Marc S. Weidner
c026d9a324
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 39s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
84 lines
3.8 KiB
Bash
84 lines
3.8 KiB
Bash
#!/bin/bash
|
|
# SPDX-Version: 3.0
|
|
# SPDX-CreationInfo: 2025-02-13; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
|
# SPDX-ExternalRef: GIT https://cendev.eu/marc.weidner/CISS.2025.debian.installer.git
|
|
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
|
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
|
# SPDX-FileType: SOURCE
|
|
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
|
# SPDX-LicenseComment: This file is part of the CISS.2025.hardened.installer framework.
|
|
# SPDX-PackageName: CISS.2025.hardened.installer
|
|
# SPDX-Security-Contact: security@coresecret.eu
|
|
|
|
###########################################################################################
|
|
# Mounting '/dev/mapper/crypt_rescue', debootstrap recovery partition, preparing chroot.
|
|
# Globals:
|
|
# ERR_CHROOT_MOUNTS
|
|
# ERR_DE_BOOT_STRAP
|
|
# MODULE_ERR
|
|
# MODULE_TXT
|
|
# RECOVERY
|
|
# TARGET
|
|
# Arguments:
|
|
# None
|
|
###########################################################################################
|
|
setup_recovery() {
|
|
|
|
# The '/dev/mapper/crypt_rescue' partition is not mounted by the installation script by default,
|
|
# as it is not required to be automatically mounted by the production system via '/etc/crypttab' and '/etc/fstab'.
|
|
mount /dev/mapper/crypt_rescue "${RECOVERY}"
|
|
|
|
# Debootstrap for a minimalistic Debian OS.
|
|
if debootstrap --arch amd64 bookworm "${RECOVERY}" https://deb.debian.org/debian; then
|
|
do_log "info" "file_only" "Executing 'debootstrap --arch amd64 bookworm '${RECOVERY}' https://deb.debian.org/debian' successful."
|
|
else
|
|
do_log "emergency" "file_only" "Executing 'debootstrap --arch amd64 bookworm '${RECOVERY}' https://deb.debian.org/debian' NOT successful."
|
|
exit "${ERR_DE_BOOT_STRAP}"
|
|
fi
|
|
|
|
### Reminder ###
|
|
# --rbind: recursive binding.
|
|
# --make-rslave: In this case, the mount point is marked as 'slave'.
|
|
# This means changes to the source mount (e.g., /proc) are propagated to the target mount (e.g., "${TARGET}"/proc).
|
|
# Conversely, changes to the target mount are not propagated back to the source mount.
|
|
# This mode is necessary to avoid problems with double or erroneous propagation effects in chroot or container environments.
|
|
|
|
# Prepare the freshly installed Debian OS recovery system for further setup.
|
|
if mount --make-rslave --rbind /proc "${RECOVERY}"/proc; then
|
|
do_log "info" "file_only" "'mount --make-rslave --rbind /proc ${RECOVERY}/proc'."
|
|
else
|
|
do_log "emergency" "file_only" "Failed: 'mount --make-rslave --rbind /proc ${RECOVERY}/proc'."
|
|
exit "${ERR_CHROOT_MOUNTS}"
|
|
fi
|
|
|
|
if mount --make-rslave --rbind /sys "${RECOVERY}"/sys; then
|
|
do_log "info" "file_only" "'mount --make-rslave --rbind /sys ${RECOVERY}/sys'."
|
|
else
|
|
do_log "emergency" "file_only" "Failed: 'mount --make-rslave --rbind /sys ${RECOVERY}/sys'."
|
|
exit "${ERR_CHROOT_MOUNTS}"
|
|
fi
|
|
|
|
if mount --make-rslave --rbind /dev "${RECOVERY}"/dev; then
|
|
do_log "info" "file_only" "'mount --make-rslave --rbind /dev ${RECOVERY}/dev'."
|
|
else
|
|
do_log "emergency" "file_only" "Failed: 'mount --make-rslave --rbind /dev ${RECOVERY}/dev'."
|
|
exit "${ERR_CHROOT_MOUNTS}"
|
|
fi
|
|
|
|
if mount --make-rslave --rbind /run "${RECOVERY}"/run; then
|
|
do_log "info" "file_only" "'mount --make-rslave --rbind /run ${RECOVERY}/run'."
|
|
else
|
|
do_log "emergency" "file_only" "Failed: 'mount --make-rslave --rbind /run ${RECOVERY}/run'."
|
|
exit "${ERR_CHROOT_MOUNTS}"
|
|
fi
|
|
|
|
if do_in_target "${TARGET}" mkdir -p /etc/systemd/system/multi-user.target.wants; then
|
|
do_log "info" "file_only" "Command: 'mkdir -p /etc/systemd/system/multi-user.target.wants' executed in: '${RECOVERY}'."
|
|
else
|
|
do_log "emergency" "file_only" "Failed: Command: 'mkdir -p /etc/systemd/system/multi-user.target.wants' executed in: '${RECOVERY}'."
|
|
fi
|
|
|
|
do_show_footer "${MODULE_TXT}"
|
|
}
|
|
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
|