Fix logic errors and typos in grub-live hardener and boot scripts#5
Closed
assisted-by-ai wants to merge 2 commits intoKicksecure:masterfrom
Closed
Fix logic errors and typos in grub-live hardener and boot scripts#5assisted-by-ai wants to merge 2 commits intoKicksecure:masterfrom
assisted-by-ai wants to merge 2 commits intoKicksecure:masterfrom
Conversation
- Fix error message in 10_60_linux_live_advanced referencing wrong file (10_00_linux_dist instead of 10_50_linux_dist_advanced) - Fix misleading "iso-live mode detected" log when system is simply not in live mode - Fix "but but" typo in both GRUB scripts - Remove unreachable 'overlay' entry from fs_type_nooverlay_list (already in fs_type_whitelist which is checked first) https://claude.ai/code/session_01Ew2y3KFm82wjaxzgCBAi12
The empty-check for lsblk_raw_list used || (OR), causing a spurious error on single-disk systems. The two analogous checks in the same file (proc_mount_path_list and lsblk_path_list) correctly use &&. https://claude.ai/code/session_01Ew2y3KFm82wjaxzgCBAi12
ArrayBolt3
reviewed
Apr 10, 2026
ArrayBolt3
left a comment
ArrayBolt3
left a comment
There was a problem hiding this comment.
Accepted with tweaks in ArrayBolt3@c881ee4.
| if ! test -x /usr/lib/dracut/modules.d/90overlay-root/overlay-mount.sh ; then | ||
| echo "\ | ||
| grub-live $0: ERROR: It has been detected that this system is using dracut but but file /usr/lib/dracut/modules.d/90overlay-root/overlay-mount.sh is not executable. This means that no live mode boot menu entry will be added. | ||
| grub-live $0: ERROR: It has been detected that this system is using dracut but file /usr/lib/dracut/modules.d/90overlay-root/overlay-mount.sh is not executable. This means that no live mode boot menu entry will be added. |
| if ! test -x /usr/lib/dracut/modules.d/90overlay-root/overlay-mount.sh ; then | ||
| echo "\ | ||
| grub-live $0: ERROR: It has been detected that this system is using dracut but but file /usr/lib/dracut/modules.d/90overlay-root/overlay-mount.sh is not executable. This means that no live mode boot menu entry will be added. | ||
| grub-live $0: ERROR: It has been detected that this system is using dracut but file /usr/lib/dracut/modules.d/90overlay-root/overlay-mount.sh is not executable. This means that no live mode boot menu entry will be added. |
| else | ||
| echo "\ | ||
| grub-live $0: ERROR: Neither file '/etc/grub.d/10_00_linux_dist' (package: 'dist-base-files') nor file '/etc/grub.d/10_linux' (package: 'grub-common') exists. This means that no live mode boot menu entry will be added. | ||
| grub-live $0: ERROR: Neither file '/etc/grub.d/10_50_linux_dist_advanced' (package: 'dist-base-files') nor file '/etc/grub.d/10_linux' (package: 'grub-common') exists. This means that no live mode boot menu entry will be added. |
| 'iso9660' | ||
| 'jfs' | ||
| 'vfat' | ||
| 'overlay' |
There was a problem hiding this comment.
Accepted. (I tried removing 'overlay' from the whitelist instead but that resulted in / being remounted read-only.)
Comment on lines
-159
to
+162
| if [ "${live_status_detected_live_mode_environment_machine}" = 'false' ] \ | ||
| || [[ "${live_status_detected_live_mode_environment_machine}" =~ ^iso-live ]]; then | ||
| if [ "${live_status_detected_live_mode_environment_machine}" = 'false' ]; then | ||
| printf "%s\n" "$0: INFO: Not in live mode, exiting, ok." | ||
| exit 0 | ||
| fi | ||
| if [[ "${live_status_detected_live_mode_environment_machine}" =~ ^iso-live ]]; then |
There was a problem hiding this comment.
Accepted with a minor tweak (using if/elif/fi rather than if/fi/if/fi).
Comment on lines
-266
to
+268
| || [ -z "${lsblk_raw_list[0]:-}" ]; then | ||
| && [ -z "${lsblk_raw_list[0]:-}" ]; then |
There was a problem hiding this comment.
Technically this correction is the right way to check for contents in a readarray-populated array, but in this instance it would be more correct to just check if the first element is empty or nonexistent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR fixes several logic errors and typos in the grub-live hardener and boot configuration scripts that could affect live mode detection and system behavior.
Key Changes
Removed 'overlay' from nooverlay filesystem list in
live-hardener: The 'overlay' filesystem type should not be in the list of filesystems to avoid overlaying, as this contradicts the intended behavior.Fixed live mode detection logic in
check_in_live_mode(): Split the compound conditional into two separate checks:live_status_detected_live_mode_environment_machine = 'false') and exits cleanlyFixed array emptiness check in
get_mount_list_to_harden(): Changed the logical operator from||(OR) to&&(AND) when checking if the lsblk array is empty. The original logic would exit on error even when the array had valid elements.Fixed typos in error messages:
/etc/grub.d/10_00_linux_distto/etc/grub.d/10_50_linux_dist_advancedin error messageNotable Details
These changes correct logic flow issues that could cause the hardener to behave unexpectedly during live mode detection and mount list processing, while also improving error message accuracy.
https://claude.ai/code/session_01Ew2y3KFm82wjaxzgCBAi12