msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.13.404.2025.11.10

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-11-10 19:40:04 +01:00
parent 826d8607cb
commit e1928caf4a
5 changed files with 94 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
config/hooks/live/zzzz_luks_squash.hook.binary Normal file
View File

@@ -0,0 +1,19 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-10-11; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
set -Ceuo pipefail
printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" "${0}"
printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}"
exit 0
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

118
docs/AUDIT_LYNIS.md
View File

@@ -13,14 +13,14 @@ include_toc: true
# 2. Lynis Audit: # 2. Lynis Audit:
````text ````text
[ Lynis 3.1.4 ] [ Lynis 3.1.6 ]
################################################################################ ################################################################################
Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
welcome to redistribute it under the terms of the GNU General Public License. welcome to redistribute it under the terms of the GNU General Public License.
See the LICENSE file for details about using this software. See the LICENSE file for details about using this software.
2007-2024, CISOfy - https://cisofy.com/lynis/ 2007-2025, CISOfy - https://cisofy.com/lynis/
Enterprise support available (compliance, plugins, interface and tools) Enterprise support available (compliance, plugins, interface and tools)
################################################################################ ################################################################################
@@ -31,11 +31,12 @@ include_toc: true
- Checking profiles... [ DONE ] - Checking profiles... [ DONE ]
--------------------------------------------------- ---------------------------------------------------
Program version: 3.1.4 Program version: 3.1.6
Operating system: Linux Operating system: Linux
Operating system name: Debian Operating system name: Debian
Operating system version: 12 Operating system version: 13
Kernel version: 6.12.22+bpo End-of-life: UNKNOWN
Kernel version: 6.16.3+deb13
Hardware platform: x86_64 Hardware platform: x86_64
Hostname: live Hostname: live
--------------------------------------------------- ---------------------------------------------------
@@ -70,38 +71,40 @@ include_toc: true
- Checking Secure Boot [ DISABLED ] - Checking Secure Boot [ DISABLED ]
- Boot loader [ NONE FOUND ] - Boot loader [ NONE FOUND ]
- Check running services (systemctl) [ DONE ] - Check running services (systemctl) [ DONE ]
Result: found 17 running services Result: found 16 running services
- Check enabled services at boot (systemctl) [ DONE ] - Check enabled services at boot (systemctl) [ DONE ]
Result: found 24 enabled services Result: found 30 enabled services
- Check startup files (permissions) [ OK ] - Check startup files (permissions) [ OK ]
- Running 'systemd-analyze security' - Running 'systemd-analyze security'
Unit name (exposure value) and predicate Unit name (exposure value) and predicate
-------------------------------- --------------------------------
- auditd.service (value=8.7) [ EXPOSED ] - auditd.service (value=8.9) [ EXPOSED ]
- chrony.service (value=3.5) [ PROTECTED ] - chrony.service (value=3.5) [ PROTECTED ]
- clamav-daemon.service (value=3.5) [ PROTECTED ]
- cron.service (value=9.6) [ UNSAFE ] - cron.service (value=9.6) [ UNSAFE ]
- dbus.service (value=9.6) [ UNSAFE ] - dbus.service (value=9.3) [ UNSAFE ]
- dm-event.service (value=9.5) [ UNSAFE ] - dm-event.service (value=9.5) [ UNSAFE ]
- emergency.service (value=9.5) [ UNSAFE ] - emergency.service (value=9.5) [ UNSAFE ]
- fail2ban.service (value=6.5) [ MEDIUM ] - fail2ban.service (value=6.5) [ MEDIUM ]
- getty@tty1.service (value=9.6) [ UNSAFE ] - getty@tty1.service (value=9.6) [ UNSAFE ]
- haveged.service (value=3.0) [ PROTECTED ]
- ifup@ens3.service (value=9.5) [ UNSAFE ] - ifup@ens3.service (value=9.5) [ UNSAFE ]
- ifup@ens4.service (value=9.5) [ UNSAFE ] - ifup@ens4.service (value=9.5) [ UNSAFE ]
- jitterentropy.service (value=2.5) [ PROTECTED ]
- lvm2-lvmpolld.service (value=9.5) [ UNSAFE ] - lvm2-lvmpolld.service (value=9.5) [ UNSAFE ]
- polkit.service (value=9.6) [ UNSAFE ]
- rc-local.service (value=9.6) [ UNSAFE ] - rc-local.service (value=9.6) [ UNSAFE ]
- rescue.service (value=9.5) [ UNSAFE ] - rescue.service (value=9.5) [ UNSAFE ]
- rsyslog.service (value=9.6) [ UNSAFE ] - rng-tools-debian.service (value=9.1) [ UNSAFE ]
- rsyslog.service (value=4.5) [ PROTECTED ]
- ssh.service (value=9.6) [ UNSAFE ] - ssh.service (value=9.6) [ UNSAFE ]
- sshd@sshd-keygen.service (value=9.6) [ UNSAFE ]
- systemd-ask-password-console.service (value=9.4) [ UNSAFE ] - systemd-ask-password-console.service (value=9.4) [ UNSAFE ]
- systemd-ask-password-wall.service (value=9.4) [ UNSAFE ] - systemd-ask-password-wall.service (value=9.4) [ UNSAFE ]
- systemd-fsckd.service (value=9.5) [ UNSAFE ] - systemd-bsod.service (value=9.5) [ UNSAFE ]
- systemd-hostnamed.service (value=1.7) [ PROTECTED ]
- systemd-initctl.service (value=9.4) [ UNSAFE ] - systemd-initctl.service (value=9.4) [ UNSAFE ]
- systemd-journald.service (value=4.3) [ PROTECTED ] - systemd-journald.service (value=4.9) [ PROTECTED ]
- systemd-logind.service (value=2.8) [ PROTECTED ] - systemd-logind.service (value=2.8) [ PROTECTED ]
- systemd-networkd.service (value=2.6) [ PROTECTED ] - systemd-networkd.service (value=2.9) [ PROTECTED ]
- systemd-rfkill.service (value=9.4) [ UNSAFE ]
- systemd-udevd.service (value=7.1) [ MEDIUM ] - systemd-udevd.service (value=7.1) [ MEDIUM ]
- unattended-upgrades.service (value=9.6) [ UNSAFE ] - unattended-upgrades.service (value=9.6) [ UNSAFE ]
- usbguard-dbus.service (value=9.6) [ UNSAFE ] - usbguard-dbus.service (value=9.6) [ UNSAFE ]
@@ -111,23 +114,21 @@ include_toc: true
[+] Kernel [+] Kernel
------------------------------------ ------------------------------------
- Checking default runlevel [ runlevel 5 ] - Checking default runlevel [ runlevel 3 ]
- Checking CPU support (NX/PAE) - Checking CPU support (NX/PAE)
CPU support: PAE and/or NoeXecute supported [ FOUND ] CPU support: PAE and/or NoeXecute supported [ FOUND ]
- Checking kernel version and release [ DONE ] - Checking kernel version and release [ DONE ]
- Checking kernel type [ DONE ] - Checking kernel type [ DONE ]
- Checking loaded kernel modules [ DONE ] - Checking loaded kernel modules [ DONE ]
Found 84 active modules Found 139 active modules
- Checking Linux kernel configuration file [ FOUND ] - Checking Linux kernel configuration file [ FOUND ]
- Checking default I/O kernel scheduler [ NOT FOUND ] - Checking default I/O kernel scheduler [ NOT FOUND ]
- Checking for available kernel update [ OK ]
- Checking core dumps configuration - Checking core dumps configuration
- configuration in systemd conf files [ DEFAULT ] - configuration in systemd conf files [ DISABLED ]
- configuration in /etc/profile [ DEFAULT ] - configuration in /etc/profile [ DEFAULT ]
- 'hard' configuration in /etc/security/limits.conf [ DISABLED ] - 'hard' configuration in /etc/security/limits.conf [ DISABLED ]
- 'soft' configuration in /etc/security/limits.conf [ DISABLED ] - 'soft' configuration in /etc/security/limits.conf [ DISABLED ]
- Checking setuid core dumps configuration [ DISABLED ] - Checking setuid core dumps configuration [ DISABLED ]
- Check if reboot is needed [ NO ]
[+] Memory and Processes [+] Memory and Processes
------------------------------------ ------------------------------------
@@ -144,7 +145,6 @@ include_toc: true
- Unique group IDs [ OK ] - Unique group IDs [ OK ]
- Unique group names [ OK ] - Unique group names [ OK ]
- Password file consistency [ OK ] - Password file consistency [ OK ]
- Password hashing methods [ OK ]
- Password hashing rounds (minimum) [ CONFIGURED ] - Password hashing rounds (minimum) [ CONFIGURED ]
- Query system users (non daemons) [ DONE ] - Query system users (non daemons) [ DONE ]
- NIS+ authentication support [ NOT ENABLED ] - NIS+ authentication support [ NOT ENABLED ]
@@ -167,10 +167,9 @@ include_toc: true
- Checking expired passwords [ OK ] - Checking expired passwords [ OK ]
- Checking Linux single user mode authentication [ OK ] - Checking Linux single user mode authentication [ OK ]
- Determining default umask - Determining default umask
- umask (/etc/profile) [ NOT FOUND ]
- umask (/etc/login.defs) [ OK ] - umask (/etc/login.defs) [ OK ]
- LDAP authentication support [ NOT ENABLED ] - LDAP authentication support [ NOT ENABLED ]
- Logging failed login attempts [ ENABLED ] - Logging failed login attempts [ DISABLED ]
[+] Kerberos [+] Kerberos
------------------------------------ ------------------------------------
@@ -179,7 +178,7 @@ include_toc: true
[+] Shells [+] Shells
------------------------------------ ------------------------------------
- Checking shells from /etc/shells - Checking shells from /etc/shells
Result: found 12 shells (valid shells: 12). Result: found 11 shells (valid shells: 11).
- Session timeout settings/tools [ FOUND ] - Session timeout settings/tools [ FOUND ]
- Checking default umask values - Checking default umask values
- Checking default umask in /etc/bash.bashrc [ NONE ] - Checking default umask in /etc/bash.bashrc [ NONE ]
@@ -203,15 +202,9 @@ include_toc: true
- Mount options of /dev/shm [ PARTIALLY HARDENED ] - Mount options of /dev/shm [ PARTIALLY HARDENED ]
- Mount options of /run [ HARDENED ] - Mount options of /run [ HARDENED ]
- Mount options of /tmp [ PARTIALLY HARDENED ] - Mount options of /tmp [ PARTIALLY HARDENED ]
- Total without nodev:11 noexec:13 nosuid:9 ro or noexec (W^X): 9 of total 33 - Total without nodev:8 noexec:11 nosuid:6 ro or noexec (W^X): 8 of total 28
- Checking Locate database [ FOUND ] - Checking Locate database [ FOUND ]
- Disable kernel support of some filesystems - Disable kernel support of some filesystems
- Module cramfs is blacklisted [ OK ]
- Module freevxfs is blacklisted [ OK ]
- Module hfs is blacklisted [ OK ]
- Module hfsplus is blacklisted [ OK ]
- Module jffs2 is blacklisted [ OK ]
- Module udf is blacklisted [ OK ]
[+] USB Devices [+] USB Devices
------------------------------------ ------------------------------------
@@ -221,7 +214,7 @@ include_toc: true
- Configuration [ FOUND ] - Configuration [ FOUND ]
- Restore controller device state [ false ] - Restore controller device state [ false ]
- Rule for controllers connected before daemon starts [ keep ] - Rule for controllers connected before daemon starts [ keep ]
- Rule for devices connected before daemon starts [ allow ] - Rule for devices connected before daemon starts [ apply-policy ]
- Rule for devices inserted after daemon starts [ apply-policy ] - Rule for devices inserted after daemon starts [ apply-policy ]
- Rule for devices not in RuleFile [ block ] - Rule for devices not in RuleFile [ block ]
- RuleFile [ FOUND ] - RuleFile [ FOUND ]
@@ -239,6 +232,7 @@ include_toc: true
[+] Name services [+] Name services
------------------------------------ ------------------------------------
- Checking /etc/resolv.conf options [ FOUND ]
- Searching DNS domain name [ FOUND ] - Searching DNS domain name [ FOUND ]
Domain name: local Domain name: local
- Checking /etc/hosts - Checking /etc/hosts
@@ -256,8 +250,13 @@ include_toc: true
- debsums utility [ FOUND ] - debsums utility [ FOUND ]
- Cron job for debsums [ FOUND ] - Cron job for debsums [ FOUND ]
- Checking security repository in sources.list file [ OK ] - Checking security repository in sources.list file [ OK ]
- Checking security repository in sources.list.d directory [ OK ]
- Checking APT package database [ OK ] - Checking APT package database [ OK ]
W: https://deb.nodesource.com/node_22.x/dists/nodistro/InRelease: Policy will reject signature within a year, see --audit for details
- Checking vulnerable packages (apt-get only) [ DONE ] - Checking vulnerable packages (apt-get only) [ DONE ]
[WARNING]: Test PKGS-7392 had a long execution: 21.028694 seconds
- Checking upgradeable packages [ NONE ] - Checking upgradeable packages [ NONE ]
- Checking package audit tool [ INSTALLED ] - Checking package audit tool [ INSTALLED ]
Found: apt-get Found: apt-get
@@ -272,6 +271,7 @@ include_toc: true
- Testing nameservers - Testing nameservers
Nameserver: 135.181.207.105 [ OK ] Nameserver: 135.181.207.105 [ OK ]
Nameserver: 89.58.62.53 [ OK ] Nameserver: 89.58.62.53 [ OK ]
Nameserver: 138.199.237.109 [ OK ]
- Minimal of 2 responsive nameservers [ OK ] - Minimal of 2 responsive nameservers [ OK ]
- Checking default gateway [ DONE ] - Checking default gateway [ DONE ]
- Getting listening ports (TCP/UDP) [ DONE ] - Getting listening ports (TCP/UDP) [ DONE ]
@@ -408,10 +408,11 @@ include_toc: true
[+] Cryptography [+] Cryptography
------------------------------------ ------------------------------------
- Checking for expired SSL certificates [0/139] [ NONE ] - Checking for expired SSL certificates [0/151] [ NONE ]
[WARNING]: Test CRYP-7902 had a long execution: 20.445007 seconds [WARNING]: Test CRYP-7902 had a long execution: 31.463606 seconds
- Found 10 LUKS encrypted block devices. [ OK ]
- Found 0 encrypted and 0 unencrypted swap devices in use. [ OK ] - Found 0 encrypted and 0 unencrypted swap devices in use. [ OK ]
- Kernel entropy is sufficient [ YES ] - Kernel entropy is sufficient [ YES ]
- HW RNG & rngd [ NO ] - HW RNG & rngd [ NO ]
@@ -427,11 +428,12 @@ include_toc: true
[+] Security frameworks [+] Security frameworks
------------------------------------ ------------------------------------
- Checking presence AppArmor [ FOUND ] - Checking presence AppArmor [ FOUND ]
- Checking AppArmor status [ DISABLED ] - Checking AppArmor status [ ENABLED ]
Found 43 unconfined processes
- Checking presence SELinux [ NOT FOUND ] - Checking presence SELinux [ NOT FOUND ]
- Checking presence TOMOYO Linux [ NOT FOUND ] - Checking presence TOMOYO Linux [ NOT FOUND ]
- Checking presence grsecurity [ NOT FOUND ] - Checking presence grsecurity [ NOT FOUND ]
- Checking for implemented MAC framework [ NONE ] - Checking for implemented MAC framework [ OK ]
[+] Software: file integrity [+] Software: file integrity
------------------------------------ ------------------------------------
@@ -455,9 +457,7 @@ include_toc: true
[+] Software: Malware [+] Software: Malware
------------------------------------ ------------------------------------
- Checking chkrootkit [ FOUND ]
- Checking Rootkit Hunter [ FOUND ] - Checking Rootkit Hunter [ FOUND ]
- Checking ClamAV scanner [ FOUND ]
- Malware software components [ FOUND ] - Malware software components [ FOUND ]
- Active agent [ NOT FOUND ] - Active agent [ NOT FOUND ]
- Rootkit scanner [ FOUND ] - Rootkit scanner [ FOUND ]
@@ -546,12 +546,16 @@ include_toc: true
================================================================================ ================================================================================
-[ Lynis 3.1.4 Results ]- -[ Lynis 3.1.6 Results ]-
Great, no warnings Great, no warnings
Suggestions (5): Suggestions (6):
---------------------------- ----------------------------
* Determine runlevel and services at startup [BOOT-5180]
- Related resources
* Website: https://cisofy.com/lynis/controls/BOOT-5180/
* Consider hardening system services [BOOT-5264] * Consider hardening system services [BOOT-5264]
- Details : Run '/usr/bin/systemd-analyze security SERVICE' for each service - Details : Run '/usr/bin/systemd-analyze security SERVICE' for each service
- Related resources - Related resources
@@ -585,34 +589,44 @@ include_toc: true
Lynis security scan details: Lynis security scan details:
Hardening index : 92 [################## ]
Tests performed : 261
Plugins enabled : 0
Components:
- Firewall [V]
- Malware scanner [V]
Scan mode: Scan mode:
Normal [V] Forensics [ ] Integration [ ] Pentest [ ] Normal [▆] Forensics [ ] Integration [ ] Pentest [ ]
Lynis modules: Lynis modules:
- Compliance status [?] - Compliance status [?]
- Security audit [V] - Security audit [V]
- Vulnerability scan [V] - Vulnerability scan [V]
Details:
Hardening index : 93 [################## ]
Tests performed : 258
Plugins enabled : 0
Software components:
- Firewall [V]
- Intrusion software [V]
- Malware scanner [V]
Files: Files:
- Test and debug information : /var/log/lynis.log - Test and debug information : /var/log/lynis.log
- Report data : /var/log/lynis-report.dat - Report data : /var/log/lynis-report.dat
================================================================================ ================================================================================
Lynis 3.1.4 Notice: No OS entry was found in the end-of-life database
What to do:
Please submit a pull request on GitHub to include your OS version and the end date of this OS version is being supported
URL: https://github.com/CISOfy/lynis
================================================================================
Lynis 3.1.6
Auditing, system hardening, and compliance for UNIX-based systems Auditing, system hardening, and compliance for UNIX-based systems
(Linux, macOS, BSD, and others) (Linux, macOS, BSD, and others)
2007-2024, CISOfy - https://cisofy.com/lynis/ 2007-2025, CISOfy - https://cisofy.com/lynis/
Enterprise support available (compliance, plugins, interface and tools) Enterprise support available (compliance, plugins, interface and tools)
================================================================================ ================================================================================

13
docs/CHANGELOG.md
View File

@@ -34,6 +34,7 @@ include_toc: true
* **Changed**: [9940_hardening_memory.dump.chroot](../config/hooks/live/9940_hardening_memory.dump.chroot) + added: 9999-ciss-coredump-disable.conf * **Changed**: [9940_hardening_memory.dump.chroot](../config/hooks/live/9940_hardening_memory.dump.chroot) + added: 9999-ciss-coredump-disable.conf
* **Changed**: [9992_password_expiration.chroot](../config/hooks/live/9992_password_expiration.chroot) + added: ``update_shadow()`` * **Changed**: [9992_password_expiration.chroot](../config/hooks/live/9992_password_expiration.chroot) + added: ``update_shadow()``
* **Changed**: [lib_clean_up.sh](../lib/lib_clean_up.sh) + added: Securely shred all regular files below ./includes.chroot, then remove empty dirs. * **Changed**: [lib_clean_up.sh](../lib/lib_clean_up.sh) + added: Securely shred all regular files below ./includes.chroot, then remove empty dirs.
* **Updated**: [AUDIT_LYNIS.md](AUDIT_LYNIS.md) + updated: Lynis Version 3.1.6
## V8.13.400.2025.11.08 ## V8.13.400.2025.11.08
* **Bugfixes**: [0030-verify-checksums](../config/includes.chroot/usr/lib/live/boot/0030-verify-checksums) - GPG key handling * **Bugfixes**: [0030-verify-checksums](../config/includes.chroot/usr/lib/live/boot/0030-verify-checksums) - GPG key handling
@@ -121,7 +122,7 @@ include_toc: true
* **Updated**: [0001_initramfs_modules.chroot](../config/hooks/live/0001_initramfs_modules.chroot) + update_initramfs=all COMPRESSLEVEL=10 * **Updated**: [0001_initramfs_modules.chroot](../config/hooks/live/0001_initramfs_modules.chroot) + update_initramfs=all COMPRESSLEVEL=10
* **Updated**: [0007_update_logrotate.chroot](../config/hooks/live/0007_update_logrotate.chroot) = rotate 90; maxage 90 * **Updated**: [0007_update_logrotate.chroot](../config/hooks/live/0007_update_logrotate.chroot) = rotate 90; maxage 90
* **Updated**: [9999_yyyy_logrotate.chroot](../config/hooks/live/9999_yyyy_logrotate.chroot) = rotate 90 * **Updated**: [9999_yyyy_logrotate.chroot](../config/hooks/live/9999_yyyy_logrotate.chroot) = rotate 90
* **Updated**: [9999-cdi-starter](../scripts/usr/local/sbin/9999-cdi-starter) = unified logging * **Updated**: [9999-cdi-starter](../scripts/usr/local/sbin/9999_cdi_starter.sh) = unified logging
## V8.13.292.2025.10.27 ## V8.13.292.2025.10.27
* **Updated**: [alias](../config/includes.chroot/root/.ciss/alias) = modified trel() * **Updated**: [alias](../config/includes.chroot/root/.ciss/alias) = modified trel()
@@ -129,7 +130,7 @@ include_toc: true
## V8.13.290.2025.10.26 ## V8.13.290.2025.10.26
* **Updated**: [0001_initramfs_modules.chroot](../config/hooks/live/0001_initramfs_modules.chroot) + ESP/FAT/UEFI mods * **Updated**: [0001_initramfs_modules.chroot](../config/hooks/live/0001_initramfs_modules.chroot) + ESP/FAT/UEFI mods
* **Updated**: [9950_hardening_fail2ban.chroot](../config/hooks/live/9950_hardening_fail2ban.chroot) * **Updated**: [9950_hardening_fail2ban.chroot](../config/hooks/live/9950_hardening_fail2ban.chroot)
* **Updated**: [9999-cdi-starter](../scripts/usr/local/sbin/9999-cdi-starter) Preparations for CISS and PhysNet primordial-workflow™. * **Updated**: [9999-cdi-starter](../scripts/usr/local/sbin/9999_cdi_starter.sh) Preparations for CISS and PhysNet primordial-workflow™.
## V8.13.288.2025.10.24 ## V8.13.288.2025.10.24
* **Added**: Preparations for CISS and PhysNet primordial-workflow™. * **Added**: Preparations for CISS and PhysNet primordial-workflow™.
@@ -152,7 +153,7 @@ include_toc: true
* **Updated**: [9996_auditd.chroot](../config/hooks/live/9996_auditd.chroot) unified auditd configuration, removed success rules * **Updated**: [9996_auditd.chroot](../config/hooks/live/9996_auditd.chroot) unified auditd configuration, removed success rules
* **Updated**: [9998_sources_list_trixie.chroot](../config/hooks/live/9998_sources_list_trixie.chroot) + apt-get dist-upgrade -y * **Updated**: [9998_sources_list_trixie.chroot](../config/hooks/live/9998_sources_list_trixie.chroot) + apt-get dist-upgrade -y
* **Updated**: [login.defs](../config/includes.chroot/etc/login.defs) * **Updated**: [login.defs](../config/includes.chroot/etc/login.defs)
* **Updated**: [9999-cdi-starter](../scripts/usr/local/sbin/9999-cdi-starter) * **Updated**: [9999-cdi-starter](../scripts/usr/local/sbin/9999_cdi_starter.sh)
## V8.13.256.2025.10.21 ## V8.13.256.2025.10.21
* **Updated**: [0007_update_logrotate.chroot](../config/hooks/live/0007_update_logrotate.chroot) * **Updated**: [0007_update_logrotate.chroot](../config/hooks/live/0007_update_logrotate.chroot)
@@ -183,7 +184,7 @@ include_toc: true
* **Changed**: [0090_jitterentropy.chroot](../config/hooks/live/0090_jitterentropy.chroot) * **Changed**: [0090_jitterentropy.chroot](../config/hooks/live/0090_jitterentropy.chroot)
## V8.13.142.2025.10.14 ## V8.13.142.2025.10.14
* **Updated**: [9999-cdi-starter](../scripts/usr/local/sbin/9999-cdi-starter) * **Updated**: [9999-cdi-starter](../scripts/usr/local/sbin/9999_cdi_starter.sh)
## V8.13.132.2025.10.11 ## V8.13.132.2025.10.11
* **Added**: [REPOSITORY.md](../REPOSITORY.md) * **Added**: [REPOSITORY.md](../REPOSITORY.md)
@@ -218,7 +219,7 @@ include_toc: true
* **Added**: [lib_note_target.sh](../lib/lib_note_target.sh) * **Added**: [lib_note_target.sh](../lib/lib_note_target.sh)
* **Updated**: [lib_trap_on_err.sh](../lib/lib_trap_on_err.sh) * **Updated**: [lib_trap_on_err.sh](../lib/lib_trap_on_err.sh)
* **Updated**: [lib_trap_on_exit.sh](../lib/lib_trap_on_exit.sh) * **Updated**: [lib_trap_on_exit.sh](../lib/lib_trap_on_exit.sh)
* **Updated**: [9999-cdi-starter](../scripts/usr/local/sbin/9999-cdi-starter) * **Updated**: [9999-cdi-starter](../scripts/usr/local/sbin/9999_cdi_starter.sh)
* **Updated**: [9980_usb_guard.chroot](../config/hooks/live/9980_usb_guard.chroot) * **Updated**: [9980_usb_guard.chroot](../config/hooks/live/9980_usb_guard.chroot)
* **Updated**: [9998_sources_list_bookworm.chroot](../.archive/9998_sources_list_bookworm.chroot) * **Updated**: [9998_sources_list_bookworm.chroot](../.archive/9998_sources_list_bookworm.chroot)
* **Updated**: [9998_sources_list_trixie.chroot](../config/hooks/live/9998_sources_list_trixie.chroot) * **Updated**: [9998_sources_list_trixie.chroot](../config/hooks/live/9998_sources_list_trixie.chroot)
@@ -230,7 +231,7 @@ include_toc: true
## V8.13.048.2025.10.06 ## V8.13.048.2025.10.06
* **Updated**: Debian 13 LIVE ISO workflows to use Kernel: ``6.16.3+deb13-amd64`` * **Updated**: Debian 13 LIVE ISO workflows to use Kernel: ``6.16.3+deb13-amd64``
* **Updated**: Debian 13 LIVE ISO workflows to use argument: ``--cdi`` * **Updated**: Debian 13 LIVE ISO workflows to use argument: ``--cdi``
* **Updated**: [9000-cdi-starter](../scripts/usr/local/sbin/9999-cdi-starter) * **Updated**: [9000-cdi-starter](../scripts/usr/local/sbin/9999_cdi_starter.sh)
## V8.13.032.2025.10.03 ## V8.13.032.2025.10.03
* **Added**: Internal Gitea Action Runner switch for static SSHFP records. * **Added**: Internal Gitea Action Runner switch for static SSHFP records.

4
lib/lib_cdi.sh
View File

@@ -30,7 +30,7 @@ cdi() {
if [[ "${VAR_HANDLER_CDI}" == "true" ]]; then if [[ "${VAR_HANDLER_CDI}" == "true" ]]; then
install -m 0400 -o root -g root /dev/null /root/.cdi install -m 0400 -o root -g root /dev/null "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.cdi"
if [[ ! -d "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/usr/local/sbin" ]]; then if [[ ! -d "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/usr/local/sbin" ]]; then
@@ -38,7 +38,7 @@ cdi() {
fi fi
install -m 0755 -o root -g root "${VAR_WORKDIR}/scripts/usr/local/sbin/9999-cdi-starter" "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/usr/local/sbin/9999-cdi-starter.sh" install -m 0755 -o root -g root "${VAR_WORKDIR}/scripts/usr/local/sbin/9999_cdi_starter.sh" "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/usr/local/sbin/9999_cdi_starter.sh"
declare tmp_entry declare tmp_entry
tmp_entry="$(mktemp)" tmp_entry="$(mktemp)"

1
scripts/usr/local/sbin/9999-cdi-starter → scripts/usr/local/sbin/9999_cdi_starter.sh
View File

@@ -1,5 +1,4 @@
#!/bin/bash #!/bin/bash
# bashsupport disable=BP5004
# SPDX-Version: 3.0 # SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-10-06; WEIDNER, Marc S.; <msw@coresecret.dev> # SPDX-CreationInfo: 2025-10-06; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git