Marc S. Weidner
353568eb69
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m54s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
411 lines
16 KiB
Bash
411 lines
16 KiB
Bash
#!/bin/bash
|
|
# SPDX-Version: 3.0
|
|
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
|
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
|
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-FileType: SOURCE
|
|
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
|
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
|
# SPDX-PackageName: CISS.debian.installer
|
|
# SPDX-Security-Contact: security@coresecret.eu
|
|
|
|
guard_sourcing
|
|
|
|
#######################################
|
|
# EFI System Partition | EF00 | UEFI Bootloader (ESP, FAT32)
|
|
# BIOS Boot Partition | EF02 | BIOS Bootloader area (GRUB)
|
|
# Linux SWAP | 8200 | Linux Swap
|
|
# Linux ext4/btrfs | 8300 | Linux Filesystem (root, home)
|
|
# Linux LUKS | 8309 | Linux LUKS
|
|
#######################################
|
|
|
|
#######################################
|
|
# https://uapi-group.org/specifications/specs/discoverable_partitions_specification/
|
|
# https://en.wikipedia.org/wiki/GUID_Partition_Table#Partition_type_GUIDs
|
|
# EFI System Partition, FAT32 | c12a7328-f81f-11d2-ba4b-00a0c93ec93b
|
|
# BIOS Boot Partition GRUB | 21686148-6449-6e6f-744e-656564454649
|
|
# Extended Boot Loader Partition | bc13c2ff-59e6-4262-a352-b275fd6f7172
|
|
# Linux Generic FS (ext4/btrfs) | 0fc63daf-8483-4772-8e79-3d69d8477de4
|
|
# Linux LUKS | ca7d7ccb-63ed-4c53-861c-1742536059cc
|
|
# Swap | 0657fd6d-a4ab-43c4-84e5-0933c84b4f4f
|
|
# / Partition (amd64/x86_64) | 4f68bce3-e8cd-4db1-96e7-fbcaf984b709
|
|
# /home | 933ac7e1-2eb4-4f13-b844-0e14e2aef915
|
|
# /srv | 3b8f8425-20e0-4f3b-907f-1a25a76f98e8
|
|
# /usr Partition (amd64/x86_64) | 8484680c-9521-48c6-9c11-b0720656f69e
|
|
# /var | 4d21b016-b534-45c2-a9fb-5c16e091fd2d
|
|
# /var/tmp | 7ec6f557-3bc5-4aca-b293-16ef5df639d1
|
|
#######################################
|
|
|
|
#######################################
|
|
# Function that generates each partition on each device according to the chosen recipe string and collects information about:
|
|
# - the mount path and whether to mount or not and in which order mounting must be done.
|
|
# - LUKS encryption enabled.
|
|
# - Specific device partition data for each mount path.
|
|
# Globals:
|
|
# ARY_CRYPT_MOUNT_PATHS
|
|
# ARY_FORMT_MOUNT_PATHS
|
|
# ARY_FSTAB_MOUNT_PATHS
|
|
# ARY_PATHS_SORTED
|
|
# DIR_LOG
|
|
# HMP_FSTAB_MOUNT_FTYPE
|
|
# HMP_PATH_DEV_PART
|
|
# HMP_PATH_PARTUUID
|
|
# VAR_RECIPE_FIRMWARE
|
|
# VAR_RECIPE_STRING
|
|
# VAR_RECIPE_TABLE
|
|
# VAR_ROOT_FS
|
|
# VAR_SETUP_PART
|
|
# Arguments:
|
|
# None
|
|
# Returns:
|
|
# 0: on success
|
|
# ERR_PARTITIONTBL: on failure
|
|
# ERR_PART_CREATE: on failure
|
|
# ERR_PART_READ: on failure
|
|
# ERR_TABLE_CREATE: on failure
|
|
# ERR_TABLE_DELETE: on failure
|
|
#######################################
|
|
partitioning() {
|
|
### Declare Arrays, HashMaps, and Variables.
|
|
# shellcheck disable=SC2034
|
|
declare -Ag HMP_PATH_PARTUUID # Used in: 3290() - [Mount Path:Partition UUID].
|
|
# shellcheck disable=SC2034
|
|
declare -Ag HMP_FSTAB_MOUNT_FTYPE # Used in: 4200() - [Mount Path:Filesystem type].
|
|
# shellcheck disable=SC2034
|
|
declare -Ag HMP_PATH_DEV_PART # Used in: 3220() - [Mount Path:DEV.PARTITION].
|
|
# Used in: 3240() - [Mount Path:DEV.PARTITION].
|
|
# Used in: 3280() - [Mount Path:DEV.PARTITION].
|
|
# shellcheck disable=SC2034
|
|
declare -ag ARY_CRYPT_MOUNT_PATHS=() # Used in: 3220() - Only entries [/paths] for encryption.
|
|
# shellcheck disable=SC2034
|
|
declare -ag ARY_FORMT_MOUNT_PATHS=() # Used in: 3240() - Only entries [/paths] for filesystem generation.
|
|
# shellcheck disable=SC2034
|
|
declare -ag ARY_FSTAB_MOUNT_PATHS=() # Used in: 4200() - Only entries [/paths] for the '/etc/fstab' generation.
|
|
# shellcheck disable=SC2034
|
|
declare -ag ARY_PATHS_SORTED=() # Used in: 3280() - All entries [/paths] in a mount ordering scheme.
|
|
# Used in: 4200() - All entries [/paths] in a mount ordering scheme.
|
|
|
|
declare var_dev="" var_part="" \
|
|
var_begin="" var_boot="" var_encryption="" var_end="" var_end_arg="" var_end_mib="" var_format="" var_fs="" \
|
|
var_label="" var_mount_path="" var_mount_true="" var_pri="" var_uuid="" \
|
|
typecode="0fc63daf-8483-4772-8e79-3d69d8477de4"
|
|
|
|
declare -a ary_devs=() ary_parts=() ary_paths_unsorted=()
|
|
|
|
declare -i i=0 var_dev_size=0 var_dev_end=0 var_sec_size=512
|
|
# shellcheck disable=SC2034
|
|
declare -g VAR_ROOT_FS=""
|
|
|
|
### Iterate over all devices in the recipe.
|
|
# shellcheck disable=SC2312
|
|
readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
|
|
for var_dev in "${ary_devs[@]}"; do
|
|
|
|
### All current data for the respective device will be deleted.
|
|
if ! blkdiscard -f "/dev/${var_dev}"; then
|
|
|
|
do_log "warn" "file_only" "3200() Partition table: '/dev/${var_dev}' deletion failed with: 'blkdiscard -f' trying 'sgdisk' fallback."
|
|
|
|
if command -v sgdisk >/dev/null && sgdisk --zap-all "/dev/${var_dev}"; then
|
|
|
|
do_log "debug" "file_only" "3200() [command -v sgdisk >/dev/null && sgdisk --zap-all]."
|
|
do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' wiped with 'sgdisk --zap-all'."
|
|
|
|
elif dd if=/dev/zero of="/dev/${var_dev}" bs=1M count=8 status=none; then
|
|
|
|
do_log "debug" "file_only" "3200() [dd if=/dev/zero of=/dev/${var_dev} bs=1M count=8 status=none]."
|
|
do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' overwritten with zeros."
|
|
|
|
else
|
|
|
|
do_log "fatal" "file_only" "3200() Partition table: '/dev/${var_dev}' deletion failed with: [blkdiscard, sgdisk and dd]."
|
|
return "${ERR_TABLE_DELETE}"
|
|
|
|
fi
|
|
|
|
else
|
|
|
|
do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' discarded [blkdiscard -f /dev/${var_dev}]."
|
|
|
|
fi
|
|
|
|
case "${VAR_RECIPE_TABLE,,}" in
|
|
|
|
gpt|mbr)
|
|
if ! parted -s "/dev/${var_dev}" mklabel "${VAR_RECIPE_TABLE,,}"; then
|
|
|
|
do_log "fatal" "file_only" "3200() [parted -s /dev/${var_dev} mklabel ${VAR_RECIPE_TABLE,,}] failed."
|
|
do_log "fatal" "file_only" "3200() Partition table: '/dev/${var_dev}' creation failed."
|
|
return "${ERR_TABLE_CREATE}"
|
|
|
|
fi
|
|
|
|
do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' generated: '${VAR_RECIPE_TABLE}'."
|
|
;;
|
|
|
|
*)
|
|
do_log "fatal" "file_only" "3200() No valid partition table chosen. String was '${VAR_RECIPE_TABLE}'."
|
|
return "${ERR_PARTITIONTBL}"
|
|
;;
|
|
|
|
esac
|
|
|
|
### Iterate over all partitions for this device.
|
|
# shellcheck disable=SC2312
|
|
readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
|
|
for var_part in "${ary_parts[@]}"; do
|
|
|
|
### Extract parameters from YAML.
|
|
var_begin=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.begin" "${VAR_SETUP_PART}")
|
|
var_end=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.end" "${VAR_SETUP_PART}")
|
|
var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
|
|
var_format=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.format" "${VAR_SETUP_PART}")
|
|
var_boot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.bootable" "${VAR_SETUP_PART}")
|
|
var_pri=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.primary" "${VAR_SETUP_PART}")
|
|
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
|
|
var_mount_true=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.enable" "${VAR_SETUP_PART}")
|
|
var_encryption=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
|
|
|
|
### Assign the start zone of the first partition and skip the first 2 MiB as the best practice.
|
|
if [[ "${var_begin,,}" == "min" ]]; then
|
|
var_begin="2MiB"
|
|
fi
|
|
|
|
### Assign the landing zone of the last partition and reserve 64 MiB for GPT and mdadm binary metadata.
|
|
### There is no mandatory upper limit, but for particularly critical systems (FDE, RAID-6 setups, dm-integrity, etc.),
|
|
### more generous reserves between 32 and 64 MiB are recommended.
|
|
if [[ "${var_end,,}" == "max" ]]; then
|
|
var_sec_size=$(blockdev --getpbsz "/dev/${var_dev}")
|
|
var_dev_size=$(blockdev --getsize64 "/dev/${var_dev}")
|
|
var_dev_end=$(( var_dev_size - (64 * 1024 * 1024) ))
|
|
var_end_mib=$(( var_dev_end / 1024 / 1024 ))
|
|
var_end_arg="${var_end_mib}MiB"
|
|
else
|
|
var_end_arg="${var_end}"
|
|
fi
|
|
|
|
# shellcheck disable=SC2249
|
|
case "${VAR_RECIPE_TABLE,,}" in
|
|
|
|
gpt)
|
|
|
|
var_label=$(get_label "${var_mount_path}" "${var_fs}" "part")
|
|
|
|
if ! parted -s "/dev/${var_dev}" mkpart "${var_label}" "${var_fs}" "${var_begin}" "${var_end_arg}"; then
|
|
|
|
do_log "fatal" "file_only" "3200() [parted -s /dev/${var_dev} mkpart ${var_label} ${var_fs} ${var_begin} ${var_end_arg}] failed."
|
|
do_log "fatal" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' creation failed."
|
|
return "${ERR_PART_CREATE}"
|
|
|
|
fi
|
|
;;
|
|
|
|
mbr|msdos)
|
|
if ! parted -s "/dev/${var_dev}" mkpart "${var_pri}" "${var_fs}" "${var_begin}" "${var_end_arg}"; then
|
|
|
|
do_log "fatal" "file_only" "3200() [parted -s /dev/${var_dev} mkpart ${var_pri} ${var_fs} ${var_begin} ${var_end_arg}] failed."
|
|
do_log "fatal" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' creation failed."
|
|
return "${ERR_PART_CREATE}"
|
|
|
|
fi
|
|
;;
|
|
|
|
esac
|
|
|
|
do_log "info" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' generated | begin: '${var_begin}' | end: '${var_end_arg}'."
|
|
|
|
### Assign the correct GPT typecode via sgdisk if the table is GPT.
|
|
if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" ]]; then
|
|
|
|
# shellcheck disable=SC2249
|
|
case "${var_mount_path,,}" in
|
|
|
|
"/")
|
|
typecode="4f68bce3-e8cd-4db1-96e7-fbcaf984b709" ;; ### / Partition (amd64/x86_64)
|
|
|
|
"/home")
|
|
typecode="933ac7e1-2eb4-4f13-b844-0e14e2aef915" ;; ### /home Partition
|
|
|
|
"/srv")
|
|
typecode="3b8f8425-20e0-4f3b-907f-1a25a76f98e8" ;; ### /srv Partition
|
|
|
|
"/usr")
|
|
typecode="8484680c-9521-48c6-9c11-b0720656f69e" ;; ### /usr Partition (amd64/x86_64)
|
|
|
|
"/var")
|
|
typecode="4d21b016-b534-45c2-a9fb-5c16e091fd2d" ;; ### /var Partition
|
|
|
|
"/var/tmp")
|
|
typecode="7ec6f557-3bc5-4aca-b293-16ef5df639d1" ;; ### /var/tmp Partition
|
|
|
|
esac
|
|
|
|
case "${var_fs,,}" in
|
|
|
|
fat32)
|
|
typecode="c12a7328-f81f-11d2-ba4b-00a0c93ec93b" ;; ### EFI System Partition
|
|
|
|
swap)
|
|
typecode="0657fd6d-a4ab-43c4-84e5-0933c84b4f4f" ;; ### Linux SWAP [NOT Ephemeral Devices]
|
|
|
|
bios)
|
|
typecode="21686148-6449-6e6f-744e-656564454649" ;; ### BIOS Boot Partition
|
|
|
|
ext4|btrfs)
|
|
typecode="0fc63daf-8483-4772-8e79-3d69d8477de4" ;; ### Linux native FS
|
|
|
|
*)
|
|
do_log "warn" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' unknown FS type: '${var_fs}', using default GPT FS '8300'."
|
|
;;
|
|
|
|
esac
|
|
|
|
# shellcheck disable=SC2249
|
|
case "${var_encryption,,}" in
|
|
|
|
true)
|
|
|
|
case "${var_mount_path,,}" in
|
|
|
|
/tmp|swap)
|
|
typecode="ca7d7ccb-63ed-4c53-861c-1742536059cc" ;; ### Linux LUKS Partition
|
|
|
|
*)
|
|
typecode="ca7d7ccb-63ed-4c53-861c-1742536059cc" ;; ### Linux LUKS Partition
|
|
|
|
esac
|
|
|
|
esac
|
|
|
|
if sgdisk --typecode="${var_part}:${typecode}" "/dev/${var_dev}" &>/dev/null; then
|
|
|
|
do_log "info" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' GPT typecode '${typecode}' set for '${var_fs}'."
|
|
|
|
else
|
|
|
|
do_log "warn" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' GPT typecode '${typecode}' failed to set."
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
### Set the bootable flag if necessary.
|
|
if [[ "${var_boot,,}" == "true" ]]; then
|
|
|
|
# shellcheck disable=SC2249
|
|
case "${VAR_RECIPE_TABLE,,}:${VAR_RECIPE_FIRMWARE,,}" in
|
|
|
|
gpt:uefi|mbr:uefi)
|
|
|
|
do_log "info" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' | [${VAR_RECIPE_TABLE^^}:UEFI] no bootable flag required."
|
|
;;
|
|
|
|
gpt:bios|mbr:bios)
|
|
|
|
parted -s "/dev/${var_dev}" set "${var_part}" boot on
|
|
do_log "info" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' | [${VAR_RECIPE_TABLE^^}:BIOS] marked as bootable."
|
|
;;
|
|
|
|
esac
|
|
|
|
fi
|
|
|
|
### Store PARTUUID of the partition.
|
|
udevadm settle
|
|
|
|
for i in {1..10}; do
|
|
|
|
var_uuid=$(blkid -s PARTUUID -o value "/dev/${var_dev}${var_part}") && [[ -n "${var_uuid}" ]] && break
|
|
sleep 0.25
|
|
|
|
done
|
|
|
|
if [[ -z "${var_uuid}" ]]; then
|
|
|
|
do_log "fatal" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' could not read PARTUUID."
|
|
return "${ERR_PART_READ}"
|
|
|
|
else
|
|
|
|
HMP_PATH_PARTUUID["${var_mount_path}"]="${var_uuid}"
|
|
do_log "debug" "file_only" "3200() [HMP_PATH_PARTUUID]: '${var_mount_path}' -> '${HMP_PATH_PARTUUID["${var_mount_path}"]}'."
|
|
|
|
fi
|
|
|
|
### Gathering information for forthcoming modules 32n0().
|
|
# shellcheck disable=SC2034
|
|
HMP_PATH_DEV_PART["${var_mount_path}"]="${var_dev}.${var_part}"
|
|
|
|
### Gathering information for encryption module 3220().
|
|
if [[ "${var_encryption}" == "true" ]]; then
|
|
# shellcheck disable=SC2034
|
|
ARY_CRYPT_MOUNT_PATHS+=("${var_mount_path}")
|
|
fi
|
|
|
|
### Gathering information for filesystem module 3240().
|
|
if [[ "${var_format}" == "true" ]]; then
|
|
# shellcheck disable=SC2034
|
|
ARY_FORMT_MOUNT_PATHS+=("${var_mount_path}")
|
|
fi
|
|
|
|
### Gathering information for mounting module 3280().
|
|
ary_paths_unsorted+=("${var_mount_path}")
|
|
|
|
### Gathering information for '/etc/fstab'-generation in 4200().
|
|
if [[ "${var_mount_true}" == "true" ]]; then
|
|
|
|
# shellcheck disable=SC2034
|
|
ARY_FSTAB_MOUNT_PATHS+=("${var_mount_path}")
|
|
do_log "debug" "file_only" "3200() [ARY_FSTAB_MOUNT_PATHS]: '${var_mount_path}'."
|
|
HMP_FSTAB_MOUNT_FTYPE["${var_mount_path}"]="${var_fs}"
|
|
do_log "debug" "file_only" "3200() [HMP_FSTAB_MOUNT_FTYPE]: '${var_mount_path}' -> '${HMP_FSTAB_MOUNT_FTYPE["${var_mount_path}"]}'."
|
|
|
|
fi
|
|
|
|
### Gathering information for '/etc/initramfs-tools/conf.d/fsroot'-generation in 4121().
|
|
if [[ "${var_mount_path}" == "/" ]]; then
|
|
|
|
# shellcheck disable=SC2034
|
|
VAR_ROOT_FS="${var_fs}"
|
|
|
|
fi
|
|
|
|
done
|
|
|
|
lsblk -o NAME,START,SIZE,PHY-SEC,LOG-SEC,ALIGNMENT "/dev/${var_dev}" >| "${DIR_LOG}/3200_${var_dev}_alignment.log"
|
|
sgdisk -p "/dev/${var_dev}" >| "${DIR_LOG}/3200_${var_dev}_info.log"
|
|
|
|
done
|
|
|
|
### Prepare the mount ordering scheme.
|
|
# shellcheck disable=SC2312
|
|
mapfile -d '' -t ARY_PATHS_SORTED < <(\
|
|
### a) Emit unsorted items as NUL-separated records (preserve any whitespace):
|
|
printf '%s\0' "${ary_paths_unsorted[@]}" |
|
|
### b) Dedupe NUL-safely, and add a sort group:
|
|
### - grp=0 for the special token "SWAP" (non-path), so it comes first.
|
|
### - grp=1 for everything else (absolute paths).
|
|
awk -v RS='\0' -v ORS='\0' '
|
|
!seen[$0]++ {
|
|
grp = ($0=="SWAP") ? 0 : 1;
|
|
# Use TAB as field separator for the sort key
|
|
printf "%d\t%s\0", grp, $0
|
|
}
|
|
' |
|
|
### c) Sort NUL-separated by the group, then lexicographically by the *full path*:
|
|
### This ensures parent before child due to prefix property:
|
|
### "/boot" < "/boot/efi", "/var/log" < "/var/log/audit" < "/var/tmp"
|
|
sort -z -t $'\t' -k1,1 -k2,2 | cut -z -f2-
|
|
)
|
|
|
|
printf "%s\n" "${ary_paths_unsorted[@]}" >| "${DIR_LOG}/3200_mount_paths_unsorted.log"
|
|
printf "%s\n" "${ARY_PATHS_SORTED[@]}" >| "${DIR_LOG}/3200_mount_paths_sorted.log"
|
|
|
|
guard_dir && return 0
|
|
}
|
|
### Prevents accidental 'unset -f'.
|
|
# shellcheck disable=SC2034
|
|
readonly -f partitioning
|
|
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|