From f134ddebd17460299dc6e7c6b451cafd0d6c0ca1 Mon Sep 17 00:00:00 2001
From: TommyTran732 <57488583+tommytran732@users.noreply.github.com>
Date: Fri, 23 Apr 2021 02:36:39 -0400
Subject: [PATCH] Update install.sh

---
 install.sh | 53 ++++++++++++++++++++++-------------------------------
 1 file changed, 22 insertions(+), 31 deletions(-)

diff --git a/install.sh b/install.sh
index 4f9ade4..9419436 100644
--- a/install.sh
+++ b/install.sh
@@ -58,10 +58,10 @@ fi
 
 # Creating a new partition scheme.
 echo "Creating new partition scheme on $DISK."
-parted -s $DISK \
+parted -s "$DISK" \
     mklabel gpt \
-    mkpart ESP fat32 1MiB 301MiB \
-    mkpart cryptroot 301MiB 100% \
+    mkpart ESP fat32 1MiB 101MiB \
+    mkpart Cryptroot 101MiB 100% \
 
 ESP="/dev/disk/by-partlabel/ESP"
 Cryptroot="/dev/disk/by-partlabel/cryptroot"
@@ -91,21 +91,22 @@ echo "Creating BTRFS subvolumes."
 btrfs su cr /mnt/@ &>/dev/null
 btrfs su cr /mnt/@boot &>/dev/null
 btrfs su cr /mnt/@home &>/dev/null
-btrfs su cr /mnt/@var &>/dev/null
+btrfs su cr /mnt/@snapshots &>/dev/null
+btrfs su cr /mnt/@var_log &>/dev/null
 
 # Mounting the newly created subvolumes.
 umount /mnt
 echo "Mounting the newly created subvolumes."
 mount -o ssd,noatime,space_cache,compress=zstd,subvol=@ $BTRFS /mnt
-mkdir -p /mnt/{home,var,boot}
-mount -o ssd,noatime,space_cache,compress=zstd,subvol=@boot $BTRFS /mnt/boot
-mount -o ssd,noatime,space_cache,compress=zstd,subvol=@home $BTRFS /mnt/home
-mount -o ssd,noatime,space_cache,nodatacow,subvol=@var $BTRFS /mnt/var/
-mkdir -p /mnt/boot/efi
+mkdir -p /mnt/{home,.snapshots,/var/log,boot}
+mount -o ssd,noatime,space_cache,compress=zstd:15,subvol=@boot $BTRFS /mnt/boot
+mount -o ssd,noatime,space_cache.compress=zstd:15,subvol=@home $BTRFS /mnt/home
+mount -o ssd,noatime,space_cache,compress=zstd:15,subvol=@snapshots $BTRFS /mnt/.snapshots
+mount -o ssd,noatime,space_cache,nodatacow,subvol=@var_log $BTRFS /mnt/var/log
+chattr +C /mnt/var/log
+mkdir /mnt/boot/efi
 mount $ESP /mnt/boot/efi
 
-chattr +C /mnt/var
-
 kernel_selector
 
 # Pacstrap (setting up a base sytem onto the new root).
@@ -157,6 +158,16 @@ cryptsetup -v luksAddKey /dev/disk/by-partlabel/cryptroot /mnt/.root.key
 sed -i -e "s,quiet,quiet cryptdevice=UUID=$UUID:cryptroot root=$BTRFS cryptkey=rootfs:/.root.key,g" /mnt/etc/default/grub
 sed -i 's#FILES=()#FILES=(/.root.key)#g' /mnt/etc/mkinitcpio.conf
 
+# Security kernel settings.
+echo "kernel.kptr_restrict = 2" > /mnt/etc/sysctl.d/51-kptr-restrict.conf
+echo "kernel.kexec_load_disabled = 1" > /mnt/etc/sysctl.d/51-kexec-restrict.conf
+cat << EOF >> /mnt/etc/sysctl.d/10-security.conf
+    fs.protected_hardlinks = 1
+    fs.protected_symlinks = 1
+    net.core.bpf_jit_harden = 2
+    kernel.yama.ptrace_scope = 3
+EOF
+
 # Configuring the system.    
 arch-chroot /mnt /bin/bash -e <<EOF
     
@@ -210,26 +221,6 @@ sed -i 's/022/077/g' /mnt/etc/profile
 echo "" >> /mnt/etc/bash.bashrc
 echo "umask 077" >> /mnt/etc/bash.bashrc
 
-#Security kernel settings
-sudo bash -c 'cat > /mnt/etc/sysctl.d/51-dmesg-restrict.conf' <<-'EOF'
-kernel.dmesg_restrict = 1
-EOF
-
-sudo bash -c 'cat > /mnt/etc/sysctl.d/51-kptr-restrict.conf' <<-'EOF'
-kernel.kptr_restrict = 2
-EOF
-
-sudo bash -c 'cat > /mnt/etc/sysctl.d/51-kexec-restrict.conf' <<-'EOF'
-kernel.kexec_load_disabled = 1
-EOF
-
-sudo bash -c 'cat > /mnt/etc/sysctl.d/10-security.conf' <<-'EOF'
-fs.protected_hardlinks = 1
-fs.protected_symlinks = 1
-net.core.bpf_jit_harden = 2
-kernel.yama.ptrace_scope = 3
-EOF
-
 #Blacklist Firewire SBP2
 echo "blacklist firewire-sbp2" | sudo tee /mnt/etc/modprobe.d/blacklist.conf