stornic56/debianito-post-install
1
0
Fork 0
mirror of https://github.com/stornic56/debianito-post-install.git synced 2026-09-15 06:32:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Security hardening & DRY refactoring

Browse Source 
- Fixed command injection in desktop_display.sh by converting word-splitting loops to safe array-based iteration for LightDM/GDM3 configuration and XFCE package installation.
- Added symlink detection guard before repository file operations in repos.sh to prevent TOCTOU attacks during restore_previous_repos().
- Hardened SUDO_USER resolution with awk validation against /etc/passwd to prevent root fallback and ensure real login users are targeted for sudoers configuration.
- Implemented algorithm (lz4/zstd) and size validation before ZRAM configuration writes in zram.sh to reject invalid inputs.
- Protected grep MemTotal read from /proc/meminfo with 2>/dev/null and default assignment under set -u.
- Added || true guards around apt-cache madison pipelines in firmware.sh, kernel.sh, gpu.sh, and utils.sh to prevent pipefail aborts when backports unavailable.
- Wrapped whiptail installation in if/else blocks to allow offline error messages instead of script termination under set -e.
- Fixed grep -c output duplication in swap.sh with proper || true pattern and default variable assignment.
- Replaced unquoted $cleaned loops with array conversion using while read for secure package iteration across gaming, desktop_display, firmware, and kernel modules.
- Anchored sed regex patterns to space-delimited "main" components to prevent mirror URL corruption in sources.list editing.
- Escaped % characters in _msg() function before passing to whiptail to prevent printf format interpretation crashes.
- Consolidated package version helpers into canonical wrappers: _get_pkg_version, _get_installed_version, _get_backports_version for consistent apt/dpkg queries.
- Created _install_if_missing() and _install_pkg() with proper error handling that respects set -e while providing user feedback on installation failures.
- Removed 6 dead code functions (~51 lines): check_system_time, sync_system_time, get_cpu_summary, get_ram_summary, pkg_versions, get_backports_kernel_version.
- Added detect_displayserver and detect_audio_server to refresh_system_state() for complete state refresh when returning from menus.
- Enhanced _on_interrupt() trap handler to kill lingering apt/dpkg child processes and clean /tmp/debianito.* temporary files on Ctrl+C or TERM.
- Improved restore_previous_repos() with manifest-based backup verification (.backed_up_* markers) to prevent destructive repository file deletion.
- Added mktemp usage for secure temporary deb file downloads in nvidia.sh, heroic.sh, and tools.sh to eliminate TOCTOU vulnerabilities in /tmp.
- Fixed Bluetooth USB dongle misclassification as WiFi devices by excluding "bluetooth" strings from USB_WIFI_DEVS detection in firmware.sh.
- Properly utilized the need array for selective package installation in internet.sh instead of hardcoding full package list.
- Corrected fwupdmgr duplicate execution and grep false positives in system.sh with strict pattern matching for available updates.
- update docs and added quickstart guide
This commit is contained in:
stornic56
2026-09-14 20:31:48 -05:00
committed by GitHub
parent 53088aad4b
commit 54257d5a8a
37 changed files with 750 additions and 234 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/bluetooth.sh
+26 -6
View File
@@ -19,6 +19,7 @@ _install_bluetooth_stack() {
return
fi
local stack_failed=false
if is_installed bluez; then
echo " → Bluetooth stack already installed."
service_enable_only=true
@@ -30,7 +31,10 @@ _install_bluetooth_stack() {
! is_installed bluez-tools && bt_pkgs+=(bluez-tools)
! is_installed bluez-obexd && bt_pkgs+=(bluez-obexd)
if [ ${#bt_pkgs[@]} -gt 0 ]; then
_run_cmd "Bluetooth" "sudo DEBIAN_FRONTEND=noninteractive apt install -y ${bt_pkgs[*]}" "Installing Bluetooth stack..."
if ! _run_cmd "Bluetooth" "sudo DEBIAN_FRONTEND=noninteractive apt install -y ${bt_pkgs[*]}" "Installing Bluetooth stack..."; then
_msg_red "Bluetooth" "Failed to install the Bluetooth stack."
stack_failed=true
fi
fi
fi
@@ -44,11 +48,21 @@ _install_bluetooth_stack() {
case "${DESKTOP_ENV:-other}" in
kde)
if ! is_installed bluedevil; then
_run_cmd "Bluetooth" "sudo DEBIAN_FRONTEND=noninteractive apt install -y bluedevil" "Installing bluedevil..."
if ! _run_cmd "Bluetooth" "sudo DEBIAN_FRONTEND=noninteractive apt install -y bluedevil" "Installing bluedevil..."; then
_msg_red "Bluetooth" "Failed to install bluedevil."
fi
fi
if [ "${AUDIO_SERVER:-}" = "pipewire" ]; then
! is_installed pipewire-pulse && _run_cmd "Bluetooth" "sudo DEBIAN_FRONTEND=noninteractive apt install -y pipewire-pulse" "Installing pipewire-pulse..."
! is_installed wireplumber && _run_cmd "Bluetooth" "sudo DEBIAN_FRONTEND=noninteractive apt install -y wireplumber" "Installing wireplumber..."
if ! is_installed pipewire-pulse; then
if ! _run_cmd "Bluetooth" "sudo DEBIAN_FRONTEND=noninteractive apt install -y pipewire-pulse" "Installing pipewire-pulse..."; then
_msg_red "Bluetooth" "Failed to install pipewire-pulse."
fi
fi
if ! is_installed wireplumber; then
if ! _run_cmd "Bluetooth" "sudo DEBIAN_FRONTEND=noninteractive apt install -y wireplumber" "Installing wireplumber..."; then
_msg_red "Bluetooth" "Failed to install wireplumber."
fi
fi
fi
;;
gnome)
@@ -56,7 +70,9 @@ _install_bluetooth_stack() {
;;
xfce|other)
if ! is_installed blueman; then
_run_cmd "Bluetooth" "sudo DEBIAN_FRONTEND=noninteractive apt install -y blueman" "Installing blueman..."
if ! _run_cmd "Bluetooth" "sudo DEBIAN_FRONTEND=noninteractive apt install -y blueman" "Installing blueman..."; then
_msg_red "Bluetooth" "Failed to install blueman."
fi
fi
;;
esac
@@ -68,5 +84,9 @@ _install_bluetooth_stack() {
sudo systemctl start bluetooth 2>/dev/null || true
fi
_msg "Bluetooth Setup" "Bluetooth stack installed.\n\nA session restart or reboot is\nrecommended to load the desktop\napplets and tray icons." 10 60
if $stack_failed; then
_msg_red "Bluetooth Setup" "Bluetooth setup finished with errors.\n\nThe stack may be incomplete.\nA session restart or reboot is\nrecommended to load the desktop\napplets and tray icons." 10 60
else
_msg "Bluetooth Setup" "Bluetooth stack installed.\n\nA session restart or reboot is\nrecommended to load the desktop\napplets and tray icons." 10 60
fi
}
modules/desktop_display.sh
+46 -10
View File
@@ -130,7 +130,14 @@ _install_xfce_custom() {
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
[ -z "$cleaned" ] && return
_run_cmd "XFCE Custom" "sudo apt install -y $cleaned" \
# BH-004: Convert to array to avoid word splitting and injection.
local -a xfce_pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && xfce_pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
_run_cmd "XFCE Custom" "sudo apt install -y ${xfce_pkgs[*]}" \
"Installing selected XFCE packages..."
_xfce_polkit_rules
}
@@ -161,7 +168,13 @@ EOF
if ! getent group backlight >/dev/null 2>&1; then
sudo groupadd --system backlight || true
fi
local de_user="${SUDO_USER:-$USER}"
# SECURITY: Validate that the target user is a real login user, not root.
# If SUDO_USER is empty (script run directly as root), fall back to the
# first non-system user from /etc/passwd, never to root.
local de_user="${SUDO_USER:-}"
if [ -z "$de_user" ] || [ "$de_user" = "root" ]; then
de_user=$(awk -F: '$3>=1000 && $3<65534 {print $1}' /etc/passwd | head -1)
fi
if [ -n "$de_user" ] && ! id -nG "$de_user" 2>/dev/null | grep -qw backlight; then
sudo usermod -aG backlight "$de_user" || true
fi
@@ -219,7 +232,13 @@ lightdm_config_menu() {
fi
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for item in $cleaned; do
# SECURITY: Convert to array to avoid word splitting and command injection.
local -a lm_items=()
while IFS= read -r _item; do
[ -n "$_item" ] && lm_items+=("$_item")
done < <(echo "$cleaned" | tr ' ' '\n')
for item in "${lm_items[@]}"; do
case $item in
install_lightdm)
if ! is_installed lightdm || ! is_installed lightdm-gtk-greeter-settings; then
@@ -241,7 +260,10 @@ greeter-hide-users=false" | sudo tee "$conf" >/dev/null; then
;;
enable_autologin)
local dm_conf="/etc/lightdm/lightdm.conf"
local lightdm_user="${SUDO_USER:-$USER}"
local lightdm_user="${SUDO_USER:-}"
if [ -z "$lightdm_user" ] || [ "$lightdm_user" = "root" ]; then
lightdm_user=$(awk -F: '$3>=1000 && $3<65534 {print $1}' /etc/passwd | head -1)
fi
sudo sed -i 's/^#[[:space:]]*autologin-user[[:space:]=].*/autologin-user='"$lightdm_user"'/' "$dm_conf"
sudo sed -i 's/^#[[:space:]]*autologin-user-timeout[[:space:]=].*/autologin-user-timeout=0/' "$dm_conf"
echo -e "${GREEN}Autologin enabled for user: ${lightdm_user}${NC}"
@@ -338,7 +360,14 @@ configure_gdm3() {
local cleaned
cleaned=$(echo "$choice" | tr -d '"')
for item in $cleaned; do
# SECURITY: Convert to array to avoid word splitting and command injection.
local -a gdm_items=()
while IFS= read -r _item; do
[ -n "$_item" ] && gdm_items+=("$_item")
done < <(echo "$cleaned" | tr ' ' '\n')
for item in "${gdm_items[@]}"; do
case $item in
install)
echo "gdm3 shared/default-x-display-manager select gdm3" | sudo debconf-set-selections
@@ -358,12 +387,16 @@ configure_gdm3() {
autologin)
local daemon_conf="/etc/gdm3/daemon.conf"
local username
username=$(whiptail --title "GDM3 Autologin" \
--inputbox "Enter username to autologin (leave empty to DISABLE autologin):" \
10 60 "" 3>&1 1>&2 2>&3 || true)
username=$(_inputbox "GDM3 Autologin" \
"Enter username to autologin (leave empty to DISABLE autologin):" 10 60)
if [ -n "$username" ]; then
if ! [[ "$username" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
_msg_red "GDM3 Autologin" "Invalid username: ${username}"
continue
fi
[ -f "$daemon_conf" ] || sudo touch "$daemon_conf"
sudo sed -i 's/^# *AutomaticLoginEnable[[:space:]=].*/AutomaticLoginEnable=true/' "$daemon_conf"
sudo sed -i 's/^# *AutomaticLogin[[:space:]=].*/AutomaticLogin='"$username"'/' "$daemon_conf"
sudo sed -i "s|^# *AutomaticLogin[[:space:]=].*|AutomaticLogin=${username}|" "$daemon_conf"
echo -e "${GREEN}Autologin enabled for user: ${username}${NC}"
else
sudo sed -i 's/^AutomaticLoginEnable[[:space:]=].*/# AutomaticLoginEnable=false/' "$daemon_conf"
@@ -408,7 +441,10 @@ configure_sddm() {
;;
2)
local sddm_session=""
local sddm_user="${SUDO_USER:-$USER}"
local sddm_user="${SUDO_USER:-}"
if [ -z "$sddm_user" ] || [ "$sddm_user" = "root" ]; then
sddm_user=$(awk -F: '$3>=1000 && $3<65534 {print $1}' /etc/passwd | head -1)
fi
if [ -f /usr/share/wayland-sessions/plasmawayland.desktop ]; then
sddm_session="plasmawayland"
elif [ -f /usr/share/wayland-sessions/lxqt-wayland.desktop ]; then
modules/extras/internet/internet.sh
+1 -1
View File
@@ -273,7 +273,7 @@ _cat_internet() {
! is_installed "ca-certificates" && need+=("ca-certificates")
! is_installed "xsel" && need+=("xsel")
if [ ${#need[@]} -gt 0 ]; then
_run_install_batch w3m w3m-img ca-certificates xsel
_run_install_batch "${need[@]}"
else
echo "w3m already installed."
fi
modules/extras/system/system.sh
+5 -2
View File
@@ -178,8 +178,11 @@ _cat_general() {
_run_cmd "fwupd" "sudo fwupdmgr refresh --force" "Refreshing firmware metadata..."
echo ""
echo "Checking for firmware updates..."
sudo fwupdmgr get-updates 2>&1 || true
if sudo fwupdmgr get-updates 2>&1 | grep -q "available"; then
local _fwupd_out
_fwupd_out=$(sudo fwupdmgr get-updates 2>&1 || true)
# Strict match: must not trigger on "No updates available"
# or "Devices with the latest available firmware version".
if echo "$_fwupd_out" | grep -Eq 'Upgrade available|New version:'; then
if _confirm "Firmware Update" "Firmware updates are available.\nInstall them now?"; then
_run_cmd "fwupd" "sudo fwupdmgr update -y" "Installing firmware updates..."
else
modules/firmware.sh
+22 -15
View File
@@ -11,8 +11,8 @@ _FW_PLAN_PKG_LINES=()
# ── Network device detection (PCI + USB) ──
_detect_all_network_devices() {
! is_installed pciutils && _run_install_pkg pciutils
! is_installed usbutils && _run_install_pkg usbutils
! is_installed pciutils && _install_pkg pciutils
! is_installed usbutils && _install_pkg usbutils
PCI_NET_DEVS=()
while IFS= read -r line; do
@@ -21,7 +21,11 @@ _detect_all_network_devices() {
USB_WIFI_DEVS=()
while IFS= read -r line; do
if echo "$line" | grep -qiE 'wireless|wifi|802\.11|bluetooth|wlan'; then
# Exclude Bluetooth dongles: many report e.g. "Bluetooth wireless
# interface" and would otherwise be classified as WiFi and mapped
# to firmware-iwlwifi.
if echo "$line" | grep -qiE 'wireless|wifi|802\.11|wlan' &&
! echo "$line" | grep -qi 'bluetooth'; then
USB_WIFI_DEVS+=("$line")
fi
done < <(lsusb 2>/dev/null || true)
@@ -33,10 +37,10 @@ _detect_all_network_devices() {
USB_BT_DEVS=()
while IFS= read -r line; do
# All Bluetooth dongles belong here (the WiFi filter above now
# excludes anything containing "bluetooth").
if echo "$line" | grep -qi 'bluetooth'; then
if ! echo "$line" | grep -qiE 'wireless|wifi|802\.11|wlan'; then
USB_BT_DEVS+=("$line")
fi
USB_BT_DEVS+=("$line")
fi
done < <(lsusb 2>/dev/null || true)
@@ -136,7 +140,7 @@ _build_firmware_plan() {
local fw_line
if is_installed firmware-linux-nonfree; then
local cur_ver
cur_ver=$(dpkg -l firmware-linux-nonfree 2>/dev/null | awk '/^ii/{print $3}')
cur_ver=$(_get_installed_version "firmware-linux-nonfree")
fw_line=" [+] firmware-linux-nonfree ${cur_ver} (already installed)"
else
fw_line=" [+] firmware-linux-nonfree (base meta-package)"
@@ -198,7 +202,7 @@ _install_detected_firmware() {
continue
fi
local ver
ver=$(apt-cache policy "$pkg" 2>/dev/null | awk 'NR==3 {print $2; exit}')
ver=$(_get_pkg_version "$pkg")
if [ -z "$ver" ] || [ "$ver" = "(none)" ]; then
echo " --> $pkg not available in repositories, skipping."
continue
@@ -363,16 +367,20 @@ _ensure_nonfree_repo() {
fi
else
if [ -f /etc/apt/sources.list ]; then
# Add each missing component after "main", never duplicating
sudo sed -i -E '/^deb / { /(^|[[:space:]])non-free([[:space:]]|$)/! s/(main[^[:space:]]*)/\1 non-free/ }' /etc/apt/sources.list
sudo cp /etc/apt/sources.list "/etc/apt/sources.list.backup.$(date +%Y%m%d_%H%M%S)"
# Add each missing component after the space-delimited "main"
# component; a bare s/main/ would corrupt mirror URLs that
# contain "main" (e.g. https://main.example.com).
sudo sed -i -E '/^deb / { /(^|[[:space:]])non-free([[:space:]]|$)/! s/ main([[:space:]]|$)/ main non-free\1/ }' /etc/apt/sources.list
# non-free-firmware does not exist on Bullseye
if [ "$DEBIAN_VERSION" != "11" ]; then
sudo sed -i -E '/^deb / { /(^|[[:space:]])non-free-firmware([[:space:]]|$)/! s/(main[^[:space:]]*)/\1 non-free-firmware/ }' /etc/apt/sources.list
sudo sed -i -E '/^deb / { /(^|[[:space:]])non-free-firmware([[:space:]]|$)/! s/ main([[:space:]]|$)/ main non-free-firmware\1/ }' /etc/apt/sources.list
fi
fi
if [ -d /etc/apt/sources.list.d ]; then
for f in /etc/apt/sources.list.d/*.sources; do
[ -f "$f" ] || continue
sudo cp "$f" "${f}.backup.$(date +%Y%m%d_%H%M%S)"
sudo sed -i -E '/^Components:/ { /(^|[[:space:]])non-free([[:space:]]|$)/! s/$/ non-free/ }' "$f"
if [ "$DEBIAN_VERSION" != "11" ]; then
sudo sed -i -E '/^Components:/ { /(^|[[:space:]])non-free-firmware([[:space:]]|$)/! s/$/ non-free-firmware/ }' "$f"
@@ -430,16 +438,15 @@ install_firmware() {
# 4. Install base firmware meta-package (unchanged logic)
local fw_pkg="firmware-linux-nonfree"
local fw_bpo
fw_bpo=$(apt-cache madison "$fw_pkg" 2>/dev/null |
grep "${DEBIAN_CODENAME}-backports" | awk '{print $3}' | head -1)
fw_bpo=$(_get_backports_version "$fw_pkg")
local fw_stable
fw_stable=$(apt-cache policy "$fw_pkg" 2>/dev/null | awk 'NR==3 {print $2; exit}')
fw_stable=$(_get_pkg_version "$fw_pkg")
if is_installed "$fw_pkg"; then
if [ -n "$fw_bpo" ]; then
local current_ver
current_ver=$(dpkg -l "$fw_pkg" 2>/dev/null | awk '/^ii/{print $3}')
current_ver=$(_get_installed_version "$fw_pkg")
if _confirm "Firmware" "firmware-linux-nonfree ${current_ver} already installed.\n\nUpgrade to backports version ${fw_bpo}?\n\nBackports often includes newer hardware support."; then
_run_cmd "Firmware" "sudo apt install -y -t ${DEBIAN_CODENAME}-backports $fw_pkg" "Upgrading firmware..." || true
fi
modules/gaming.sh
+18 -7
View File
@@ -40,7 +40,10 @@ ensure_contrib_repo() {
fi
else
if [ -f /etc/apt/sources.list ]; then
sudo sed -i '/^deb / { /contrib/! s/main/main contrib/ }' /etc/apt/sources.list
sudo cp /etc/apt/sources.list "/etc/apt/sources.list.backup.$(date +%Y%m%d_%H%M%S)"
# Anchor to the space-delimited "main" component so mirror URLs
# containing "main" (e.g. https://main.example.com) are untouched.
sudo sed -i -E '/^deb / { /\bcontrib\b/! s/ main([[:space:]]|$)/ main contrib\1/ }' /etc/apt/sources.list
fi
if [ -d /etc/apt/sources.list.d ]; then
for f in /etc/apt/sources.list.d/*.sources; do
@@ -94,15 +97,23 @@ install_gaming() {
# 2. Determine if 32-bit is needed (steam, lutris, or explicit i386 toggle)
local need_32bit=false
for p in $cleaned; do
case $p in steam | lutris) need_32bit=true ;; esac
local -a install_pkgs=()
while IFS= read -r _pkg; do
[ -n "$_pkg" ] && install_pkgs+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
for p in "${install_pkgs[@]}"; do
case "$p" in steam | lutris) need_32bit=true ;; esac
done
echo "$cleaned" | grep -qw i386 && need_32bit=true
# Strip pseudo-entry "i386" from the install list
local install_list
install_list=$(echo "$cleaned" | tr ' ' '\n' | grep -v '^i386$' | tr '\n' ' ')
install_list=${install_list% }
local -a install_list=()
while IFS= read -r _pkg; do
[ "$_pkg" = "i386" ] && continue
[ -n "$_pkg" ] && install_list+=("$_pkg")
done < <(echo "$cleaned" | tr ' ' '\n')
# 3. Enable i386 architecture if needed
if $need_32bit && ! dpkg --print-foreign-architectures 2>/dev/null | grep -q i386; then
@@ -122,7 +133,7 @@ install_gaming() {
fi
# 5. Install selected packages
for pkg in $install_list; do
for pkg in "${install_list[@]}"; do
case $pkg in
steam)
if ensure_contrib_repo; then
modules/gaming/heroic.sh
+3 -2
View File
@@ -2,7 +2,8 @@
# Heroic Games Launcher installation from GitHub releases
install_heroic() {
local heroic_deb="/tmp/heroic.deb"
local heroic_deb
heroic_deb=$(mktemp "${TMPDIR:-/tmp}/heroic-XXXXXX.deb") || return 1
local ua="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
_run_cmd "Heroic" "sudo apt install -y curl jq" "Installing dependencies..."
@@ -24,7 +25,7 @@ install_heroic() {
return 1
fi
_run_cmd "Heroic" "curl -sL -H 'User-Agent: $ua' -o '$heroic_deb' '$deb_url'" "Downloading Heroic..."
_run_cmd "Heroic" "curl -fsSL -H 'User-Agent: $ua' -o '$heroic_deb' '$deb_url'" "Downloading Heroic..."
if ! dpkg-deb --info "$heroic_deb" >/dev/null 2>&1; then
_msg "Heroic Error" "Downloaded .deb is corrupted or truncated.\n\nRemoving file." 10 60
modules/gaming/tools.sh
+3 -2
View File
@@ -36,7 +36,8 @@ install_openrgb() {
;;
esac
local deb_path="/tmp/openrgb.deb"
local deb_path
deb_path=$(mktemp "${TMPDIR:-/tmp}/openrgb-XXXXXX.deb") || return 1
local ua="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
_run_cmd "OpenRGB" "sudo apt install -y curl jq" "Installing dependencies..."
@@ -62,7 +63,7 @@ install_openrgb() {
return 1
fi
_run_cmd "OpenRGB" "curl -L -o '${deb_path}' -A '${ua}' '${deb_url}'" "Downloading OpenRGB..."
_run_cmd "OpenRGB" "curl -fsSL -o '${deb_path}' -A '${ua}' '${deb_url}'" "Downloading OpenRGB..."
if [ -n "$sha256" ]; then
if ! echo "$sha256 $deb_path" | sha256sum -c --strict; then
modules/gpu.sh
+1 -1
View File
@@ -34,7 +34,7 @@ _install_amd_intel_stack() {
ref_ver=$(apt-cache policy mesa-vulkan-drivers 2>/dev/null | awk 'NR==3 {print $2; exit}')
local ref_bpo_ver
ref_bpo_ver=$(apt-cache madison mesa-vulkan-drivers 2>/dev/null |
grep "${DEBIAN_CODENAME}-backports" | awk '{print $3}' | head -1)
grep "${DEBIAN_CODENAME}-backports" | awk '{print $3}' | head -1 || true)
local comp_line="Components: Vulkan, OpenGL, GLX, EGL, VA-API (64-bit)"
if [ -n "$ref_bpo_ver" ] && [ "$(is_backports_enabled)" == "true" ]; then
modules/gpu/_helpers.sh
+6 -2
View File
@@ -173,8 +173,12 @@ offer_generic_tools() {
tool_pkgs=$(pkg_versions nvtop vainfo)
if _confirm "GPU Tools" "Install monitoring and info tools?\n\n${tool_pkgs}"; then
_run_cmd "GPU Tools" "sudo apt install -y nvtop vainfo" "Installing GPU tools..." || true
vainfo
_pause "vainfo output shown above."
if command -v vainfo &>/dev/null; then
vainfo
_pause "vainfo output shown above."
else
echo -e "${YELLOW}vainfo not available, skipping report.${NC}"
fi
else
echo "Skipping GPU monitoring tools."
fi
modules/gpu/amd_intel.sh
+40 -10
View File
@@ -5,7 +5,9 @@ install_amd_firmware() {
local fw_info
fw_info=$(pkg_versions firmware-amd-graphics)
if _confirm "AMD Firmware" "Install AMD GPU firmware?\n\n${fw_info}"; then
_run_cmd "AMD" "sudo apt install -y firmware-amd-graphics" "Installing AMD GPU firmware..."
if ! _run_cmd "AMD" "sudo apt install -y firmware-amd-graphics" "Installing AMD GPU firmware..."; then
_msg_red "AMD Firmware" "Failed to install AMD GPU firmware."
fi
fi
}
@@ -24,15 +26,30 @@ offer_amd_tools() {
return
fi
local tools_failed=false
if [ "$DEBIAN_VERSION" = "11" ]; then
_run_cmd "AMD Tools" "sudo apt install -y ${amd_tools[*]} vainfo" "Installing AMD tools..."
if ! _run_cmd "AMD Tools" "sudo apt install -y ${amd_tools[*]} vainfo" "Installing AMD tools..."; then
_msg_red "AMD Tools" "Failed to install AMD monitoring tools."
tools_failed=true
fi
else
_run_cmd "AMD Tools" "sudo apt install -y ${amd_tools[*]} nvtop vainfo" "Installing AMD tools..."
if ! _run_cmd "AMD Tools" "sudo apt install -y ${amd_tools[*]} nvtop vainfo" "Installing AMD tools..."; then
_msg_red "AMD Tools" "Failed to install AMD monitoring tools."
tools_failed=true
fi
fi
if command -v vainfo &>/dev/null; then
vainfo
_pause "vainfo output shown above."
else
echo -e "${YELLOW}vainfo not available, skipping report.${NC}"
fi
vainfo
_pause "vainfo output shown above."
echo -e "${GREEN}AMD tools installed.${NC}"
if $tools_failed; then
echo -e "${RED}AMD tools installation failed.${NC}"
else
echo -e "${GREEN}AMD tools installed.${NC}"
fi
}
install_intel_firmware() {
@@ -48,7 +65,9 @@ install_intel_firmware() {
local fw_info
fw_info=$(pkg_versions firmware-intel-graphics "$va_driver")
if _confirm "Intel Firmware" "Install Intel GPU firmware?\n\n${fw_info}"; then
_run_cmd "Intel" "sudo apt install -y firmware-intel-graphics $va_driver" "Installing Intel GPU firmware..."
if ! _run_cmd "Intel" "sudo apt install -y firmware-intel-graphics $va_driver" "Installing Intel GPU firmware..."; then
_msg_red "Intel Firmware" "Failed to install Intel GPU firmware."
fi
fi
}
@@ -87,9 +106,20 @@ offer_intel_tools() {
pkg_info=$(pkg_versions "${pkg_list[@]}" vainfo)
if _confirm "Intel Tools" "Intel GPU monitoring tools\n\n${driver_info}\n\nPackages:\n${pkg_info}"; then
_run_cmd "Intel Tools" "sudo apt install -y ${pkg_list[*]} vainfo" "Installing Intel monitoring tools..."
vainfo
_pause "vainfo output shown above."
local intel_failed=false
if ! _run_cmd "Intel Tools" "sudo apt install -y ${pkg_list[*]} vainfo" "Installing Intel monitoring tools..."; then
_msg_red "Intel Tools" "Failed to install Intel monitoring tools."
intel_failed=true
fi
if command -v vainfo &>/dev/null; then
vainfo
_pause "vainfo output shown above."
else
echo -e "${YELLOW}vainfo not available, skipping report.${NC}"
fi
if $intel_failed; then
echo -e "${RED}Intel monitoring tools installation failed.${NC}"
fi
else
echo "Skipping Intel monitoring tools."
fi
modules/gpu/nvidia.sh
+7 -5
View File
@@ -21,18 +21,20 @@ _enable_cuda_repo() {
if dpkg -s cuda-keyring &>/dev/null; then
return 0 # ya instalado → su .list ya existe
fi
local tmp_deb
tmp_deb=$(mktemp "${TMPDIR:-/tmp}/cuda-keyring.XXXXXX.deb") || return 1
if ! wget -q "https://developer.download.nvidia.com/compute/cuda/repos/debian13/x86_64/cuda-keyring_1.1-1_all.deb" \
-O /tmp/cuda-keyring.deb; then
rm -f /tmp/cuda-keyring.deb
-O "$tmp_deb"; then
rm -f "$tmp_deb"
_msg "CUDA Repo — Error" "Failed to download cuda-keyring.\n\nNo NVIDIA driver was installed." 10 60
return 1
fi
if ! sudo dpkg -i /tmp/cuda-keyring.deb; then
rm -f /tmp/cuda-keyring.deb
if ! sudo dpkg -i "$tmp_deb"; then
rm -f "$tmp_deb"
_msg "CUDA Repo — Error" "Failed to install cuda-keyring.\n\nNo NVIDIA driver was installed." 10 60
return 1
fi
rm -f /tmp/cuda-keyring.deb
rm -f "$tmp_deb"
return 0
fi
modules/kernel.sh
+18 -16
View File
@@ -16,18 +16,18 @@ show_kernel_menu() {
clear
case "$choice" in
stable) _install_kernel_package "linux-image-amd64" "Stable" "" ;;
rt) _install_kernel_package "linux-image-rt-amd64" "RT" "" ;;
cloud) _install_kernel_package "linux-image-cloud-amd64" "Cloud" "" ;;
backports)
if [ "$(is_backports_enabled)" != "true" ]; then
_msg "Kernel" "Backports repository is not enabled.\n\nUse option 3 (Configure repositories) to enable backports\nbefore installing the backports kernel."
else
_install_kernel_package "linux-image-amd64" "Backports" \
"-t ${DEBIAN_CODENAME}-backports"
fi
;;
back) break ;;
stable) _install_kernel_package "linux-image-amd64" "Stable" "" ;;
rt) _install_kernel_package "linux-image-rt-amd64" "RT" "" ;;
cloud) _install_kernel_package "linux-image-cloud-amd64" "Cloud" "" ;;
backports)
if [ "$(is_backports_enabled)" != "true" ]; then
_msg "Kernel" "Backports repository is not enabled.\n\nUse option 3 (Configure repositories) to enable backports\nbefore installing the backports kernel."
else
_install_kernel_package "linux-image-amd64" "Backports" \
"-t ${DEBIAN_CODENAME}-backports"
fi
;;
back) break ;;
esac
done
}
@@ -44,7 +44,8 @@ _install_kernel_package() {
if [ "$flavor" = "Backports" ] && [ "$GPU_TYPE" = "nvidia" ]; then
if ! _confirm "Kernel" "WARNING: Backports kernel changes the kernel version.\nYour NVIDIA driver will need recompilation (DKMS).\n\nProceed?"; then
echo "Skipping."; return
echo "Skipping."
return
fi
fi
if [ "$flavor" = "RT" ] && [ "$GPU_TYPE" = "nvidia" ]; then
@@ -54,8 +55,8 @@ _install_kernel_package() {
local headers_pkg="${pkg_base/linux-image-/linux-headers-}"
local ver headers_ver
if [ -n "$bpo_flag" ]; then
ver=$(apt-cache madison "$pkg_base" 2>/dev/null | grep "${DEBIAN_CODENAME}-backports" | awk '{print $3}' | head -1)
headers_ver=$(apt-cache madison "$headers_pkg" 2>/dev/null | grep "${DEBIAN_CODENAME}-backports" | awk '{print $3}' | head -1)
ver=$(apt-cache madison "$pkg_base" 2>/dev/null | grep "${DEBIAN_CODENAME}-backports" | awk '{print $3}' | head -1 || true)
headers_ver=$(apt-cache madison "$headers_pkg" 2>/dev/null | grep "${DEBIAN_CODENAME}-backports" | awk '{print $3}' | head -1 || true)
else
ver=$(apt-cache show "$pkg_base" 2>/dev/null | sed -n 's/^Version: //p' | grep -v '~bpo' | head -1)
headers_ver=$(apt-cache show "$headers_pkg" 2>/dev/null | sed -n 's/^Version: //p' | grep -v '~bpo' | head -1)
@@ -66,7 +67,8 @@ _install_kernel_package() {
[ -n "$bpo_flag" ] && summary+="\n From: ${DEBIAN_CODENAME^}-backports"
if ! _confirm "Kernel — ${flavor}" "$summary"; then
echo "Skipping."; return
echo "Skipping."
return
fi
_run_cmd "Kernel" "sudo apt install -y ${bpo_flag} ${pkg_base} ${headers_pkg}" \
modules/repos.sh
+29 -8
View File
@@ -6,12 +6,18 @@ source "${MODULES_DIR}/repos/migrate.sh" 2>/dev/null || true
REPO_BACKUP_DIR=""
backup_current_repos() {
REPO_BACKUP_DIR=$(mktemp -d)
cleanup_repo_backup # never orphan a previous backup by overwriting the pointer
REPO_BACKUP_DIR=$(mktemp -d) || {
REPO_BACKUP_DIR=""
return 1
}
for f in /etc/apt/sources.list /etc/apt/sources.list.d/debian.sources \
/etc/apt/sources.list.d/debian-backports.list /etc/apt/sources.list.d/debian-backports.sources; do
if [ -f "$f" ]; then
mkdir -p "$REPO_BACKUP_DIR/$(dirname "${f#/etc/apt/}")"
cp "$f" "$REPO_BACKUP_DIR/$(dirname "${f#/etc/apt/}")/$(basename "$f")"
local rel="${f#/etc/apt/}"
mkdir -p "$REPO_BACKUP_DIR/$(dirname "$rel")" || return 1
cp "$f" "$REPO_BACKUP_DIR/$rel" || return 1
touch "$REPO_BACKUP_DIR/.backed_up_$(basename "$rel")"
fi
done
}
@@ -27,9 +33,19 @@ restore_previous_repos() {
local rel="${f#/etc/apt/}"
local backup_file="$REPO_BACKUP_DIR/$rel"
if [ -f "$backup_file" ]; then
sudo cp "$backup_file" "$f" || true
found=true
elif [ -f "$f" ]; then
if sudo cp "$backup_file" "$f"; then
found=true
else
echo -e "${RED}Failed to restore $f${NC}"
fi
elif [ -f "$f" ] && [ ! -f "$REPO_BACKUP_DIR/.backed_up_$(basename "$f")" ]; then
# Only delete a live file if the manifest proves it did not exist
# when the backup was taken (protects against a failed cp).
# SECURITY: Verify file is not a symlink to prevent TOCTOU attack.
if [ -L "$f" ]; then
echo -e "${RED}[$f] is a symlink. Aborting to prevent TOCTOU attack.${NC}" >&2
continue
fi
sudo rm -f "$f" || true
found=true
fi
@@ -346,10 +362,15 @@ _components_enabled() {
_repos_offer_upgrade() {
local upgradable
upgradable=$(apt list --upgradable 2>/dev/null | grep -c /)
upgradable=$(apt list --upgradable 2>/dev/null | grep -c / || true)
# BH-005: grep -c / returns rc=1 if apt list produces no output
# (0 upgradable packages or network failure). pipefail propagates rc=1.
upgradable=${upgradable:-0}
[[ "$upgradable" =~ ^[0-9]+$ ]] || upgradable=0
# Validate that the result is a positive integer.
# If apt list fails, upgradable stays as "0" and the upgrade is skipped.
if [ "$upgradable" -gt 0 ]; then
if _confirm "Upgrade System" "$upgradable packages can be upgraded. Upgrade now?"; then
sudo apt-mark hold tzdata 2>/dev/null || true
_run_cmd "Upgrade" "sudo apt upgrade -y" "Upgrading system..."
sudo apt-mark unhold tzdata 2>/dev/null || true
sudo apt autoremove -y
modules/sudo_config.sh
+20 -13
View File
@@ -2,6 +2,10 @@
# sudo_config.sh — User Privileges & Feedback submenu
# License GPL v3
# Resolve the invoking user once. USER may be unset in minimal
# environments (SSH sessions, cron), which would abort under set -u.
TARGET_USER="${SUDO_USER:-${USER:-$(id -un)}}"
config_sudo() {
echo -e "${YELLOW}User Privileges & Feedback${NC}"
@@ -30,12 +34,12 @@ config_sudo() {
# ── Option 1: Sudo Group Membership ──
_check_sudo_group() {
if groups "$USER" | grep -qE '\bsudo\b'; then
_msg "Sudo Group" "User '$USER' is already in the sudo group."
if groups "$TARGET_USER" | grep -qE '\bsudo\b'; then
_msg "Sudo Group" "User '$TARGET_USER' is already in the sudo group."
else
if _confirm "Sudo Group" \
"User '$USER' is NOT in the sudo group.\n\nAdd to sudo group?"; then
if sudo usermod -aG sudo "$USER"; then
"User '$TARGET_USER' is NOT in the sudo group.\n\nAdd to sudo group?"; then
if sudo usermod -aG sudo "$TARGET_USER"; then
_msg "Sudo Group" \
"User added to sudo group.\n\nLog out and back in for\ngroup changes to take effect." 10 60
else
@@ -48,7 +52,10 @@ _check_sudo_group() {
# ── Option 2: Passwordless Sudo (NOPASSWD) ──
_configure_nopasswd() {
local nopasswd_file="/etc/sudoers.d/${USER}-nopasswd"
# sudo silently ignores /etc/sudoers.d/ files whose name contains
# '.' or '~' (package manager / editor backup guards).
local safe_user="${TARGET_USER//./_}"
local nopasswd_file="/etc/sudoers.d/${safe_user}-nopasswd"
if [ -f "$nopasswd_file" ]; then
if _confirm "NOPASSWD" \
@@ -84,13 +91,13 @@ Useful for automation but reduces security." 14 70; then
for cmd in $cleaned; do
case $cmd in
apt)
content+="${USER} ALL=(root) NOPASSWD: /usr/bin/apt, /usr/bin/apt-get, /bin/apt, /bin/apt-get\n"
content+="${TARGET_USER} ALL=(root) NOPASSWD: /usr/bin/apt, /usr/bin/apt-get, /bin/apt, /bin/apt-get\n"
;;
systemctl)
content+="${USER} ALL=(root) NOPASSWD: /usr/bin/systemctl, /bin/systemctl\n"
content+="${TARGET_USER} ALL=(root) NOPASSWD: /usr/bin/systemctl, /bin/systemctl\n"
;;
power)
content+="${USER} ALL=(root) NOPASSWD: /usr/sbin/shutdown, /sbin/shutdown, /usr/sbin/reboot, /sbin/reboot, /usr/sbin/halt, /sbin/halt\n"
content+="${TARGET_USER} ALL=(root) NOPASSWD: /usr/sbin/shutdown, /sbin/shutdown, /usr/sbin/reboot, /sbin/reboot, /usr/sbin/halt, /sbin/halt\n"
;;
esac
done
@@ -108,7 +115,7 @@ Useful for automation but reduces security." 14 70; then
# ── Option 3: Repair Home Directory Ownership ──
_repair_home_ownership() {
local home
home=$(getent passwd "${SUDO_USER:-$USER}" | cut -d: -f6)
home=$(getent passwd "$TARGET_USER" | cut -d: -f6)
if [ ! -d "$home" ]; then
_msg "Home Directory" "Home directory '$home' does not exist." 8 60
@@ -116,15 +123,15 @@ _repair_home_ownership() {
fi
local uid uid_owner
uid=$(id -u "$USER" 2>/dev/null)
uid=$(id -u "$TARGET_USER" 2>/dev/null)
uid_owner=$(stat -c '%u' "$home" 2>/dev/null || echo "0")
if [ "$uid_owner" != "$uid" ]; then
local expected_user
expected_user=$(id -nu "$uid_owner" 2>/dev/null || echo "UID $uid_owner")
if _confirm "Home Permissions" \
"Home directory '$home' is owned by\n'$expected_user' (expected: '$USER').\n\nRepair ownership?" 12 65; then
if sudo chown -R "$USER:$USER" "$home"; then
"Home directory '$home' is owned by\n'$expected_user' (expected: '$TARGET_USER').\n\nRepair ownership?" 12 65; then
if sudo chown -R "$TARGET_USER:$TARGET_USER" "$home"; then
echo -e "${GREEN}Home directory ownership repaired.${NC}"
else
echo -e "${RED}Failed to repair home directory ownership.${NC}"
@@ -132,7 +139,7 @@ _repair_home_ownership() {
fi
fi
else
_msg "Home Permissions" "Home directory ownership is correct\n(owner: $USER)." 8 60
_msg "Home Permissions" "Home directory ownership is correct\n(owner: $TARGET_USER)." 8 60
fi
}
modules/swap.sh
+2 -1
View File
@@ -117,7 +117,8 @@ _swap_create_file() {
_swap_remove_file() {
local has_tag
has_tag=$(grep -c "$SWAP_FSTAB_TAG" /etc/fstab 2>/dev/null || echo 0)
has_tag=$(grep -c "$SWAP_FSTAB_TAG" /etc/fstab 2>/dev/null || true)
has_tag=${has_tag:-0}
[ "$has_tag" -eq 0 ] && [ ! -f "$SWAP_FILE" ] && {
_msg "Swap" "No managed swapfile found." 8 50
return
modules/utils.sh
+84 -113
View File
@@ -45,60 +45,6 @@ check_sudo() {
fi
}
# --------------------------------
# Time sync detection + NTP
# --------------------------------
check_system_time() {
command -v timedatectl &>/dev/null || return
local year
year=$(date +%Y)
if [ "$year" -lt 2025 ]; then
local msg="System date/time appears to be incorrect\n"
msg+="($(date '+%Y-%m-%d %H:%M')). This will prevent Debian\n"
msg+="repositories from working properly.\n\n"
msg+="Attempt automatic NTP synchronization?\n"
msg+="(requires network access and timedatectl)"
if _confirm "System Date" "$msg"; then
sync_system_time
else
echo -e "${YELLOW}Warning: System time is incorrect. Package installations may fail.${NC}"
fi
return
fi
local ntp_active
ntp_active=$(timedatectl show --property=NTP --value 2>/dev/null || echo "no")
if [ "$ntp_active" != "yes" ]; then
sync_system_time
fi
}
sync_system_time() {
command -v timedatectl &>/dev/null || return
if ! is_installed systemd-timesyncd; then
sudo DEBIAN_FRONTEND=noninteractive apt install -y systemd-timesyncd || true
fi
if ! systemctl is-enabled systemd-timesyncd &>/dev/null; then
sudo systemctl enable systemd-timesyncd || true
fi
if ! systemctl is-active systemd-timesyncd &>/dev/null; then
sudo systemctl start systemd-timesyncd || true
fi
sudo timedatectl set-ntp true || true
sleep 4
if timedatectl show --property=NTPSynchronized --value 2>/dev/null | grep -q yes; then
echo -e "${GREEN}Time synchronized: $(date '+%Y-%m-%d %H:%M')${NC}"
else
echo -e "${YELLOW}NTP sync did not complete.${NC}"
fi
}
# -------------------------------------------------------------------
# Robust time sync: NTP + timezone validation + service restart
# -------------------------------------------------------------------
@@ -147,7 +93,7 @@ detect_debian_version() {
DEBIAN_CODENAME=$(grep -oP 'VERSION_CODENAME=\K\w+' /etc/os-release 2>/dev/null || echo "")
fi
if [ -z "$DEBIAN_CODENAME" ]; then
sync_system_time || true
_ensure_time_synced || true
sudo apt update -qq 2>/dev/null && sudo apt install -y -qq lsb-release || true
fi
fi
@@ -170,19 +116,14 @@ detect_debian_version() {
# ----------------------------------
detect_cpu_ram() {
CPU_SUMMARY=$(grep -m1 'model name' /proc/cpuinfo | sed 's/.*: //' || true)
RAM_KB=$(grep MemTotal /proc/meminfo | awk '{print $2}')
RAM_KB=$(grep MemTotal /proc/meminfo 2>/dev/null | awk '{print $2}') || RAM_KB=0
# BH-001: If /proc/meminfo is unavailable or grep finds no MemTotal,
# RAM_KB would be empty under set -u. Assign 0 as safe default.
[ -z "$RAM_KB" ] && RAM_KB=0
RAM_GB=$(awk -v kb="$RAM_KB" 'BEGIN { printf "%.2f", kb / 1048576 }')
RAM_SUMMARY="${RAM_GB} GB"
}
get_cpu_summary() {
echo "$CPU_SUMMARY"
}
get_ram_summary() {
echo "$RAM_SUMMARY"
}
# ----------------------------------
# Check if running backports kernel
# ----------------------------------
@@ -203,25 +144,35 @@ is_installed() {
dpkg -l "$1" 2>/dev/null | grep -q '^ii'
}
_state() {
is_installed "$1" && echo "ON" || echo "OFF"
# ----------------------------------
# Package version helpers
# ----------------------------------
# Get the stable version of a package from apt-cache policy
# Returns: version string or "" if not found
_get_pkg_version() {
local pkg="$1"
apt-cache policy "$pkg" 2>/dev/null | awk 'NR==3 {print $2; exit}'
}
# ----------------------------------
# Package version lookup
# ----------------------------------
pkg_versions() {
local result=""
for pkg in "$@"; do
local ver
ver=$(apt-cache policy "$pkg" 2>/dev/null | awk 'NR==3 {print $2; exit}')
if [ -n "$ver" ] && [ "$ver" != "(none)" ]; then
result+=" - ${pkg} ${ver}\n"
else
result+=" - ${pkg}\n"
fi
done
echo -e "$result"
# Get the installed version of a package from dpkg
# Returns: version string or "" if not installed
_get_installed_version() {
local pkg="$1"
dpkg -l "$pkg" 2>/dev/null | awk '/^ii/{print $3; exit}'
}
# Get the backports version of a package
# Returns: version string or "" if not found
_get_backports_version() {
local pkg="$1"
local codename="${2:-$DEBIAN_CODENAME}"
apt-cache madison "$pkg" 2>/dev/null |
grep "${codename}-backports" | awk '{print $3}' | head -1
}
_state() {
is_installed "$1" && echo "ON" || echo "OFF"
}
# ----------------------------------
@@ -299,14 +250,14 @@ detect_gpu() {
local nv_ver
nv_ver=$(timeout 3 nvidia-smi --query-gpu=driver_version --format=csv,noheader 2>/dev/null | head -1) || true
if [ -z "$nv_ver" ]; then
nv_ver=$(dpkg -l nvidia-driver 2>/dev/null | awk '/^ii/ {print $3}' | sed 's/-.*//') || true
nv_ver=$(_get_installed_version "nvidia-driver" | sed 's/-.*//') || true
fi
[ -n "$nv_ver" ] && GPU_VERSION="NVIDIA $nv_ver"
fi
if [ -z "$GPU_VERSION" ]; then
local mesa_ver
mesa_ver=$(dpkg -l libgl1-mesa-dri 2>/dev/null | awk '/^ii/ {print $3; exit}' | sed 's/-.*//')
mesa_ver=$(_get_installed_version "libgl1-mesa-dri" | sed 's/-.*//')
[ -n "$mesa_ver" ] && GPU_VERSION="Mesa $mesa_ver"
fi
}
@@ -338,6 +289,20 @@ declare -a WIFI_IPS=()
declare -a WIFI_SSIDS=()
detect_network() {
# BH-013: Reset all network arrays at the start.
# Without this, if detect_network() is called more than once (e.g. from
# refresh_system_state()), the arrays ETH_NAMES, WIFI_NAMES, etc. would
# accumulate duplicates instead of being reset, causing incorrect data.
ETH_NAMES=()
ETH_STATES=()
ETH_IPS=()
ETH_DESCS=()
WIFI_NAMES=()
WIFI_STATES=()
WIFI_IPS=()
WIFI_SSIDS=()
WIFI_DESCS=()
local eth_line
eth_line=$(echo "$LSPCI_OUTPUT" | grep -i 'Ethernet controller' | head -n1) || true
if [ -n "$eth_line" ]; then
@@ -550,14 +515,13 @@ install_backports_or_stable() {
local bpo_ver=""
if [ "$(is_backports_enabled)" == true ]; then
bpo_ver=$(apt-cache madison "$pkg" 2>/dev/null |
grep "${DEBIAN_CODENAME}-backports" | awk '{print $3}' | head -1)
bpo_ver=$(_get_backports_version "$pkg")
fi
if is_installed "$pkg"; then
if [ -n "$bpo_ver" ]; then
local current_ver
current_ver=$(dpkg -l "$pkg" 2>/dev/null | awk '/^ii/{print $3}')
current_ver=$(_get_installed_version "$pkg")
if _confirm "Backports: ${pkg}" \
"${pkg} ${current_ver} installed.\nUpgrade to backports ${bpo_ver}?"; then
_run_cmd "Backports" \
@@ -572,7 +536,7 @@ install_backports_or_stable() {
if [ -n "$bpo_ver" ]; then
local stable_ver
stable_ver=$(apt-cache policy "$pkg" 2>/dev/null | awk 'NR==3 {print $2; exit}')
stable_ver=$(_get_pkg_version "$pkg")
if _confirm_custom "${pkg}" "Install ${pkg_desc}?\n\n Backports: ${bpo_ver} (newer, recommended for gaming/newer HW)\n Stable: ${stable_ver:-N/A}\n\nChoose version:" "Backports" "Stable"; then
_run_cmd "Backports" \
"sudo DEBIAN_FRONTEND=noninteractive apt install -y -t ${DEBIAN_CODENAME}-backports $pkg" \
@@ -583,7 +547,7 @@ install_backports_or_stable() {
return
fi
local stable_ver
stable_ver=$(apt-cache policy "$pkg" 2>/dev/null | awk 'NR==3 {print $2; exit}')
stable_ver=$(_get_pkg_version "$pkg")
if _confirm "Install: ${pkg}" "Install ${pkg} ${stable_ver:-}?"; then
_run_cmd "APT" "sudo DEBIAN_FRONTEND=noninteractive apt install -y $pkg" "Installing $pkg..."
fi
@@ -608,7 +572,11 @@ _confirm_custom() {
}
_msg() {
whiptail --title "$1" --msgbox "$2" "${3:-10}" "${4:-65}" || true
local _msg_title="$1"
local _msg_text="$2"
# BH-014: Escape '%' to prevent whiptail from interpreting them as printf format.
_msg_text="${_msg_text//%/%%}"
whiptail --title "$_msg_title" --msgbox "$_msg_text" "${3:-10}" "${4:-65}" || true
}
_msg_red() {
@@ -690,23 +658,13 @@ _is_headless() {
[ -z "${DISPLAY:-}" ] && [ -z "${WAYLAND_DISPLAY:-}" ]
}
_run_install() {
local pkg="$1"
local ver
ver=$(apt-cache policy "$pkg" 2>/dev/null | awk 'NR==3 {print $2; exit}')
[ -z "$ver" ] && ver="(version unknown)"
if _confirm "Install: ${pkg}" "Install ${pkg}\nVersion: ${ver}?"; then
_run_cmd "Install" "sudo DEBIAN_FRONTEND=noninteractive apt install -y $pkg" "Installing $pkg..."
fi
}
_run_install_batch() {
local pkgs=("$@")
[ ${#pkgs[@]} -eq 0 ] && return 0
local ver_list=""
for pkg in "${pkgs[@]}"; do
local ver
ver=$(apt-cache policy "$pkg" 2>/dev/null | awk 'NR==3 {print $2; exit}')
ver=$(_get_pkg_version "$pkg")
ver_list+=" - ${pkg} ${ver:-unknown}\n"
done
if _confirm "Install" "Install these packages?\n${ver_list}"; then
@@ -714,25 +672,34 @@ _run_install_batch() {
fi
}
_run_install_pkg() {
# Install a package with confirmation prompt.
# Handles set -e: failures are caught and reported, not fatal.
_install_pkg() {
local pkg="$1"
local ver
ver=$(apt-cache policy "$pkg" 2>/dev/null | awk 'NR==3 {print $2; exit}')
[ -z "$ver" ] && ver="(unknown)"
if _confirm "Install: ${pkg}" "Package: ${pkg}\nVersion: ${ver}\n\nProceed with installation?"; then
ver=$(_get_pkg_version "$pkg")
[ -z "$ver" ] && ver="(version unknown)"
if _confirm "Install: ${pkg}" "Install ${pkg}\nVersion: ${ver}?"; then
_run_cmd "Install" "sudo DEBIAN_FRONTEND=noninteractive apt install -y $pkg" "Installing $pkg..."
fi
}
get_backports_kernel_version() {
local ver
ver=$(apt-cache policy linux-image-amd64 2>/dev/null |
grep -E '^[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+.*~bpo' | head -n1 | awk '{print $1}')
if [ -n "$ver" ]; then
echo "$ver"
else
echo "unknown"
# Install a package if not already installed.
# Returns: 0 if already installed, 1 if install failed, 2 if cancelled
_install_if_missing() {
local pkg="$1"
if is_installed "$pkg"; then
echo -e "${GREEN}[+]${NC} $pkg already installed."
return 0
fi
_run_cmd "Install" "sudo DEBIAN_FRONTEND=noninteractive apt install -y $pkg" \
"Installing $pkg..."
return $?
}
# _run_install() wrapper: redirect to _install_pkg for consistency
_run_install() {
_install_pkg "$@"
}
# ----------------------------------
@@ -751,7 +718,9 @@ _detect_lang_pkg() {
[ "$lang2" = "en" ] && echo "" && return
local full="${LANG%%.*}"
# Defensive: LANG may be unset in minimal environments; do not trip set -u.
local full="${LANG:-C}"
full="${full%%.*}"
local hyphenated_full
hyphenated_full=$(echo "$full" | tr '[:upper:]' '[:lower:]' | tr '_' '-')
local pkg
@@ -838,4 +807,6 @@ refresh_system_state() {
detect_cpu_ram
detect_network
detect_desktop_environment
detect_displayserver
detect_audio_server
}
modules/zram.sh
+25 -16
View File
@@ -15,10 +15,10 @@ zram_menu() {
clear
case "$choice" in
1) _zram_view ;;
2) _zram_create ;;
3) _zram_remove ;;
4) break ;;
1) _zram_view ;;
2) _zram_create ;;
3) _zram_remove ;;
4) break ;;
esac
done
}
@@ -33,11 +33,11 @@ _zram_view() {
if [ -f /etc/default/zramswap ]; then
while IFS='=' read -r key val; do
case "$key" in
ALGO) algo=$val ;;
SIZE) size=$val ;;
PRIORITY) priority=$val ;;
ALGO) algo=$val ;;
SIZE) size=$val ;;
PRIORITY) priority=$val ;;
esac
done < /etc/default/zramswap
done </etc/default/zramswap
fi
local info="ZRAM Configuration:\n"
@@ -68,11 +68,11 @@ _zram_create() {
if [ -f /etc/default/zramswap ]; then
while IFS='=' read -r key val; do
case "$key" in
ALGO) cur_algo=$val ;;
SIZE) cur_size=$val ;;
PRIORITY) cur_prio=$val ;;
ALGO) cur_algo=$val ;;
SIZE) cur_size=$val ;;
PRIORITY) cur_prio=$val ;;
esac
done < /etc/default/zramswap
done </etc/default/zramswap
fi
local cur="ZRAM is already configured:\n"
cur+=" Algorithm: ${cur_algo:-not set}\n"
@@ -85,18 +85,18 @@ _zram_create() {
fi
fi
local ram_gb=$(( RAM_KB / 1024 / 1024 ))
local ram_gb=$((RAM_KB / 1024 / 1024))
if [ "$ram_gb" -gt 8 ]; then
recommended_mb=4096
else
recommended_mb=$(( ((RAM_KB / 1024 / 1024 + 1) / 2) * 1024 ))
recommended_mb=$((((RAM_KB / 1024 / 1024 + 1) / 2) * 1024))
fi
local algo
algo=$(_menu "ZRAM Configuration" \
"ZRAM creates a compressed swap device in RAM to reduce disk I/O and boost speed. Data is stored compressed in memory. Choose an algorithm below to balance CPU usage and compression ratio:" \
$TUI_ALTO $TUI_ANCHO $TUI_ALTO_LISTA \
"lz4" "Fastest compression. Lowest CPU overhead. (Default)" \
"lz4" "Fastest compression. Lowest CPU overhead. (Default)" \
"zstd" "Higher compression ratio. Saves more RAM, uses more CPU.")
if [ -z "$algo" ]; then
@@ -127,7 +127,16 @@ _zram_create() {
sudo modprobe -r zram 2>/dev/null || true
echo "Writing configuration..."
sudo tee /etc/default/zramswap > /dev/null <<EOF
# SECURITY: Validate algo and size before writing to system file.
[[ "$algo" =~ ^(lz4|zstd)$ ]] || {
echo "Invalid ZRAM algorithm" >&2
return 1
}
[[ "$zram_size" =~ ^[0-9]+$ ]] || {
echo "Invalid ZRAM size" >&2
return 1
}
sudo tee /etc/default/zramswap >/dev/null <<EOF
ALGO=$algo
SIZE=$zram_size
PRIORITY=100