CISS.debian.installer/func/cdi_1000_helper/1080_helper_chroot.sh

#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu

guard_sourcing

#######################################
# Use chroot_exec() for:
#   - simple commands (e.g., dpkg, ln, mkdir, apt, etc.).
# Use chroot_script() for:
#   - all shell scripts, redirects, pipes, conditions, loops, or subshells.
#######################################

#######################################
# Wrapper for executing commands in the desired chroot environment.
# Globals:
#   BASH_SOURCE
#   TERM
# Arguments:
#   1: Target of the chroot environment.
#   2: Commands and options and parameters to be executed in chroot.
# Returns:
#   0: on success
#   ERR_CHRT_COMMAND: on failure
#######################################
chroot_exec() {
  declare    var_chroot_target="$1"; shift
  declare -a ary_chroot_command=("$@")
  declare -r var_default_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  declare    var_mod="${BASH_SOURCE[1]##*/}"; var_mod="${var_mod%%_*}()"

  if (( ${#ary_chroot_command[@]} == 0 )); then

    do_log "emergency" "file_only" "1080() Empty command passed to 'chroot_exec()'."
    return "${ERR_CHRT_COMMAND}"

  fi

  if ! chroot "${var_chroot_target}" /usr/bin/env -i PATH="${var_default_path}" which "${ary_chroot_command[0]}" &>/dev/null; then

    do_log "emergency" "file_only" "1080() Binary: '${ary_chroot_command[0]}' not found in target 'PATH=${var_default_path}'."
    do_log "emergency" "file_only" "1080() Command: [chroot ${var_chroot_target} /usr/bin/env -i PATH=${var_default_path} which ${ary_chroot_command[0]} &>/dev/null]."
    return "${ERR_CHRT_COMMAND}"

  fi

  if ! chroot "${var_chroot_target}" /usr/bin/env -i \
    HOME="/root" \
    PATH="${var_default_path}" \
    TERM="${TERM}" \
    LANG="C.UTF-8" \
    LC_ALL="C.UTF-8" \
    DEBIAN_FRONTEND="noninteractive" \
    APT_LISTCHANGES_FRONTEND="none" \
    "${ary_chroot_command[@]}"

  then

    do_log "emergency" "file_only" "1080() Command of ${var_mod} [chroot ${var_chroot_target} /usr/bin/env -i HOME=/root PATH=${var_default_path} TERM=${TERM} LANG=C.UTF-8 LC_ALL=C.UTF-8 DEBIAN_FRONTEND=noninteractive APT_LISTCHANGES_FRONTEND=none ${ary_chroot_command[*]}] failed."
    return "${ERR_CHRT_COMMAND}"

  else

    do_log "info" "file_only" "1080() Command of ${var_mod} [chroot ${var_chroot_target} /usr/bin/env -i HOME=/root PATH=${var_default_path} TERM=${TERM} LANG=C.UTF-8 LC_ALL=C.UTF-8 DEBIAN_FRONTEND=noninteractive APT_LISTCHANGES_FRONTEND=none ${ary_chroot_command[*]}] successful."
    return 0

  fi
}

#######################################
# Execute a full shell script line inside the chroot via bash -c.
# Globals:
#   BASH_SOURCE
#   TERM
#   VAR_CHROOT_DEBUG
#   VAR_DEBUG_TRACE
#   VAR_DEBUG_TRAP
#   VAR_IN_DIALOG_WR
# Arguments:
#   1: Target of the chroot environment
#   2: Command string to execute inside a shell (quoted)
#   3: Log level of command pipeline to be executed.
# Returns:
#   0: on success
#   ERR_CHRT_COMMAND: on failure
#######################################
chroot_script() {
  declare    var_chroot_target="$1"
  declare    var_chroot_script="$2"
  declare    var_log_level_on_error="${3:-emergency}"
  declare -r var_default_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  declare    var_mod="${BASH_SOURCE[1]##*/}"; var_mod="${var_mod%%_*}()"

  if [[ -z "${var_chroot_script}" ]]; then

    do_log "emergency" "file_only" "1080() Empty command passed to 'chroot_script()'."
    return "${ERR_CHRT_COMMAND}"

  fi

  if ! chroot "${var_chroot_target}" /usr/bin/env -i \
    HOME="/root" \
    PATH="${var_default_path}" \
    TERM="${TERM}" \
    LANG="C.UTF-8" \
    LC_ALL="C.UTF-8" \
    DEBIAN_FRONTEND="noninteractive" \
    APT_LISTCHANGES_FRONTEND="none" \
    /bin/bash -o errexit -o errtrace -o functrace -o nounset -o pipefail \
    -O inherit_errexit -O failglob -O lastpipe -c "${var_chroot_script}"

  then

    do_log "${var_log_level_on_error}" "file_only" "1080() Command of ${var_mod} [chroot ${var_chroot_target} /usr/bin/env -i HOME=/root PATH=${var_default_path} TERM=${TERM} LANG=C.UTF-8 LC_ALL=C.UTF-8 DEBIAN_FRONTEND=noninteractive APT_LISTCHANGES_FRONTEND=none /bin/bash -c ${var_chroot_script}] failed."

    if [[ "${VAR_CHROOT_DEBUG}" == "true" ]]; then

      if [[ "${VAR_DEBUG_TRACE}" == "true" || "${VAR_DEBUG_TRAP}" == "true" ]]; then dump_vars_exiting; fi

      case "${VAR_IN_DIALOG_WR}" in
        box   ) dialog_box_cleaner   ;;
        gauge ) dialog_gauge_cleaner ;;
        text  ) dialog_text_cleaner  ;;
      esac

      do_log "emergency" "tty" "1080() Launching interactive debug shell in chroot: '${var_chroot_target}'."

      chroot "${var_chroot_target}" /bin/bash -l

    else

      return "${ERR_CHRT_COMMAND}"

    fi

  else

    do_log "info" "file_only" "1080() Command of ${var_mod} [chroot ${var_chroot_target} /usr/bin/env -i HOME=/root PATH=${var_default_path} TERM=${TERM} LANG=C.UTF-8 LC_ALL=C.UTF-8 DEBIAN_FRONTEND=noninteractive APT_LISTCHANGES_FRONTEND=none /bin/bash -c ${var_chroot_script}] successful."
    return 0

  fi
}

#######################################
# Execute the desired code of the installer via stdin inside the chroot with bash -s.
# Globals:
#   BASH_SOURCE
#   TERM
#   VAR_CHROOT_DEBUG
#   VAR_DEBUG_TRACE
#   VAR_DEBUG_TRAP
#   VAR_IN_DIALOG_WR
# Arguments:
#   1: Target of the chroot environment
#   2: Command string to execute inside a shell (quoted)
#   3: Log level of command pipeline to be executed.
# Returns:
#   0: on success
#   ERR_CHRT_COMMAND: on failure
#######################################
chroot_stdin() {
  declare    var_chroot_target="$1"
  declare    var_chroot_script="$2"
  declare    var_log_level_on_error="${3:-emergency}"
  declare -r var_default_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  declare    var_mod="${BASH_SOURCE[1]##*/}"; var_mod="${var_mod%%_*}()"

  if [[ -z "${var_chroot_script}" ]]; then

    do_log "emergency" "file_only" "1080() Empty command passed to 'chroot_script()'."
    return "${ERR_CHRT_COMMAND}"

  fi

  if ! chroot "${var_chroot_target}" /usr/bin/env -i \
    HOME="/root" \
    PATH="${var_default_path}" \
    TERM="${TERM}" \
    LANG="C.UTF-8" \
    LC_ALL="C.UTF-8" \
    DEBIAN_FRONTEND="noninteractive" \
    APT_LISTCHANGES_FRONTEND="none" \
    /bin/bash -o errexit -o errtrace -o functrace -o nounset -o pipefail \
    -O inherit_errexit -O failglob -O lastpipe -s

  then

    do_log "${var_log_level_on_error}" "file_only" "1080() Command of ${var_mod} [chroot ${var_chroot_target} /usr/bin/env -i HOME=/root PATH=${var_default_path} TERM=${TERM} LANG=C.UTF-8 LC_ALL=C.UTF-8 DEBIAN_FRONTEND=noninteractive APT_LISTCHANGES_FRONTEND=none /bin/bash -s] failed."

    if [[ "${VAR_CHROOT_DEBUG}" == "true" ]]; then

      if [[ "${VAR_DEBUG_TRACE}" == "true" || "${VAR_DEBUG_TRAP}" == "true" ]]; then dump_vars_exiting; fi

      case "${VAR_IN_DIALOG_WR}" in
        box   ) dialog_box_cleaner   ;;
        gauge ) dialog_gauge_cleaner ;;
        text  ) dialog_text_cleaner  ;;
      esac

      do_log "emergency" "tty" "1080() Launching interactive debug shell in chroot: '${var_chroot_target}'."

      chroot "${var_chroot_target}" /bin/bash -l

    else

      return "${ERR_CHRT_COMMAND}"

    fi

  else

    do_log "info" "file_only" "1080() Command of ${var_mod} [chroot ${var_chroot_target} /usr/bin/env -i HOME=/root PATH=${var_default_path} TERM=${TERM} LANG=C.UTF-8 LC_ALL=C.UTF-8 DEBIAN_FRONTEND=noninteractive APT_LISTCHANGES_FRONTEND=none /bin/bash -c ${var_chroot_script}] successful."
    return 0

  fi
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh