systemrescue-zfs/airootfs/etc/systemd/scripts/sysrescue-initialize

#!/bin/bash
echo "$0 Starting ..."
errcnt=0

# Process options passed on the boot command line
for curopt in $(< /proc/cmdline)
do
    case "${curopt}" in
      # Configure keyboard layout if requested in the boot command line
      setkmap=*)
          echo "Found option '${curopt}' on the boot command line"
          localectl set-keymap ${curopt#*=}
          ;;

      # Configure root login shell if requested in the boot command line
      rootshell=*)
          echo "Found option '${curopt}' on the boot command line"
          chsh --shell ${curopt#*=} root
          ;;

      # Set the system root password from a clear password
      rootpass=*)
          echo "Found option 'rootpass=******' on the boot command line"
          if echo "root:${curopt#*=}" | chpasswd --crypt-method SHA512
          then
              echo "Password successfully changed"
          else
              echo "Failed to change password"
              errcnt=$((errcnt + 1))
          fi
          ;;

      # Set the system root password from an encrypted password
      # A password can be encrypted using a one-line python3 command such as:
      # python3 -c 'import crypt; print(crypt.crypt("MyPassWord123", crypt.mksalt(crypt.METHOD_SHA512)))'
      rootcryptpass=*)
          echo "Found option 'rootcryptpass=******' on the boot command line"
          if echo "root:${curopt#*=}" | chpasswd --encrypted
          then
              echo "Password successfully changed"
          else
              echo "Failed to change password"
              errcnt=$((errcnt + 1))
          fi
          ;;

      # Option to allow user to disable the firewall
      nofirewall)
          echo "Found option '${curopt}' on the boot command line"
          # the firewall service(s) must be in the Before-section of sysrescue-initialize.service
          systemctl disable --now iptables.service ip6tables.service
          ;;

      # Auto-start the graphical environment (tty1 only)
      dostartx)
          echo "Found option '${curopt}' on the boot command line"
          echo '[[ ! $DISPLAY ]] && [[ ! $SSH_TTY ]] && [[ $XDG_VTNR == 1 ]] && startx' | \
              tee -a /root/.bash_profile > /root/.zlogin
          ;;

      # Require authenticated console access
      noautologin)
          echo "Found option '${curopt}' on the boot command line"
          systemctl revert getty@.service serial-getty@.service
          ;;
    esac
done

exit ${errcnt}