3

When I install Manjaro (16.10.3) from the LiveCD using the erase drive + encrypted option, it seems to create a setup like the following:

  • Encrypted /dev/sda1 holding / and encrypted /dev/sda2 used as swap
  • Unknown process prompts for decryption passphrase at boot
  • Entering passphrase brings up GRUB menu, from which Manjaro can be booted

How is this accomplished? On the Arch wiki's "encrypted boot" section, I can only find a description for UEFI systems (my computer is BIOS only). That one also involves creating a separate (encrypted) /boot partition, which Manjaro does not create.

Improve this question

1 Answer 1

Reset to default
2

It appears that Grub is basically taking care of it. Notice that although you are prompted for the passphrase before the Grub menu, it is right after the "Welcome to Grub" message.

Take a look inside the grub.cfg file at the following entries: 

insmod cryptodisk
insmod luks
insmod gcry_rijndael
insmod gcry_sha256
...
cryptomount -u [encrypted container UUID]
set root='cryptouuid/[encrypted container UUID]
...
search ... --hint='cryptouuid/[encrypted container UUID]

After Grub, there are some obviously important settings in /etc/mkinitcpio.conf: 

FILES="/crypto_keyfile.bin"  
HOOKS="[nothing out of the ordinary except `encrypt`]"

It's a recent feature of their Calamares installer that has provided this functionality on install.

Also, take a look at this if you haven't already.

Improve this answer
2
  • I'm confused by this. How is GRUB loaded before decryption when it's on /boot that is part of the encrypted fs?
    – user212900
    Jan 28, 2017 at 20:04
  • At some point, the installer program ran the command grub-install, which installed it to the master boot record of the hard drive. My guess is that grub can detect an encrypted drive/partition from there then opens the grub.cfg that it needs to finish the job, provide a menu etc., afterwords. The MBR is where the partition table lives, too. I'm pretty sure of the gist of this though I don't claim to understand every detail of the boot process.
    – airhuff
    Jan 28, 2017 at 22:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .