Files
debianito-post-install/modules/extras/system/system.sh
T
stornic56 54257d5a8a Security hardening & DRY refactoring
- Fixed command injection in desktop_display.sh by converting word-splitting loops to safe array-based iteration for LightDM/GDM3 configuration and XFCE package installation.
- Added symlink detection guard before repository file operations in repos.sh to prevent TOCTOU attacks during restore_previous_repos().
- Hardened SUDO_USER resolution with awk validation against /etc/passwd to prevent root fallback and ensure real login users are targeted for sudoers configuration.
- Implemented algorithm (lz4/zstd) and size validation before ZRAM configuration writes in zram.sh to reject invalid inputs.
- Protected grep MemTotal read from /proc/meminfo with 2>/dev/null and default assignment under set -u.
- Added || true guards around apt-cache madison pipelines in firmware.sh, kernel.sh, gpu.sh, and utils.sh to prevent pipefail aborts when backports unavailable.
- Wrapped whiptail installation in if/else blocks to allow offline error messages instead of script termination under set -e.
- Fixed grep -c output duplication in swap.sh with proper || true pattern and default variable assignment.
- Replaced unquoted $cleaned loops with array conversion using while read for secure package iteration across gaming, desktop_display, firmware, and kernel modules.
- Anchored sed regex patterns to space-delimited "main" components to prevent mirror URL corruption in sources.list editing.
- Escaped % characters in _msg() function before passing to whiptail to prevent printf format interpretation crashes.
- Consolidated package version helpers into canonical wrappers: _get_pkg_version, _get_installed_version, _get_backports_version for consistent apt/dpkg queries.
- Created _install_if_missing() and _install_pkg() with proper error handling that respects set -e while providing user feedback on installation failures.
- Removed 6 dead code functions (~51 lines): check_system_time, sync_system_time, get_cpu_summary, get_ram_summary, pkg_versions, get_backports_kernel_version.
- Added detect_displayserver and detect_audio_server to refresh_system_state() for complete state refresh when returning from menus.
- Enhanced _on_interrupt() trap handler to kill lingering apt/dpkg child processes and clean /tmp/debianito.* temporary files on Ctrl+C or TERM.
- Improved restore_previous_repos() with manifest-based backup verification (.backed_up_* markers) to prevent destructive repository file deletion.
- Added mktemp usage for secure temporary deb file downloads in nvidia.sh, heroic.sh, and tools.sh to eliminate TOCTOU vulnerabilities in /tmp.
- Fixed Bluetooth USB dongle misclassification as WiFi devices by excluding "bluetooth" strings from USB_WIFI_DEVS detection in firmware.sh.
- Properly utilized the need array for selective package installation in internet.sh instead of hardcoding full package list.
- Corrected fwupdmgr duplicate execution and grep false positives in system.sh with strict pattern matching for available updates.
- update docs and added quickstart guide
2026-09-14 20:31:48 -05:00

279 lines
11 KiB
Bash

#!/usr/bin/env bash
# system.sh — System Tools (extrepo moved here from Dev & Servers)
_detect_desktop_type() {
local desktop
desktop="${XDG_CURRENT_DESKTOP:-${DESKTOP_SESSION:-}}"
desktop="${desktop,,}"
case "$desktop" in
*kde* | *lxqt* | *razor* | *plasma*)
echo "qt"
return
;;
*gnome* | *xfce* | *cinnamon* | *mate* | *lxde* | *budgie* | *sway* | *hyprland* | *i3* | *bspwm* | *openbox* | *fluxbox*)
echo "gtk"
return
;;
esac
echo "gtk"
}
_cat_general() {
local headless=false
_is_headless && headless=true
local -a items=()
local btop_state
btop_state=$(_state "btop")
local compress_state
if is_installed "zip" && is_installed "unzip" && is_installed "p7zip-full"; then
compress_state="ON"
else
compress_state="OFF"
fi
local cpufetch_state
cpufetch_state=$(_state "cpufetch")
local cpu_x_state
cpu_x_state=$(_state "cpu-x")
local curl_wget_state
if is_installed "curl" && is_installed "wget"; then
curl_wget_state="ON"
else
curl_wget_state="OFF"
fi
local extrepo_state
extrepo_state=$(_state "extrepo")
local fwupd_state
fwupd_state=$(_state "fwupd")
local htop_state
htop_state=$(_state "htop")
local inxi_state
inxi_state=$(_state "inxi")
local jq_state
jq_state=$(_state "jq")
local kvm_state
kvm_state=$(_state "virt-manager")
local lshw_state
lshw_state=$(_state "lshw")
local mc_state
mc_state=$(_state "mc")
local nala_state
nala_state=$(_state "nala")
local ncdu_state
ncdu_state=$(_state "ncdu")
local tmux_state
tmux_state=$(_state "tmux")
local wine_state
wine_state=$(_state "wine")
local nvme_state
nvme_state=$(_state "nvme-cli")
items+=(
"btop" "Resource monitor (fancy top)" "$btop_state"
"compress" "Compression tools (zip, unrar, 7z)" "$compress_state"
"cpufetch" "CPU info fetcher" "$cpufetch_state"
"cpu-x" "CPU-X (alternative to CPU-Z)" "$cpu_x_state"
"curl-wget" "HTTP transfer tools (curl, wget)" "$curl_wget_state"
"extrepo" "External repository manager" "$extrepo_state"
"fwupd" "Firmware update daemon" "$fwupd_state"
"htop" "Interactive process viewer" "$htop_state"
"inxi" "System information tool" "$inxi_state"
"jq" "JSON command-line processor" "$jq_state"
"kvm" "QEMU/KVM virtualization" "$kvm_state"
"lshw" "List hardware details" "$lshw_state"
"mc" "Midnight Commander (file manager)" "$mc_state"
"nala" "APT frontend (parallel downloads)" "$nala_state"
"ncdu" "Disk usage analyzer (ncurses)" "$ncdu_state"
"nvme-cli" "NVMe SSD health monitoring" "$nvme_state"
"tmux" "Terminal multiplexer" "$tmux_state"
"wine" "Windows compatibility layer" "$wine_state"
)
if ! $headless; then
local bleachbit_state
bleachbit_state=$(_state "bleachbit")
local conky_state
conky_state=$(_state "conky-all")
local gdebi_state
gdebi_state=$(_state "gdebi")
local corectrl_state
corectrl_state=$(_state "corectrl")
local dcgtk_state
dcgtk_state=$(_state "doublecmd-gtk")
local dcqt_state
dcqt_state=$(_state "doublecmd-qt")
local disks_state
disks_state=$(_state "gnome-disk-utility")
local gparted_state
gparted_state=$(_state "gparted")
local hardinfo_state
hardinfo_state=$(_state "hardinfo")
local psensor_state
psensor_state=$(_state "psensor")
local timeshift_state
timeshift_state=$(_state "timeshift")
items+=(
"bleachbit" "System cleaner (GUI)" "$bleachbit_state"
"conky-all" "System monitor for desktop" "$conky_state"
"gdebi" "Install .deb packages with deps" "$gdebi_state"
"corectrl" "AMD GPU control (CoreCtrl)" "$corectrl_state"
"doublecmd-gtk" "Dual-panel file manager (GTK)" "$dcgtk_state"
"doublecmd-qt" "Dual-panel file manager (Qt)" "$dcqt_state"
"gnome-disk-utility" "Disk management GUI" "$disks_state"
"gparted" "GNOME partition editor" "$gparted_state"
"hardinfo" "Graphical system profiler" "$hardinfo_state"
"psensor" "Hardware temperature monitor" "$psensor_state"
"timeshift" "System restore snapshots" "$timeshift_state"
)
fi
local item_count=${#items[@]}
local lista_alto=$((item_count > TUI_ALTO_LISTA ? TUI_ALTO_LISTA : item_count))
local choices
choices=$(
_checklist "System Tools" "Check [*] the packages you want installed/updated on your system.\n" $TUI_ALTO $TUI_ANCHO $lista_alto \
"${items[@]}"
)
clear
[ -z "$choices" ] && return
local cleaned
cleaned=$(echo "$choices" | tr -d '"')
for pkg in $cleaned; do
case $pkg in
compress)
local need=()
! is_installed "zip" && need+=("zip")
! is_installed "unzip" && need+=("unzip")
! is_installed "rar" && need+=("rar")
! is_installed "unrar" && need+=("unrar")
! is_installed "p7zip-full" && need+=("p7zip-full")
! is_installed "p7zip-rar" && need+=("p7zip-rar")
if [ ${#need[@]} -gt 0 ]; then
_run_install_batch "${need[@]}"
echo -e "${GREEN}Compression utilities installed.${NC}"
fi
;;
curl-wget)
local need=()
! is_installed "curl" && need+=("curl")
! is_installed "wget" && need+=("wget")
if [ ${#need[@]} -gt 0 ]; then
_run_install_batch "${need[@]}"
else
echo "curl and wget already installed."
fi
;;
extrepo)
install_backports_or_stable extrepo
;;
fwupd)
if ! is_installed "fwupd"; then
_run_cmd "fwupd" "sudo apt install -y fwupd" "Installing fwupd..."
else
echo "fwupd already installed."
fi
if _confirm "Firmware Scan" "Scan for firmware updates now?\n\nThis will run:\n fwupdmgr refresh\n fwupdmgr get-updates\n fwupdmgr update (if available)"; then
_run_cmd "fwupd" "sudo fwupdmgr refresh --force" "Refreshing firmware metadata..."
echo ""
echo "Checking for firmware updates..."
local _fwupd_out
_fwupd_out=$(sudo fwupdmgr get-updates 2>&1 || true)
# Strict match: must not trigger on "No updates available"
# or "Devices with the latest available firmware version".
if echo "$_fwupd_out" | grep -Eq 'Upgrade available|New version:'; then
if _confirm "Firmware Update" "Firmware updates are available.\nInstall them now?"; then
_run_cmd "fwupd" "sudo fwupdmgr update -y" "Installing firmware updates..."
else
echo "Skipping firmware update."
_pause
fi
else
echo "No firmware updates available."
_pause
fi
fi
echo -e "${GREEN}fwupd setup complete.${NC}"
_pause
;;
kvm)
if ! is_installed "virt-manager"; then
_run_cmd "KVM" "sudo apt install -y qemu-system-x86 qemu-utils libvirt-daemon-system libvirt-clients bridge-utils virt-manager" "Installing KVM..."
sudo adduser "$USER" libvirt 2>/dev/null || true
sudo adduser "$USER" kvm 2>/dev/null || true
echo -e "${GREEN}QEMU/KVM installed. A reboot is recommended.${NC}"
else
echo "QEMU/KVM already installed."
fi
;;
wine)
if ! is_installed "wine64"; then
_run_cmd "Wine" "sudo apt install -y --no-install-recommends wine64 fonts-wine" "Installing Wine (64-bit only)..."
local wine_ver
wine_ver=$(wine --version 2>/dev/null)
if [ -n "$wine_ver" ]; then
echo -e "${GREEN}Wine (64-bit) installed: ${wine_ver}${NC}"
else
echo -e "${YELLOW}Wine installed but version check failed.${NC}"
fi
else
echo "Wine64 already installed."
fi
;;
nvme-cli)
if ! timeout 2 lsblk -d -o TRAN 2>/dev/null | grep -q "^nvme$"; then
echo "No NVMe controller detected. Skipping."
continue
fi
if ! is_installed "nvme-cli"; then
_run_cmd "nvme-cli" "sudo apt install -y nvme-cli" "Installing nvme-cli..."
fi
local nvme_devs=()
while read -r dev; do
nvme_devs+=("$dev")
done < <(timeout 2 lsblk -d -o NAME,TRAN 2>/dev/null | awk '$2 == "nvme" {print $1}')
if [ ${#nvme_devs[@]} -eq 0 ]; then
echo "No NVMe block devices found for health check."
continue
fi
local dev_list=""
local dev
for dev in "${nvme_devs[@]}"; do
[ -n "$dev_list" ] && dev_list+=", "
dev_list+="/dev/${dev}"
done
if _confirm "NVMe Health" "Run smart-log on ${#nvme_devs[@]} NVMe device(s): ${dev_list}?"; then
echo ""
for dev in "${nvme_devs[@]}"; do
local cw="" temp="" pu=""
while IFS= read -r line; do
case "$line" in
*critical_warning*) cw="${line##*: }" ;;
*temperature*) temp="${line##*: }" ;;
*percentage_used*) pu="${line##*: }" ;;
esac
done < <(sudo nvme smart-log "/dev/${dev}" 2>/dev/null || true)
echo -e "${YELLOW}━━━ /dev/${dev} ━━━${NC}"
echo -e " ${GREEN}Critical Warning:${NC} ${cw:-N/A}"
echo -e " ${GREEN}Temperature:${NC} ${temp:-N/A}"
echo -e " ${GREEN}Percentage Used:${NC} ${pu:-N/A}"
echo ""
done
_pause
fi
;;
*)
if ! is_installed "$pkg"; then
_run_install "$pkg"
else
echo "$pkg already installed."
fi
;;
esac
done
echo -e "${GREEN}System tools installed.${NC}"
_pause
}