mirror of
https://github.com/stornic56/debianito-post-install.git
synced 2026-09-15 06:32:37 +00:00
54257d5a8a
- Fixed command injection in desktop_display.sh by converting word-splitting loops to safe array-based iteration for LightDM/GDM3 configuration and XFCE package installation. - Added symlink detection guard before repository file operations in repos.sh to prevent TOCTOU attacks during restore_previous_repos(). - Hardened SUDO_USER resolution with awk validation against /etc/passwd to prevent root fallback and ensure real login users are targeted for sudoers configuration. - Implemented algorithm (lz4/zstd) and size validation before ZRAM configuration writes in zram.sh to reject invalid inputs. - Protected grep MemTotal read from /proc/meminfo with 2>/dev/null and default assignment under set -u. - Added || true guards around apt-cache madison pipelines in firmware.sh, kernel.sh, gpu.sh, and utils.sh to prevent pipefail aborts when backports unavailable. - Wrapped whiptail installation in if/else blocks to allow offline error messages instead of script termination under set -e. - Fixed grep -c output duplication in swap.sh with proper || true pattern and default variable assignment. - Replaced unquoted $cleaned loops with array conversion using while read for secure package iteration across gaming, desktop_display, firmware, and kernel modules. - Anchored sed regex patterns to space-delimited "main" components to prevent mirror URL corruption in sources.list editing. - Escaped % characters in _msg() function before passing to whiptail to prevent printf format interpretation crashes. - Consolidated package version helpers into canonical wrappers: _get_pkg_version, _get_installed_version, _get_backports_version for consistent apt/dpkg queries. - Created _install_if_missing() and _install_pkg() with proper error handling that respects set -e while providing user feedback on installation failures. - Removed 6 dead code functions (~51 lines): check_system_time, sync_system_time, get_cpu_summary, get_ram_summary, pkg_versions, get_backports_kernel_version. - Added detect_displayserver and detect_audio_server to refresh_system_state() for complete state refresh when returning from menus. - Enhanced _on_interrupt() trap handler to kill lingering apt/dpkg child processes and clean /tmp/debianito.* temporary files on Ctrl+C or TERM. - Improved restore_previous_repos() with manifest-based backup verification (.backed_up_* markers) to prevent destructive repository file deletion. - Added mktemp usage for secure temporary deb file downloads in nvidia.sh, heroic.sh, and tools.sh to eliminate TOCTOU vulnerabilities in /tmp. - Fixed Bluetooth USB dongle misclassification as WiFi devices by excluding "bluetooth" strings from USB_WIFI_DEVS detection in firmware.sh. - Properly utilized the need array for selective package installation in internet.sh instead of hardcoding full package list. - Corrected fwupdmgr duplicate execution and grep false positives in system.sh with strict pattern matching for available updates. - update docs and added quickstart guide
187 lines
5.7 KiB
Bash
187 lines
5.7 KiB
Bash
#!/usr/bin/env bash
|
|
# swap.sh — Disk-based swap management (swapfile + swappiness)
|
|
# Independent of zram.sh. Uses pri=10 to coexist with ZRAM priority=100.
|
|
|
|
readonly SWAP_FILE="/swapfile"
|
|
readonly SWAP_FSTAB_TAG="# debianito-managed-swap"
|
|
readonly SWAP_PRIORITY="10"
|
|
readonly SWAP_CONF="/etc/sysctl.d/99-swappiness-debianito.conf"
|
|
readonly SWAP_LOCK="/run/lock/debianito-swap.lock"
|
|
|
|
# ── Helpers ──
|
|
|
|
_swap_valid_fstab() {
|
|
local tmp="$1"
|
|
sudo findmnt --verify --fstab "$tmp" >/dev/null 2>&1
|
|
}
|
|
|
|
_swap_safe_write_fstab() {
|
|
local line="$1"
|
|
local tmp
|
|
tmp=$(mktemp) || return 1
|
|
sudo cp /etc/fstab "$tmp"
|
|
sudo sed -i "/$SWAP_FSTAB_TAG/d" "$tmp"
|
|
[ -n "$line" ] && printf '%s\n' "$line" >> "$tmp"
|
|
if _swap_valid_fstab "$tmp"; then
|
|
sudo install -o root -g root -m 0644 "$tmp" /etc/fstab
|
|
else
|
|
local err
|
|
err=$(sudo findmnt --verify --fstab "$tmp" 2>&1 || true)
|
|
rm -f "$tmp"
|
|
_msg "fstab Error" "Validation failed — changes NOT applied.\n\n$err" 12 70
|
|
return 1
|
|
fi
|
|
rm -f "$tmp"
|
|
}
|
|
|
|
_swap_recommend_gb() {
|
|
if [ -z "${RAM_GB:-}" ]; then
|
|
echo 2
|
|
return
|
|
fi
|
|
local ram
|
|
ram=$(echo "$RAM_GB" | awk '{print int($1)}')
|
|
if [ "$ram" -ge 16 ]; then
|
|
echo 2
|
|
elif [ "$ram" -ge 8 ]; then
|
|
echo 4
|
|
else
|
|
local rec
|
|
rec=$((ram * 2))
|
|
[ "$rec" -lt 1 ] && rec=1
|
|
echo "$rec"
|
|
fi
|
|
}
|
|
|
|
# ── Menu options ──
|
|
|
|
_swap_current_status() {
|
|
local info="── Current swap ──\n"
|
|
info+="$(sudo swapon --show 2>/dev/null || echo '(none active)')\n\n"
|
|
info+="swappiness: $(cat /proc/sys/vm/swappiness)\n\n"
|
|
info+="fstab swap entries:\n"
|
|
info+="$(grep -E 'swap|SWAP' /etc/fstab 2>/dev/null || echo '(none in fstab)')"
|
|
_msg "Swap Status" "$info" 14 65
|
|
}
|
|
|
|
_swap_create_file() {
|
|
local fstype rec_gb
|
|
fstype=$(stat -f -c %T "$(dirname "$SWAP_FILE")" 2>/dev/null || echo "ext4")
|
|
rec_gb=$(_swap_recommend_gb)
|
|
|
|
local warn=""
|
|
if [ "$fstype" = "btrfs" ]; then
|
|
warn="Filesystem: Btrfs\nSwapfile on Btrfs needs extra steps (nodatacow).\nHibernation requires swap ≥ RAM and manual resume= config.\n\n"
|
|
fi
|
|
warn+="ZRAM (priority 100) is used first.\nDisk swap (priority $SWAP_PRIORITY) is only consumed after ZRAM fills."
|
|
|
|
_msg "Swapfile Info" "$warn" 14 65
|
|
|
|
local size_gb
|
|
size_gb=$(_inputbox "Swapfile Size" "Size in GB for $SWAP_FILE:" 10 60 "$rec_gb")
|
|
[ -z "$size_gb" ] && return
|
|
[[ "$size_gb" =~ ^[0-9]+$ ]] && [ "$size_gb" -gt 0 ] || {
|
|
_msg "Error" "Enter a positive integer." 8 40
|
|
return
|
|
}
|
|
|
|
if [ -f "$SWAP_FILE" ]; then
|
|
_confirm "Swapfile exists" "$SWAP_FILE already exists.\nRecreate it (${size_gb} GB)?" || return
|
|
sudo swapoff "$SWAP_FILE" 2>/dev/null || true
|
|
sudo rm -f "$SWAP_FILE"
|
|
fi
|
|
|
|
echo -e "${YELLOW}Allocating ${size_gb}G swapfile...${NC}"
|
|
if [ "$fstype" = "btrfs" ]; then
|
|
sudo touch "$SWAP_FILE"
|
|
sudo chattr +C "$SWAP_FILE" 2>/dev/null || true
|
|
sudo dd if=/dev/zero of="$SWAP_FILE" bs=1M count=$((size_gb * 1024)) status=progress
|
|
else
|
|
sudo fallocate -l "${size_gb}G" "$SWAP_FILE" || \
|
|
sudo dd if=/dev/zero of="$SWAP_FILE" bs=1M count=$((size_gb * 1024)) status=progress
|
|
fi
|
|
|
|
sudo chmod 600 "$SWAP_FILE"
|
|
sudo mkswap "$SWAP_FILE" >/dev/null
|
|
sudo swapon "$SWAP_FILE"
|
|
|
|
local fstab_line
|
|
fstab_line="$SWAP_FILE none swap sw,pri=$SWAP_PRIORITY 0 0 $SWAP_FSTAB_TAG # pri=$SWAP_PRIORITY (below zram 100)"
|
|
if _swap_safe_write_fstab "$fstab_line"; then
|
|
_msg "Swapfile" "Swapfile created and added to fstab (persistent).\n\nPriority: $SWAP_PRIORITY (below ZRAM 100)." 12 65
|
|
else
|
|
sudo swapoff "$SWAP_FILE" 2>/dev/null || true
|
|
sudo rm -f "$SWAP_FILE"
|
|
fi
|
|
}
|
|
|
|
_swap_remove_file() {
|
|
local has_tag
|
|
has_tag=$(grep -c "$SWAP_FSTAB_TAG" /etc/fstab 2>/dev/null || true)
|
|
has_tag=${has_tag:-0}
|
|
[ "$has_tag" -eq 0 ] && [ ! -f "$SWAP_FILE" ] && {
|
|
_msg "Swap" "No managed swapfile found." 8 50
|
|
return
|
|
}
|
|
|
|
_confirm "Remove Swapfile" "Disable and delete $SWAP_FILE?\n\nRemoves fstab entry and deletes the file." || return
|
|
|
|
sudo swapoff "$SWAP_FILE" 2>/dev/null || true
|
|
_swap_safe_write_fstab ""
|
|
sudo rm -f "$SWAP_FILE"
|
|
_msg "Swap" "Swapfile removed and fstab entry cleaned." 8 60
|
|
}
|
|
|
|
_swap_set_swappiness() {
|
|
local cur val
|
|
cur=$(cat /proc/sys/vm/swappiness 2>/dev/null || echo 60)
|
|
val=$(_inputbox "Swappiness" "Current value: $cur\nEnter new value (0-100):" 10 60 "$cur")
|
|
[ -z "$val" ] && return
|
|
[[ "$val" =~ ^[0-9]+$ ]] && [ "$val" -le 100 ] || {
|
|
_msg "Error" "Value must be 0-100." 8 40
|
|
return
|
|
}
|
|
|
|
local tmp
|
|
tmp=$(mktemp) || return
|
|
printf 'vm.swappiness=%s\n' "$val" > "$tmp"
|
|
sudo install -o root -g root -m 0644 "$tmp" "$SWAP_CONF"
|
|
sudo sysctl -w "vm.swappiness=$val" >/dev/null
|
|
rm -f "$tmp"
|
|
_msg "Swappiness" "swappiness set to $val (persistent)." 8 60
|
|
}
|
|
|
|
# ── Entry point ──
|
|
|
|
manage_swap() {
|
|
exec 9>"$SWAP_LOCK"
|
|
flock -n 9 || {
|
|
_msg "Busy" "Another swap operation is already running." 8 55
|
|
return
|
|
}
|
|
|
|
while true; do
|
|
local choice
|
|
choice=$(_menu "Swap Management" \
|
|
"Select an option:" $TUI_ALTO $TUI_ANCHO 6 \
|
|
"1" "Show current swap & swappiness" \
|
|
"2" "Create / resize swapfile" \
|
|
"3" "Remove swapfile" \
|
|
"4" "Change swappiness" \
|
|
"5" "Back to main menu")
|
|
|
|
[ -z "$choice" ] && break
|
|
clear
|
|
|
|
case "$choice" in
|
|
1) _swap_current_status ;;
|
|
2) _swap_create_file ;;
|
|
3) _swap_remove_file ;;
|
|
4) _swap_set_swappiness ;;
|
|
5) break ;;
|
|
esac
|
|
done
|
|
|
|
exec 9>&-
|
|
}
|