secubox-deb/image/sbin/secubox-cmdline-handler

#!/bin/bash
# ══════════════════════════════════════════════════════════════════
#  secubox-cmdline-handler — Kernel Command Line Parameter Handler
#  Parses kernel parameters for SecuBox-specific options
#  Run early at boot before network configuration
# ══════════════════════════════════════════════════════════════════
set -u  # Exit on undefined variables, but allow command failures

CMDLINE="${1:-/proc/cmdline}"
MARKER_DIR="/var/lib/secubox"

log() { echo "[cmdline] $*" | systemd-cat -t secubox-cmdline -p info 2>/dev/null || echo "[cmdline] $*"; }

# Parse kernel command line
parse_cmdline() {
    local cmdline
    cmdline=$(cat "$CMDLINE" 2>/dev/null || echo "")

    # Default values
    local netmode="router"
    local kiosk="0"
    local mode="kiosk"  # Default display mode: kiosk, tui, or console
    local debug="0"
    local install="0"

    for param in $cmdline; do
        case "$param" in
            secubox.netmode=*)
                netmode="${param#secubox.netmode=}"
                ;;
            secubox.kiosk=*)
                kiosk="${param#secubox.kiosk=}"
                ;;
            secubox.mode=*)
                mode="${param#secubox.mode=}"
                ;;
            secubox.debug=*)
                debug="${param#secubox.debug=}"
                ;;
            secubox.install=*)
                install="${param#secubox.install=}"
                ;;
        esac
    done

    # Export values
    echo "SECUBOX_NETMODE=${netmode}"
    echo "SECUBOX_KIOSK=${kiosk}"
    echo "SECUBOX_MODE=${mode}"
    echo "SECUBOX_DEBUG=${debug}"
    echo "SECUBOX_INSTALL=${install}"
}

# Send boot mode to Plymouth splash
send_plymouth_mode() {
    local mode="$1"
    local mode_text=""

    case "$mode" in
        kiosk)   mode_text="KIOSK MODE" ;;
        tui)     mode_text="TUI MODE" ;;
        console) mode_text="CONSOLE MODE" ;;
        *)       mode_text="BOOTING..." ;;
    esac

    # Send message to Plymouth if available
    if command -v plymouth &>/dev/null && plymouth --ping 2>/dev/null; then
        plymouth message --text="$mode_text"
        log "Plymouth: $mode_text"
    fi
}

# Apply settings from command line
apply_settings() {
    mkdir -p "$MARKER_DIR"

    # Source parsed values
    eval "$(parse_cmdline)"

    log "Network mode: $SECUBOX_NETMODE"
    log "Display mode: $SECUBOX_MODE"

    # Send boot mode to Plymouth
    send_plymouth_mode "$SECUBOX_MODE"

    # Handle display mode (kiosk/tui/console)
    case "$SECUBOX_MODE" in
        tui)
            log "TUI mode requested via cmdline"
            rm -f "${MARKER_DIR}/.kiosk-enabled"
            touch "${MARKER_DIR}/.tui-enabled"

            # Mask kiosk service to prevent any startup
            systemctl mask secubox-kiosk.service 2>/dev/null || true
            systemctl stop secubox-kiosk.service 2>/dev/null || true

            # Kill any X11/Chromium if already started
            pkill -9 Xorg 2>/dev/null || true
            pkill -9 chromium 2>/dev/null || true

            # Enable TUI service
            systemctl unmask secubox-console-tui.service 2>/dev/null || true
            systemctl enable secubox-console-tui.service 2>/dev/null || true

            # Set multi-user target for current AND future boots
            systemctl set-default multi-user.target 2>/dev/null || true

            # Write to generator drop-in to ensure correct target on this boot
            mkdir -p /run/systemd/generator
            echo "[Unit]" > /run/systemd/generator/default.target
            echo "Requires=multi-user.target" >> /run/systemd/generator/default.target

            systemctl daemon-reload 2>/dev/null || true

            # Start TUI service
            log "Starting console TUI service..."
            systemctl start secubox-console-tui.service 2>/dev/null &
            ;;
        console)
            log "Console mode requested via cmdline (standard shell)"
            rm -f "${MARKER_DIR}/.kiosk-enabled"
            rm -f "${MARKER_DIR}/.tui-enabled"

            # Disable both kiosk and TUI
            systemctl disable secubox-kiosk.service 2>/dev/null || true
            systemctl disable secubox-console-tui.service 2>/dev/null || true
            systemctl stop secubox-kiosk.service 2>/dev/null || true
            systemctl stop secubox-console-tui.service 2>/dev/null || true

            # Set multi-user target with standard getty
            systemctl set-default multi-user.target 2>/dev/null || true
            systemctl enable getty@tty1.service 2>/dev/null || true
            ;;
        kiosk)
            log "Kiosk mode explicitly requested"
            # Will be handled below with secubox.kiosk=1 logic
            ;;
        *)
            # Default: check if kiosk marker exists from build time
            if [[ -f "${MARKER_DIR}/.kiosk-enabled" ]]; then
                log "Default mode: Kiosk (marker present from build)"
            else
                log "Default mode: Console shell"
            fi
            ;;
    esac

    # Handle network mode
    if [[ -x /usr/sbin/secubox-net-detect ]]; then
        case "$SECUBOX_NETMODE" in
            router|bridge|single)
                log "Applying network mode: $SECUBOX_NETMODE"
                /usr/sbin/secubox-net-detect apply "$SECUBOX_NETMODE"
                ;;
            *)
                log "Unknown netmode '$SECUBOX_NETMODE', using router"
                /usr/sbin/secubox-net-detect apply router
                ;;
        esac
    fi

    # Handle kiosk mode
    if [[ "$SECUBOX_KIOSK" == "1" ]]; then
        log "Kiosk mode requested via cmdline"
        touch "${MARKER_DIR}/.kiosk-enabled"

        # Check if kiosk packages are already installed (pre-baked in image)
        # Support both X11 (xinit/Xorg) and Wayland (cage)
        local has_display=0
        if command -v xinit >/dev/null 2>&1 || command -v Xorg >/dev/null 2>&1; then
            log "X11 kiosk environment detected"
            has_display=1
        elif command -v cage >/dev/null 2>&1; then
            log "Wayland (cage) kiosk environment detected"
            has_display=1
        fi

        if [[ "$has_display" == "1" ]] && command -v chromium >/dev/null 2>&1; then
            log "Kiosk packages present, enabling kiosk mode"

            # Setup user and scripts if needed (this doesn't require network)
            if [[ -x /usr/sbin/secubox-kiosk-setup ]]; then
                # Just setup user/scripts, don't try apt-get install
                /usr/sbin/secubox-kiosk-setup enable 2>/dev/null || log "Kiosk enable deferred"
            fi

            # NOTE: Do NOT set graphical.target - kiosk service runs in multi-user.target
            # The service is enabled and will start automatically

            log "Kiosk mode enabled - service will start via multi-user.target"
        else
            log "Kiosk packages NOT present - use --kiosk flag when building live USB"
            log "Will attempt installation when network is available"

            # Create a oneshot service to install kiosk after network
            cat > /etc/systemd/system/secubox-kiosk-install.service <<EOF
[Unit]
Description=SecuBox Kiosk Package Installation
After=network-online.target
Wants=network-online.target
ConditionPathExists=!/var/lib/secubox/.kiosk-installed

[Service]
Type=oneshot
ExecStart=/usr/sbin/secubox-kiosk-setup install
ExecStart=/usr/sbin/secubox-kiosk-setup enable
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF
            systemctl daemon-reload 2>/dev/null || true
            systemctl enable secubox-kiosk-install.service 2>/dev/null || true
        fi
    fi

    # Debug mode
    if [[ "$SECUBOX_DEBUG" == "1" ]]; then
        log "Debug mode enabled"
        touch "${MARKER_DIR}/.debug-enabled"
    fi

    # Install mode - launch installer on tty1
    if [[ "$SECUBOX_INSTALL" == "1" ]]; then
        log "Install mode requested - launching disk installer"
        touch "${MARKER_DIR}/.install-mode"
        rm -f "${MARKER_DIR}/.kiosk-enabled"
        rm -f "${MARKER_DIR}/.tui-enabled"

        # Create installer service
        cat > /etc/systemd/system/secubox-install.service <<'EOF'
[Unit]
Description=SecuBox Disk Installer
After=basic.target
Conflicts=getty@tty1.service

[Service]
Type=oneshot
ExecStart=/usr/bin/secubox-install
StandardInput=tty
StandardOutput=tty
TTYPath=/dev/tty1
TTYReset=yes
TTYVHangup=yes

[Install]
WantedBy=multi-user.target
EOF
        systemctl daemon-reload 2>/dev/null || true
        systemctl enable secubox-install.service 2>/dev/null || true
        systemctl start secubox-install.service 2>/dev/null &
    fi
}

# Main
case "${1:-apply}" in
    parse)
        parse_cmdline
        ;;
    apply)
        apply_settings
        ;;
    *)
        echo "Usage: $0 {parse|apply}"
        exit 1
        ;;
esac