Marc S. Weidner
ab8c3a78b0
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m28s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
322 lines
13 KiB
Bash
322 lines
13 KiB
Bash
#!/bin/bash
|
|
# SPDX-Version: 3.0
|
|
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
|
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
|
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-FileType: SOURCE
|
|
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
|
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
|
# SPDX-PackageName: CISS.debian.installer
|
|
# SPDX-Security-Contact: security@coresecret.eu
|
|
|
|
guard_sourcing
|
|
|
|
#######################################
|
|
# Function to generate btrfs-subvolumes.
|
|
# Globals:
|
|
# ERR_BTRFS_SUBVOL
|
|
# TARGET
|
|
# Arguments:
|
|
# $1: MOUNT_PATH
|
|
# $2: SUBVOLUME
|
|
#######################################
|
|
create_btrfs_subvolume() {
|
|
declare var_mount_path="$1"
|
|
declare var_subvolume="$2"
|
|
|
|
btrfs subvolume create "${TARGET}${var_mount_path}/${var_subvolume}" || {
|
|
do_log "error" "false" "Error occurred at creation of subvolume: '${var_subvolume}' in: '${TARGET}${var_mount_path}'."
|
|
exit "${ERR_BTRFS_SUBVOL}"
|
|
}
|
|
do_log "info" "false" "Created: '${var_subvolume}' at: '${TARGET}${var_mount_path}'."
|
|
}
|
|
|
|
#######################################
|
|
# Function to create the mount path and mount the respective device on it.
|
|
# Globals:
|
|
# ERR_MOUNTING_DEV
|
|
# TARGET
|
|
# Arguments:
|
|
# $1: MOUNT_PATH
|
|
# $2: MOUNT_DEVICE
|
|
# $3: MOUNT_OPTIONS
|
|
#######################################
|
|
mount_with_dir() {
|
|
declare var_mount_path="$1"
|
|
declare var_mount_device="$2"
|
|
declare var_mount_options="$3"
|
|
|
|
if [[ "${var_mount_path}" == "/" ]]; then
|
|
var_mount_path=""
|
|
fi
|
|
|
|
mkdir -p "${TARGET}${var_mount_path}"
|
|
|
|
mount "${var_mount_options:+-o $var_mount_options}" "${var_mount_device}" "${TARGET}${var_mount_path}" || {
|
|
do_log "error" "false" "Error occurred at mounting '${var_mount_device}' on: '${TARGET}${var_mount_path}'."
|
|
exit "${ERR_MOUNTING_DEV}"
|
|
}
|
|
do_log "info" "false" "Mounted: '${var_mount_device}' on: '${TARGET}${var_mount_path}' incl. options: '${var_mount_options}'."
|
|
}
|
|
|
|
###########################################################################################
|
|
# Function for mounting all partitions for debootstrap incl. generating btrfs subvolumes.
|
|
# Globals:
|
|
# ERR_MOUNTING_ROOT
|
|
# ERR_NO_DEVIC_PATH
|
|
# ERR_NO_ENCR_LABEL
|
|
# MAP_EPHEMERAL_DEV
|
|
# MAP_MOUNTPATH_DEV
|
|
# MODULE_ERR
|
|
# MODULE_TXT
|
|
# RECIPE_STRING
|
|
# TARGET
|
|
# Arguments:
|
|
# None
|
|
###########################################################################################
|
|
mount_partition() {
|
|
### 3260_setup_filesystem.sh
|
|
### Assoziative Array (HashMap) to store Crypt Mapper OR Device for each Mount Path
|
|
### HMP_MOUNTPATH_DEV["${var_mount_path}"]="/dev/mapper/${var_encryption_label}"
|
|
### HMP_MOUNTPATH_DEV["${var_mount_path}"]="/dev/${var_dev}${var_part}"
|
|
|
|
### Mount "/"-filesystem
|
|
declare -r var_mount_path_root="/"
|
|
if [[ -n ${HMP_MOUNTPATH_DEV[$var_mount_path_root]} ]]; then
|
|
mount_with_dir "${var_mount_path_root}" "${HMP_MOUNTPATH_DEV[$var_mount_path_root]}"
|
|
else
|
|
do_log "error" "false" "Root-filesystem '${var_mount_path_root}' not found in Hashmap."
|
|
exit "${ERR_MOUNTING_ROOT}"
|
|
fi
|
|
|
|
### Ensure order of "/boot" and "/boot/efi"
|
|
declare var_path
|
|
for var_path in "/boot" "/boot/efi"; do
|
|
if [[ -n ${HMP_MOUNTPATH_DEV[${var_path}]} ]]; then
|
|
mount_with_dir "${var_path}" "${HMP_MOUNTPATH_DEV[${var_path}]}"
|
|
else
|
|
do_log "info" "false" "Entry '${var_path}' not found in Hashmap."
|
|
fi
|
|
done
|
|
|
|
### Mounting all remaining keys of hashmap 'HMP_MOUNTPATH_DEV'.
|
|
|
|
### Iterate over all devices in the recipe.
|
|
for var_dev in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}"); do
|
|
|
|
### Iterate over all partitions for this device.
|
|
for var_part in $(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}"); do
|
|
|
|
### Extract parameters from YAML.
|
|
var_fs_btrfs_compress=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
|
|
var_fs_btrfs_level=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level" "${VAR_SETUP_PART}")
|
|
var_encryption_enable=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
|
|
var_encryption_label=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label" "${VAR_SETUP_PART}")
|
|
var_fs_label=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label" "${VAR_SETUP_PART}")
|
|
var_fs_version=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
|
|
var_mount_path=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
|
|
var_mount_options=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.options" "${VAR_SETUP_PART}")
|
|
var_mount_subvolume=$(yq e ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.subvolume" "${VAR_SETUP_PART}")
|
|
|
|
### Skip already mounted paths ("/", "/boot", "/boot/efi") and ("/recovery")
|
|
if [[ "${var_mount_path}" == "/" || "${var_mount_path}" == "/boot" || "${var_mount_path}" == "/boot/efi" || "${var_mount_path}" == "/recovery" ]]; then
|
|
continue
|
|
fi
|
|
|
|
if [[ "${var_mount_path}" == "SWAP" ]]; then
|
|
|
|
cryptsetup open --type plain --key-file /dev/random \
|
|
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
|
|
--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
|
|
mkswap "/dev/mapper/${var_encryption_label}"
|
|
swapon "/dev/mapper/${var_encryption_label}"
|
|
do_log "info" "false" "Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
|
|
|
|
elif [[ ${var_mount_path} == "/tmp" ]]; then
|
|
|
|
cryptsetup open --type plain --key-file /dev/random \
|
|
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
|
|
--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
|
|
mkdir -p "${TARGET}/tmp"
|
|
mkfs.ext4 -L "${var_fs_label}" "/dev/mapper/${var_encryption_label}" "${var_fs_options:+ $var_fs_options}"
|
|
mount "${MOUNT_OPTIONS:+-o $MOUNT_OPTIONS}" "/dev/mapper/${var_encryption_label}" "${TARGET}/tmp"
|
|
do_log "info" "false" "Mounted: '${var_dev}' on: '/dev/mapper/${var_encryption_label}'."
|
|
|
|
else
|
|
|
|
|
|
|
|
|
|
|
|
|
|
done
|
|
|
|
done
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
declare var_key
|
|
declare var_transformed_string
|
|
declare var_device_path
|
|
declare var_encryption_label
|
|
declare var_matching_var
|
|
|
|
for var_key in "${!HMP_MOUNTPATH_DEV[@]}"; do
|
|
### Initialize variables.
|
|
var_device_path="${HMP_MOUNTPATH_DEV[${var_key}]}"
|
|
|
|
### If 'KEY:VALUE' equals "/dev/${DEV}${PARTITION}"
|
|
if [[ "${var_device_path}" =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
|
|
|
|
var_transformed_string=$(echo "${var_device_path}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
|
|
|
|
### If 'KEY:VALUE' equals "/dev/mapper/${ENCRYPTION_LABEL}"
|
|
elif [[ ${var_device_path} =~ ^/dev/mapper/ ]]; then
|
|
|
|
### Extract ENCRYPTION_LABEL
|
|
var_encryption_label="${var_device_path#/dev/mapper/}"
|
|
|
|
### Search matching variable of sourced "${PRESEED}" variable file
|
|
var_matching_var=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${var_encryption_label}")
|
|
|
|
if [[ -n ${var_matching_var} ]]; then
|
|
|
|
### Extract third, fourth and fifth part of the respective variable
|
|
var_transformed_string=$(echo "${var_matching_var}" | sed -E 's|recipe_([^_]+_[^_]+_[^_]+)_.*|\1|')
|
|
|
|
else
|
|
|
|
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${var_encryption_label}'."
|
|
exit "${ERR_MOUNTING_LUKS}"
|
|
|
|
fi
|
|
|
|
else
|
|
|
|
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${var_device_path}'."
|
|
exit "${ERR_UNKNOWN_DEV}"
|
|
|
|
fi
|
|
|
|
declare BTRFS_COMPR_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_filesystem_btrfs_compress"
|
|
declare BTRFS_LEVEL_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_filesystem_btrfs_level"
|
|
declare ENCRYPTION_LABEL_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_encryption_label"
|
|
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_filesystem_label"
|
|
declare FILESYSTEM_VERSION_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_filesystem_version"
|
|
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_mount_options"
|
|
declare MOUNT_SUBVOLUME_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_mount_subvolume"
|
|
|
|
declare BTRFS_COMPR=${!BTRFS_COMPR_VAR}
|
|
declare BTRFS_LEVEL=${!BTRFS_LEVEL_VAR}
|
|
declare var_encryption_label=${!ENCRYPTION_LABEL_VAR}
|
|
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
|
|
declare FILESYSTEM_VERSION=${!FILESYSTEM_VERSION_VAR}
|
|
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
|
|
declare MOUNT_SUBVOLUME=${!MOUNT_SUBVOLUME_VAR}
|
|
|
|
# Skip already mounted paths ("/", "/boot", "/boot/efi")
|
|
if [[ ${var_key} == "/" || ${var_key} == "/boot" || ${var_key} == "/boot/efi" ]]; then
|
|
continue
|
|
fi
|
|
|
|
if [[ ${FILESYSTEM_VERSION,,} == "btrfs" ]]; then
|
|
|
|
declare BTRFS_OPTIONS="compress=${BTRFS_COMPR}:${BTRFS_LEVEL}"
|
|
mount_with_dir "${var_key}" "${var_device_path}" "${BTRFS_OPTIONS}"
|
|
[[ -n ${MOUNT_SUBVOLUME} ]] && create_btrfs_subvolume "${var_key}" "${MOUNT_SUBVOLUME}"
|
|
|
|
elif [[ ${FILESYSTEM_VERSION,,} == "ext4" ]]; then
|
|
|
|
mount_with_dir "${var_key}" "${var_device_path}"
|
|
|
|
else
|
|
|
|
do_log "error" "false" "No valid filesystem: '${FILESYSTEM_VERSION}' found for ${var_key}."
|
|
|
|
fi
|
|
|
|
done
|
|
|
|
# Reminder: MAP_EPHEMERALLABEL_DEV["${MOUNT_PATH}"]="/dev/${DEV}${PARTITION}"
|
|
# Mounting remaining entries of hashmap 'MAP_EPHEMERALLABEL_DEV'.
|
|
declare var_key
|
|
declare var_transformed_string
|
|
declare var_device_path
|
|
|
|
for var_key in "${!MAP_EPHEMERAL_DEV[@]}"; do
|
|
# Initialize variables
|
|
var_device_path="${MAP_EPHEMERAL_DEV[${var_key}]}"
|
|
|
|
# if KEY:VALUE equals "/dev/${DEV}${PARTITION}"
|
|
if [[ ${var_device_path} =~ ^/dev/[a-zA-Z]+[0-9]+$ ]]; then
|
|
|
|
var_transformed_string=$(echo "${var_device_path}" | sed 's|/dev/|dev_|; s|\([a-zA-Z]\)\([0-9]\)|\1_\2|')
|
|
|
|
# if KEY:VALUE equals "/dev/mapper/${ENCRYPTION_LABEL}"
|
|
elif [[ ${var_device_path} =~ ^/dev/mapper/ ]]; then
|
|
|
|
# Extract ENCRYPTION_LABEL
|
|
var_encryption_label="${var_device_path#/dev/mapper/}"
|
|
|
|
# Search matching variable of sourced "${PRESEED}" variable file
|
|
var_matching_var=$(declare -p | grep -oP "recipe_[^ ]+_encryption_label=${var_encryption_label}")
|
|
|
|
if [[ -n ${var_matching_var} ]]; then
|
|
|
|
# Extract third, fourth and fifth part of the respective variable
|
|
var_transformed_string=$(echo "${var_matching_var}" | sed -E 's|recipe_[^_]+_(dev_[^_]+_[^_]+)_.*|\1|')
|
|
|
|
else
|
|
|
|
do_log "error" "false" "No matching variable found for ENCRYPTION_LABEL='${var_encryption_label}'."
|
|
exit "${ERR_NO_ENCR_LABEL}"
|
|
|
|
fi
|
|
|
|
else
|
|
|
|
do_log "error" "false" "Unknown DEVICE_PATH-Format: '${var_device_path}'."
|
|
exit "${ERR_NO_DEVIC_PATH}"
|
|
|
|
fi
|
|
|
|
declare ENCRYPTION_LABEL_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_encryption_label"
|
|
declare FILESYSTEM_LABEL_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_filesystem_label"
|
|
declare MOUNT_OPTIONS_VAR="recipe_${RECIPE_STRING}_${var_transformed_string}_mount_options"
|
|
declare var_encryption_label=${!ENCRYPTION_LABEL_VAR}
|
|
declare FILESYSTEM_LABEL=${!FILESYSTEM_LABEL_VAR}
|
|
declare MOUNT_OPTIONS=${!MOUNT_OPTIONS_VAR}
|
|
|
|
if [[ ${var_key} == "SWAP" ]]; then
|
|
|
|
cryptsetup open --type plain --key-file /dev/random \
|
|
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
|
|
--sector-size 4096 "/dev/disk/by-label/${FILESYSTEM_LABEL}" "${var_encryption_label}"
|
|
mkswap "/dev/mapper/${var_encryption_label}"
|
|
swapon "/dev/mapper/${var_encryption_label}"
|
|
do_log "info" "false" "Mounted: '${var_key}' on: '/dev/mapper/${var_encryption_label}'."
|
|
|
|
elif [[ ${var_key} == "/tmp" ]]; then
|
|
|
|
cryptsetup open --type plain --key-file /dev/random \
|
|
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
|
|
--sector-size 4096 "/dev/disk/by-label/${FILESYSTEM_LABEL}" "${var_encryption_label}"
|
|
mkdir -p "${TARGET}/tmp"
|
|
mount "${MOUNT_OPTIONS:+-o $MOUNT_OPTIONS}" "/dev/mapper/${var_encryption_label}" "${TARGET}/tmp"
|
|
do_log "info" "false" "Mounted: '${var_key}' on: '/dev/mapper/${var_encryption_label}'."
|
|
|
|
else
|
|
do_log "warn" "false" "Ephemeral configuration for ${var_key} is not valid or disabled."
|
|
fi
|
|
|
|
done
|
|
|
|
do_log "info" "false" "All devices of 'MAP_MOUNTPATH_DEV' and 'MAP_EPHEMERALLABEL_DEV' successfully mounted."
|
|
}
|
|
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|