From 42a7ffe979275c86e13bff20854c4411bac7aecb57fd63d2f9b3a2dc9b79ab17 Mon Sep 17 00:00:00 2001 From: "Marc S. Weidner" Date: Mon, 10 Nov 2025 23:12:16 +0100 Subject: [PATCH] V8.13.404.2025.11.10 Signed-off-by: Marc S. Weidner --- config/hooks/live/0003_cdi_autostart.chroot | 4 +- .../hooks/live/zzzz_luks_squash.hook.binary | 114 ++++++++++++++++++ .../initramfs-tools/files/unlock_wrapper.sh | 4 +- docs/CHANGELOG.md | 1 + lib/lib_check_secrets.sh | 1 + lib/lib_clean_up.sh | 4 + 6 files changed, 125 insertions(+), 3 deletions(-) diff --git a/config/hooks/live/0003_cdi_autostart.chroot b/config/hooks/live/0003_cdi_autostart.chroot index 802d4d3..c1bc64d 100644 --- a/config/hooks/live/0003_cdi_autostart.chroot +++ b/config/hooks/live/0003_cdi_autostart.chroot @@ -19,14 +19,14 @@ if [[ -f /root/.cdi ]]; then [Unit] Description=CISS CDI post-boot starter Documentation=https://git.coresecret.dev/msw/CISS.debian.live.builder.git -ConditionPathIsExecutable=/usr/local/sbin/9999-cdi-starter.sh +ConditionPathIsExecutable=/usr/local/sbin/9999_cdi_starter.sh After=live-config.service systemd-user-sessions.service getty.target After=network-online.target NetworkManager-wait-online.service systemd-networkd-wait-online.service Wants=network-online.target [Service] Type=idle -ExecStart=/usr/local/sbin/9999-cdi-starter.sh +ExecStart=/usr/local/sbin/9999_cdi_starter.sh TimeoutStartSec=1min Nice=5 IOSchedulingClass=best-effort diff --git a/config/hooks/live/zzzz_luks_squash.hook.binary b/config/hooks/live/zzzz_luks_squash.hook.binary index 0cb6019..6e9801f 100644 --- a/config/hooks/live/zzzz_luks_squash.hook.binary +++ b/config/hooks/live/zzzz_luks_squash.hook.binary @@ -11,8 +11,122 @@ # SPDX-Security-Contact: security@coresecret.eu set -Ceuo pipefail +__umask=$(umask) +umask 0077 + +####################################### +# Pre allocates space for LUKS container. +# Globals: +# None +# Arguments: +# 1: LUKS Container +# 2: LUKS Container Size +# Returns: +# 0: on success +# 42: on failure +####################################### +preallocate() { + declare file="$1" size="$2" + declare -i blocksize=$((8*1024*1024)) + declare -i blockcounter=$(( (size + blocksize - 1) / blocksize )) + + if fallocate -l "${size}" -- "${file}" 2>/dev/null; then + + printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ [fallocate -l %s -- %s] successful. \e[0m\n" "${size}" "${file}" + return 0 + + else + + printf "\e[93m++++ ++++ ++++ ++++ ++++ ++++ ++ ⚠️ [fallocate -l %s -- %s] NOT successful. \e[0m\n" "${size}" "${file}" + + fi + + if dd if=/dev/zero of="${file}" bs="${blocksize}" count="${blockcounter}" status=progress conv=fsync; then + + printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ [dd if=/dev/zero of=%s bs=%s count=%s status=progress conv=fsync ] successful. \e[0m\n" "${file}" "${blocksize}" "${blockcounter}" + return 0 + + else + + printf "\e[93m++++ ++++ ++++ ++++ ++++ ++++ ++ ⚠️ [dd if=/dev/zero of=%s bs=%s count=%s status=progress conv=fsync ] NOT successful. \e[0m\n" "${file}" "${blocksize}" "${blockcounter}" + return 42 + + fi +} +### Prevents accidental 'unset -f'. +# shellcheck disable=SC2034 +readonly -f preallocate + printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" "${0}" +declare ROOTFS="${VAR_HANDLER_BUILD_DIR}/binary/live/filesystem.squashfs" +declare LUKSFS="${VAR_HANDLER_BUILD_DIR}/binary/live/rootfs.crypt" +declare KEYFD="" + +# shellcheck disable=SC2155 +declare -i SIZE=$(stat -c%s -- "${ROOTFS}") + +### Safety margin: +# - LUKS2-Header and Metadata +# - dm-integrity Overhead (Tags and Journal) +# - Filesystem-Slack +declare -i OVERHEAD_FIXED=$((64 * 1024 * 1024)) +declare -i OVERHEAD_PCT=3 +declare -i ALIGN_BYTES=$(( 2048 * 1024 )) +declare -i BASE_SIZE=$(( SIZE + OVERHEAD_FIXED + (SIZE * OVERHEAD_PCT / 100) )) +declare -i LUKSFS_SIZE=$(( ( (BASE_SIZE + ALIGN_BYTES - 1) / ALIGN_BYTES ) * ALIGN_BYTES )) + +preallocate "${LUKSFS}" "${LUKSFS_SIZE}" + +exec {KEYFD}<"${VAR_TMP_SECRET}/luks.txt" + +cryptsetup luksFormat \ + --batch-mode \ + --cipher aes-xts-plain64 \ + --integrity hmac-sha512 \ + --iter-time 1000 \ + --key-file "/proc/$$/fd/${KEYFD}" \ + --key-size 512 \ + --label crypt_liveiso \ + --luks2-keyslots-size 16777216 \ + --luks2-metadata-size 4194304 \ + --pbkdf argon2id \ + --sector-size 4096 \ + --type luks2 \ + --use-random \ + --verbose \ + "${LUKSFS}" + +cryptsetup open --key-file "/proc/$$/fd/${KEYFD}" "${LUKSFS}" crypt_liveiso + +# shellcheck disable=SC2155 +declare -i LUKS_FREE=$(blockdev --getsize64 /dev/mapper/crypt_liveiso) +declare -i SQUASH_FS="${SIZE}" + +if (( LUKS_FREE >= SQUASH_FS )); then + + printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ LUKS_FREE '%s' >= SQUASH_FS '%s' \e[0m\n" "${LUKS_FREE}" "${SQUASH_FS}" + +else + + printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ LUKS_FREE '%s' <= SQUASH_FS '%s' \e[0m\n" "${LUKS_FREE}" "${SQUASH_FS}" >&2 + exit 42 + +fi + +dd if="${ROOTFS}" of=/dev/mapper/crypt_liveiso bs=8M status=progress conv=fsync +sync +cryptsetup close crypt_liveiso + +exec {KEYFD}<&- + +shred -fzu -n 5 -- "${VAR_TMP_SECRET}/luks.txt" + +#rm -f -- "${ROOTFS}" + +umask "${__umask}" +__umask="" + printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}" exit 0 diff --git a/config/includes.chroot/etc/initramfs-tools/files/unlock_wrapper.sh b/config/includes.chroot/etc/initramfs-tools/files/unlock_wrapper.sh index 7c8d925..fc38d88 100644 --- a/config/includes.chroot/etc/initramfs-tools/files/unlock_wrapper.sh +++ b/config/includes.chroot/etc/initramfs-tools/files/unlock_wrapper.sh @@ -98,6 +98,7 @@ extract_nuke_hash() { for ARG in ${CMDLINE}; do + # shellcheck disable=SC2249 case "${ARG,,}" in nuke=*) @@ -397,9 +398,10 @@ verify_script() { color_echo "${MAG}" "🔢 Recomputing Hash: [${item}]" + declare _="" # shellcheck disable=SC2312 read -r computed _ < <("${cmd}" "${dir}/${script}") - read -r expected < "${hashfile}" + read -r expected _ < "${hashfile}" if [[ "${computed}" != "${expected}" ]]; then diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index c224ba1..9fefbfc 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -22,6 +22,7 @@ include_toc: true * **Added**: [0000_ciss_fixpath.sh](../config/includes.chroot/etc/initramfs-tools/scripts/init-top/0000_ciss_fixpath.sh) * **Added**: [dropbear](../config/includes.chroot/usr/share/initramfs-tools/scripts/init-premount/dropbear) * **Added**: [MAN_SSH_Host_Key_Policy.md](MAN_SSH_Host_Key_Policy.md) +* **Added**: [zzzz_luks_squash.hook.binary](../config/hooks/live/zzzz_luks_squash.hook.binary) + Preparing squashfs LUKS encryption * **Bugfixes**: [generate_PRIVATE_trixie_0.yaml](../.gitea/workflows/generate_PRIVATE_trixie_0.yaml) + updated: Preparing SSH Setup, SSH Deploy Key, Known Hosts, .config. * **Bugfixes**: [generate_PRIVATE_trixie_1.yaml](../.gitea/workflows/generate_PRIVATE_trixie_1.yaml) + updated: Preparing SSH Setup, SSH Deploy Key, Known Hosts, .config. * **Bugfixes**: [generate_PUBLIC_iso.yaml](../.gitea/workflows/generate_PUBLIC_iso.yaml) + updated: Preparing SSH Setup, SSH Deploy Key, Known Hosts, .config. diff --git a/lib/lib_check_secrets.sh b/lib/lib_check_secrets.sh index 93f8500..23527c6 100644 --- a/lib/lib_check_secrets.sh +++ b/lib/lib_check_secrets.sh @@ -32,6 +32,7 @@ x_remove() { # shellcheck disable=SC2312 find "${VAR_TMP_SECRET}" -xdev -type f \ ! -path "${VAR_TMP_SECRET}/signing_key_pass.txt" \ + ! -path "${VAR_TMP_SECRET}/luks.txt" \ -print0 \ | xargs -0 --no-run-if-empty shred -fzu -n 5 -- diff --git a/lib/lib_clean_up.sh b/lib/lib_clean_up.sh index 6be1984..b709a1b 100644 --- a/lib/lib_clean_up.sh +++ b/lib/lib_clean_up.sh @@ -40,6 +40,10 @@ clean_up() { shopt -s nullglob dotglob shopt -u failglob + if [[ -e /dev/mapper/crypt_liveiso ]]; then + cryptsetup close crypt_liveiso || true + fi + rm -f -- "${VAR_KERNEL_INF}" rm -f -- "${VAR_KERNEL_SRT}" rm -f -- "${VAR_KERNEL_TMP}"