf '%03o' "${ascii}")")
dev_path="/dev/${dev_prefix}${letter}"

27
lib/0025_logging_modules.sh
View File

@@ -15,7 +15,7 @@ guard_sourcing
#######################################
# Log level values for comparison.
# Arguments:
# 1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
# 1: LOG_LEVEL: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
#######################################
log_level_value() {
case "${1,,}" in
@@ -35,7 +35,7 @@ log_level_value() {
# Globals:
# VAR_DEFAULT_LOG_LEVEL
# Arguments:
# 1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
# 1: LOG_LEVEL: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
#######################################
do_should_log() {
# shellcheck disable=SC2155
@@ -56,7 +56,7 @@ do_should_log() {
# WHI
# YEL
# Arguments:
# 1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
# 1: LOG_LEVEL: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
#######################################
do_get_log_color() {
case "${1,,}" in
@@ -75,9 +75,9 @@ do_get_log_color() {
# LOG_ERR
# LOG_INS
# Arguments:
# 1: "${LOG_LEVEL}" one of: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
# 2: "${LOG_ONLY}" one of: "file_only" | "tty"
# *: "${*}" arbitrary text string to log.
# 1: LOG_LEVEL: "debug" | "info" | "notice" | "warn" | "error" | "critical" | "fatal" | "emergency"
# 2: LOG_ONLY: "file_only" | "tty"
# *: Arbitrary text string to log.
#######################################
do_log() {
### Reading arguments.
@@ -86,9 +86,22 @@ do_log() {
declare var_msg_string="${*}"
### Declare variables.
declare log_uniform=""
declare var_color; var_color=$(do_get_log_color "${var_log_level}")
declare var_ts; var_ts="$(date -u '+%Y-%m-%dT%H:%M:%S.%4N%z')"
declare var_log_entry=("${var_ts} [${var_log_level}]: ${var_msg_string}")
case "${var_log_level,,}" in
debug) log_uniform="[DEBUG] ";;
info) log_uniform="[INFO] ";;
notice) log_uniform="[NOTICE] ";;
warn) log_uniform="[WARNING] ";;
error) log_uniform="[ERROR] ";;
critical) log_uniform="[CRITICAL] ";;
fatal) log_uniform="[FATAL] ";;
emergency) log_uniform="[EMERGENCY]";;
esac
declare var_log_entry=("${var_ts} ${log_uniform}: ${var_msg_string}")
if do_should_log "${var_log_level}"; then
if [[ "${var_log_only,,}" == "file_only" ]]; then