calamares

gistfile1.txt

# SPDX-FileCopyrightText: no
# SPDX-License-Identifier: CC0-1.0
# /etc/calamares/modules/shellprocess/shellprocess@luksfix.conf
---
id: luksfix
dontChroot: false
timeout: 90
name: "Configuring single-passphrase boot bypass..."

script:
  # 1. Write the clean, standalone script file using a literal text block
  - |
    cat << 'EOF' > /tmp/luks-bypass.sh
    #!/bin/bash
    set -x
    set -e
    
    mkdir -p /boot/cryptsetup-keys.d
    dd bs=512 count=8 if=/dev/urandom of=/boot/cryptsetup-keys.d/root.key iflag=fullblock
    chmod 400 /boot/cryptsetup-keys.d/root.key
    echo "# Automatically generated by Mobian FDE Fix" > /etc/crypttab

    ls /dev/mapper/luks-* 2>/dev/null | while read -r mapper_path; do
        MAP_NAME=$(basename "$mapper_path")
        UUID_HEX=$(cryptsetup luksUUID "$mapper_path" 2>/dev/null || echo "")
        if [ -n "$UUID_HEX" ]; then
            PHYS_PART=$(blkid -U "$UUID_HEX" 2>/dev/null || echo "")
            if [ -n "$PHYS_PART" ]; then
                echo "Enrolling keyfile into LUKS slot for: $PHYS_PART"
                echo -n "$PASSPHRASE_TOKEN" | cryptsetup luksAddKey "$PHYS_PART" /boot/cryptsetup-keys.d/root.key
                echo "${MAP_NAME} UUID=${UUID_HEX} /boot/cryptsetup-keys.d/root.key luks,initramfs" >> /etc/crypttab
            fi
        fi
    done
    
    mkdir -p /etc/cryptsetup-initramfs
    echo 'KEYFILE_PATTERN="/boot/cryptsetup-keys.d/*.key"' >> /etc/cryptsetup-initramfs/conf-hook
    EOF

  # 2. Make the script executable
  - "chmod +x /tmp/luks-bypass.sh"

  # 3. Execute the script while safely injecting the Calamares password variable from the host
  - "PASSPHRASE_TOKEN=${PASSWORD} /tmp/luks-bypass.sh"

  # 4. Clean up the temporary script file
  - "rm -f /tmp/luks-bypass.sh"

gistfile2.txt

# /etc/calamares/modules/shellprocess@cryptfix.conf
---
dontChroot: true   # Keep this TRUE so the script can map the host's real disk layout
timeout: 30
script:
  - description: "Dynamically mapping host LUKS parameters to the target configuration..."
    command: |
      # 1. Locate where Calamares has currently mounted the target root image on the live host
      TARGET_MOUNT=$(mount | grep 'calamares-root' | grep 'on /tmp/' | head -n 1 | awk '{print $3}')
      
      # Validate that a mount target was actually discovered before continuing
      if [ -z "$TARGET_MOUNT" ]; then
          echo "ERROR: Calamares target mount point could not be detected!"
          exit 1
      fi

      # 2. Extract the underlying mapper device node handling the filesystem
      TARGET_DEV=$(mount | grep "on ${TARGET_MOUNT}" | awk '{print $1}')

      # 3. Retrieve the matching true physical LUKS disk partition UUID
      REAL_UUID=$(blkid -o value -s UUID ${TARGET_DEV})
      
      if [ -z "$REAL_UUID" ]; then
          echo "ERROR: Failed to resolve the underlying LUKS container UUID!"
          exit 1
      fi

      # 4. Mount target is on the host, so write directly to its absolute path offset
      echo "cryptroot UUID=${REAL_UUID} none luks,initramfs" > "${TARGET_MOUNT}/etc/crypttab"
      
      # Output confirmation directly to Calamares logs for clean debugging
      echo "SUCCESS: Wrote cryptroot entry with UUID=${REAL_UUID} directly to ${TARGET_MOUNT}/etc/crypttab"

Diagnostics 12/07/10AM

echo "================================================================="
echo "        CALAMARES CRYPTOGRAPHIC SYSTEM AUDIT INTERFACE           "
echo "================================================================="
echo ""

echo "[1/5] SCANNING RAW VIRTUAL DISK CHANNELS..."
lsblk -o NAME,FSTYPE,SIZE,UUID,MOUNTPOINTS /dev/vda
echo ""

echo "[2/5] AUDITING ACTIVE KERNEL MAPPER PROFILES..."
sudo cryptsetup status luks-0c349def-f79f-4dc7-934c-4fc12238ae44 2>/dev/null || echo "Mapper luks-0c349def is currently closed."
sudo cryptsetup status target_repair_node 2>/dev/null || echo "Mapper target_repair_node is currently closed."
echo ""

echo "[3/5] LOCATING EMBEDDED KEYFILE ASSETS ON ACTIVE MOUNTS..."
echo "Checking live host mount tree locations:"
find /mnt /tmp -name "boot.key" -o -name "crypto_keyfile.bin" 2>/dev/null || echo "No key assets found on live host paths."
echo ""

echo "[4/5] MOUNTING CORE ENCRYPTED TREE TO CHECK TARGET FILES..."
# Safely peek inside using a neutral temporary name to avoid resource locks
sudo mkdir -p /tmp/diag_peeker
if sudo cryptsetup open /dev/vda2 diag_peeker --readonly; then
    sudo mount -o ro /dev/mapper/diag_peeker /tmp/diag_peeker
    
    echo "--- TARGET CRYPTTAB ---"
    cat /tmp/diag_peeker/etc/crypttab || echo "ERROR: crypttab missing"
    echo ""
    
    echo "--- TARGET FSTAB ---"
    cat /tmp/diag_peeker/etc/fstab || echo "ERROR: fstab missing"
    echo ""
    
    echo "--- TARGET HOOK CONFIGURATIONS ---"
    cat /tmp/diag_peeker/etc/cryptsetup-initramfs/conf-hook 2>/dev/null || echo "conf-hook missing"
    echo ""
    
    echo "--- TARGET EMBED HOOK CONTENT ---"
    cat /tmp/diag_peeker/etc/initramfs-tools/hooks/embed_keyfile 2>/dev/null || echo "embed_keyfile hook missing"
    echo ""

    echo "--- INTERNAL HARDWARE KEYS RECORDED IN DRIVE HEADER ---"
    sudo cryptsetup luksDump /dev/vda2 | grep -A 4 "Key Slot"
    echo ""

    sudo umount /tmp/diag_peeker
    sudo cryptsetup close diag_peeker
else
    echo "CRITICAL: Could not unlock /dev/vda2 for file auditing."
fi
echo ""

echo "[5/5] CHECKING LIVE STORAGE FILE ALLOCATIONS..."
df -h
echo "================================================================="
=================================================================
        CALAMARES CRYPTOGRAPHIC SYSTEM AUDIT INTERFACE           
=================================================================

[1/5] SCANNING RAW VIRTUAL DISK CHANNELS...
NAME                                          FSTYPE       SIZE UUID                                 MOUNTPOINTS
vda                                                         20G                                      
├─vda1                                        vfat         300M A477-ACD9                            
├─vda2                                        crypto_LUKS 15.5G 85e64c1f-170c-4a22-835c-fa1cc9ec7c13 
│ └─luks-85e64c1f-170c-4a22-835c-fa1cc9ec7c13 ext4        15.5G 7e24cb36-8225-48b8-b543-bf1c3e5a92cc 
└─vda3                                        crypto_LUKS  4.2G 3caf8d4f-1b77-46f1-9b8e-52977c7a1b4d 
  └─luks-3caf8d4f-1b77-46f1-9b8e-52977c7a1b4d swap         4.2G 87017c1e-7373-4744-89a7-f1928fd483fd 

[2/5] AUDITING ACTIVE KERNEL MAPPER PROFILES...
[sudo] password for mobian: 
/dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 is inactive.
Mapper luks-0c349def is currently closed.
/dev/mapper/target_repair_node is inactive.
Mapper target_repair_node is currently closed.

[3/5] LOCATING EMBEDDED KEYFILE ASSETS ON ACTIVE MOUNTS...
Checking live host mount tree locations:
/mnt/target_clean/etc/cryptsetup-initramfs/boot.key
No key assets found on live host paths.

[4/5] MOUNTING CORE ENCRYPTED TREE TO CHECK TARGET FILES...
Enter passphrase for /dev/vda2: 
Cannot use device /dev/vda2 which is in use (already mapped or mounted).
CRITICAL: Could not unlock /dev/vda2 for file auditing.

[5/5] CHECKING LIVE STORAGE FILE ALLOCATIONS...
Filesystem      Size  Used Avail Use% Mounted on
udev            612M     0  612M   0% /dev
tmpfs           197M  944K  196M   1% /run
/dev/sda3       6.8G  4.7G  1.8G  73% /
tmpfs           985M   96K  985M   1% /dev/shm
efivarfs        256K  7.5K  244K   3% /sys/firmware/efi/efivars
none            1.0M     0  1.0M   0% /run/credentials/systemd-journald.service
tmpfs           985M  3.7M  981M   1% /tmp
/dev/sda2       488M  111M  342M  25% /boot
/dev/sda1       510M  168K  510M   1% /boot/efi
tmpfs           197M   44K  197M   1% /run/user/1000
tmpfs           197M   20K  197M   1% /run/user/0
=================================================================

echo "--> 1. Terminating background storage mapping blocks..."
sudo swapoff -a 2>/dev/null || true
sudo umount -R /mnt/target_clean 2>/dev/null || true
sudo cryptsetup close luks-9e7e1b0a-6ffd-4b61-ab64-8ad2da9bbd16 2>/dev/null || true
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44 2>/dev/null || true

echo "--> 2. Re-opening storage container using the exact name crypttab checks for..."
sudo cryptsetup open /dev/vda2 luks-0c349def-f79f-4dc7-934c-4fc12238ae44

echo "--> 3. Remounting core system directory sectors cleanly..."
sudo mkdir -p /mnt/target_clean
sudo mount /dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 /mnt/target_clean
sudo mount /dev/vda1 /mnt/target_clean/boot/efi
sudo mount --bind /dev /mnt/target_clean/dev
sudo mount --bind /proc /mnt/target_clean/proc
sudo mount --bind /sys /mnt/target_clean/sys

echo "--> 4. Writing a clean, high-entropy keyfile asset to the target root..."
sudo mkdir -p /mnt/target_clean/etc/cryptsetup-initramfs
sudo dd bs=512 count=4 if=/dev/urandom of=/mnt/target_clean/etc/cryptsetup-initramfs/boot.key status=none
sudo chmod 400 /mnt/target_clean/etc/cryptsetup-initramfs/boot.key

echo "--> 5. Enrolling the valid key into hardware Key Slot 3..."
sudo cryptsetup luksAddKey /dev/vda2 /mnt/target_clean/etc/cryptsetup-initramfs/boot.key

echo "--> 6. Aligning the target system tables to eliminate swap locks..."
sudo tee /mnt/target_clean/etc/crypttab << 'EOF'
luks-0c349def-f79f-4dc7-934c-4fc12238ae44  UUID=0c349def-f79f-4dc7-934c-4fc12238ae44  /etc/cryptsetup-initramfs/boot.key  luks,initramfs,keyslot=3
cryptswap                                  /dev/vda3                                  /dev/urandom                        swap,cipher=aes-xts-plain64,size=256,noauto
EOF

sudo tee /mnt/target_clean/etc/fstab << 'EOF'
UUID=8CFE-32E0                            /boot/efi      vfat    defaults   0 2
/dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 /              ext4    defaults   0 1
/dev/mapper/cryptswap                      none           swap    sw,x-systemd.makefs 0 0
EOF

echo "--> 7. Populating the initramfs ramdisk file-copy script hook..."
sudo tee /mnt/target_clean/etc/cryptsetup-initramfs/conf-hook << 'EOF'
KEYFILE_PATTERN="/etc/cryptsetup-initramfs/boot.key"
UMASK=0077
EOF

sudo mkdir -p /mnt/target_clean/etc/initramfs-tools/hooks
sudo tee /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile << 'EOF'
#!/bin/sh
if [ "$1" = "prereqs" ]; then exit 0; fi
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
    mkdir -p "$2/etc/cryptsetup-initramfs"
    cp -p /etc/cryptsetup-initramfs/boot.key "$2/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile

echo "--> 8. Triggering pristine ramdisk and bootloader compilation..."
sudo chroot /mnt/target_clean sh -c "echo 'RESUME=none' > /etc/initramfs-tools/conf.d/resume && update-initramfs -u -k all && update-grub"

echo "--> 9. VERIFYING SUCCESS: Scanning boot target for the keyfile payload..."
sudo chroot /mnt/target_clean sh -c "lsinitramfs /boot/initrd.img-* | grep boot.key"

echo "--> 10. Safely locking down drive structures..."
sudo umount -R /mnt/target_clean
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44
echo "======================================================="
echo " FIXED: Verification pass complete. Ready to boot!     "
echo "======================================================="
--> 1. Terminating background storage mapping blocks...
--> 2. Re-opening storage container using the exact name crypttab checks for...
Enter passphrase for /dev/vda2: 
--> 3. Remounting core system directory sectors cleanly...
--> 4. Writing a clean, high-entropy keyfile asset to the target root...
--> 5. Enrolling the valid key into hardware Key Slot 3...
Enter any existing passphrase: 
--> 6. Aligning the target system tables to eliminate swap locks...
luks-0c349def-f79f-4dc7-934c-4fc12238ae44  UUID=0c349def-f79f-4dc7-934c-4fc12238ae44  /etc/cryptsetup-initramfs/boot.key  luks,initramfs,keyslot=3
cryptswap                                  /dev/vda3                                  /dev/urandom                        swap,cipher=aes-xts-plain64,size=256,noauto
UUID=8CFE-32E0                            /boot/efi      vfat    defaults   0 2
/dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 /              ext4    defaults   0 1
/dev/mapper/cryptswap                      none           swap    sw,x-systemd.makefs 0 0
--> 7. Populating the initramfs ramdisk file-copy script hook...
KEYFILE_PATTERN="/etc/cryptsetup-initramfs/boot.key"
UMASK=0077
#!/bin/sh
if [ "$1" = "prereqs" ]; then exit 0; fi
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
    mkdir -p "$2/etc/cryptsetup-initramfs"
    cp -p /etc/cryptsetup-initramfs/boot.key "$2/etc/cryptsetup-initramfs/boot.key"
fi
--> 8. Triggering pristine ramdisk and bootloader compilation...
update-initramfs: Generating /boot/initrd.img-6.19.8-surface-3
cp: '/etc/cryptsetup-initramfs/boot.key' and '/etc/cryptsetup-initramfs/boot.key' are the same file
E: /etc/initramfs-tools/hooks/embed_keyfile failed with return 1.
update-initramfs: failed for /boot/initrd.img-6.19.8-surface-3 with 1.
--> 9. VERIFYING SUCCESS: Scanning boot target for the keyfile payload...
--> 10. Safely locking down drive structures...
=======================================================
 FIXED: Verification pass complete. Ready to boot!     
======================================================

echo "--> 1. Correcting the initramfs file hook with the proper destination variables..."
sudo tee /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile << 'EOF'
#!/bin/sh
PREREQ=""
prereqs() { echo "$PREREQ"; }
case $1 in prereqs) prereqs; exit 0;; esac
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
    mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
    cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile

echo "--> 2. Re-triggering the clean system image compilation pass..."
sudo chroot /mnt/target_clean sh -c "update-initramfs -u -k all && update-grub"

echo "--> 3. VERIFYING SUCCESS: Confirming key footprint inside the image..."
sudo chroot /mnt/target_clean sh -c "lsinitramfs /boot/initrd.img-* | grep boot.key"

echo "--> 4. Safely unmounting and locking all device descriptors..."
sudo umount -R /mnt/target_clean
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44
echo "======================================================="
echo " VICTORY: Single-passphrase boot is officially active! " && \
echo "======================================================="

#!/usr/bin/env bash
set -e

# Dynamically pull the exact UUIDs from your real disk layout
REAL_ROOT_UUID=$(blkid -s UUID -o value /dev/vda2)
REAL_SWAP_UUID=$(blkid -s UUID -o value /dev/vda3)
REAL_EFI_UUID=$(blkid -s UUID -o value /dev/vda1)

TARGET="/mnt/target_clean"
MAP_NAME="luks-${REAL_ROOT_UUID}"

echo "======================================================="
echo " EXECUTION PASS: ALIGNING SCHEMATICS TO REAL HARDWARE  "
echo "======================================================="
echo "Found Active Root UUID: ${REAL_ROOT_UUID}"
echo "Found Active Swap UUID: ${REAL_SWAP_UUID}"

echo "--> 1. Freeing active partition locks..."
sudo swapoff -a 2>/dev/null || true
if mountpoint -q "$TARGET"; then
    sudo umount -R "$TARGET" 2>/dev/null || true
fi

echo "--> 2. Ensuring the real system device mapping is mounted..."
# If Calamares already opened it under the real name, this safely uses it
if [ ! -b "/dev/mapper/${MAP_NAME}" ]; then
    sudo cryptsetup open /dev/vda2 "$MAP_NAME"
fi

echo "--> 3. Structuring clean target virtual environments..."
sudo mkdir -p "$TARGET"
sudo mount "/dev/mapper/${MAP_NAME}" "$TARGET"
sudo mkdir -p "$TARGET/boot/efi"
sudo mount /dev/vda1 "$TARGET/boot/efi"

# Bind pseudo-filesystems for chroot commands
for dir in dev proc sys dev/pts; do
    sudo mkdir -p "$TARGET/$dir"
    sudo mount --bind "/$dir" "$TARGET/$dir"
done

echo "--> 4. Depositing high-entropy keyfile..."
sudo mkdir -p "$TARGET/etc/cryptsetup-initramfs"
sudo dd bs=512 count=4 if=/dev/urandom of="$TARGET/etc/cryptsetup-initramfs/boot.key" status=none
sudo chmod 400 "$TARGET/etc/cryptsetup-initramfs/boot.key"

echo "--> 5. Enrolling key into LUKS keyslot..."
# This will prompt you for your master user passphrase once
sudo cryptsetup luksAddKey --key-slot 3 /dev/vda2 "$TARGET/etc/cryptsetup-initramfs/boot.key"

echo "--> 6. Generating systemic file tables using dynamic identifiers..."
sudo tee "$TARGET/etc/crypttab" << EOF
${MAP_NAME}  UUID=${REAL_ROOT_UUID}  /etc/cryptsetup-initramfs/boot.key  luks,initramfs,keyslot=3
cryptswap         UUID=${REAL_SWAP_UUID}  /dev/urandom                        swap,cipher=aes-xts-plain64,size=256,noauto
EOF

sudo tee "$TARGET/etc/fstab" << EOF
UUID=${REAL_EFI_UUID}                            /boot/efi      vfat    defaults   0 2
/dev/mapper/${MAP_NAME} /              ext4    defaults   0 1
/dev/mapper/cryptswap                      none           swap    sw,x-systemd.makefs 0 0
EOF

echo "--> 7. Structuring fixed initramfs hook variables..."
sudo tee "$TARGET/etc/cryptsetup-initramfs/conf-hook" << EOF
KEYFILE_PATTERN="/etc/cryptsetup-initramfs/boot.key"
UMASK=0077
EOF

sudo mkdir -p "$TARGET/etc/initramfs-tools/hooks"
sudo tee "$TARGET/etc/initramfs-tools/hooks/embed_keyfile" << 'EOF'
#!/bin/sh
PREREQ=""
prereqs() { echo "$PREREQ"; }
case $1 in prereqs) prereqs; exit 0;; esac

. /usr/share/initramfs-tools/hook-functions

if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
    mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
    cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x "$TARGET/etc/initramfs-tools/hooks/embed_keyfile"

echo "--> 8. Compiling new initial ramdisk..."
sudo chroot "$TARGET" sh -c "echo 'RESUME=none' > /etc/initramfs-tools/conf.d/resume && update-initramfs -u -k all && update-grub"

echo "--> 9. VERIFYING PAYLOAD INTEGRITY..."
if sudo chroot "$TARGET" sh -c "lsinitramfs /boot/initrd.img-* | grep -q 'boot.key'"; then
    echo "   [SUCCESS] Verified: boot.key mapped perfectly inside the boot RAM disk image!"
else
    echo "   [CRITICAL FAIL] key asset dropped out of initrd compile path."
    exit 1
fi

echo "--> 10. Cleanly unlocking system devices..."
sudo umount -R "$TARGET"
# We leave the device mapping as-is since the live environment is tracking it.

echo "======================================================="
echo " VICTORY: Script fully reconciled against device pins!  "
echo "======================================================="