Multibooting Grub with shared /boot one distro uses Grub 1, the other Grub 2

Question

I have a set up like so:

- sda1 /boot (shared)
- sda5 (Kali: luks encrypted LVM)
  - home /home
  - root /
  - swap swap
- sda6 (Qubes(xen): luks encrypted LVM)
  - root /
  - swap swap
  - ... (a bunch of virtual machine drives)

My question is: How can I get grub set up to boot into either distro.

In /boot there's grub/ and grub2/. Grepping the two config files inside those directories, it looks like grub/ is the kali config, and grub2/ is the Qubes config.

I installed Qubes second, and it looks like that had written grub2 to the MBR and Qubes would boot fine.

The Qubes guide to multi-booting wasn't particularly helpful, explaining how to chroot back into the other partition and run some commands. I did that (after some help from here), but wound up just reinstalling the Kali bootloader but I couldn't boot into Qubes.

From Kali I attempted to mount the Qubes volumes and run os-prober/grub-update to get Qubes booting again but to no avail, it seems to get confused by Xen and all the VM volumes and things get wierd*.

I feel like continuing on unguided at this point is just going to become an unrecoverable mess, and while I could simply reinstall one or both OSes, and I think I can find my way from there, I figured trying to grapple with grub will give me a far better understanding of the Linux boot process.

If it will prove helpful I have a backup of the state of /boot/grub/ and /boot/grub2/ as of installing Qubes.

Since researching, I've learned that sharing an unencrypted boot is probably not the best solution to my problem, so if I can migrate boot for each distro into the encrypted partitions while fixing this, that's a bonus.

As far as my level of experience/how much guidance I need, I'm not particularly well versed in this corner of linux, but coming from Mac I'm fairly well versed in unix terminal world and I've done a fair bit in linux server terminals too but never needed to touch grub or the boot process.

*(It names the Qubes menu item Kali w. Xen Hypervisor, and refuses to boot either distro, hanging at "Found Target Volumes" after entering the luks passphrase for either. It also asks for the luks passphrase before opening grub, which under the Qubes and Kali alone boot screen it does not.)

Answer 1

I will be including several links on how to fix grub, setting up multiboot for Qubes, a guide specifically how to install Qubes OS along side another OS, as well a guide on how to create a VM template for Qubes. I suggest you read through everything before taking action.

Issue at Hand

If I am right your goal is to have a multi boot set-up of Kali Linux and Qubes OS with whole disk encryption. The issue you are having is from there being 2 different kinds of GRUB being installed and thus you are unable to boot. We need to correct that issue. You are right in that according to the official Qubes OS documentation that sharing an unencrypted /boot is not recommended.

I believe that your issue can be solved by doing 1 of 2 things.

1. Start from Scratch, and set up the dual boot.
2. Create Kali Virtual Machine for Qubes OS.

1. Starting from Scratch

It will be easiest to give you a guide on how to set this up from scratch. As far as I know you will have to share the /boot but if you want complete whole disk encryption the best advice I can give is to use two separate disks. This will also be easiest as you simply install the operating system on one, and the other on the other one and you can simply have grub reference the other drive as well. Or if that does not work out switching which drive you boot to is trivial from the BIOS.

If you must share a drive between the two operating systems you can follow this guide.

Install Kali First

Make sure you have the latest .iso from Kali.org. Verify the checksum and write it to your flash drive like normal. During the install process however you will be taking some different steps.

• Complete the install process as normal until you reach the partitioning disk section. Select the manual option and create a /boot partition as shown below:

• Next you will need to create the partition Kali will use. This you then encrypt by selecting the 'Configure encrypted volumes' option. At this point you should have three partitions: a /boot, a partition to be encrypted and install Kali to, and the majority of the disk left for Qubes OS.

• Select the partition you will be using as your partition for Kali Linux.

• Complete the process to configure an encrypted volume and partition your / partition. Write changes to the disk and ignore the warning about not having a swap partition. Sharing swap is just as much of a risk. You could split your encrypted volume between / and a swap but I am under the assumption that you have plenty of RAM sense you want to use Qubes OS.

• Continue as normal until it asks you to install GRUB. Do not install GRUB to the master boot record and instead install it to the /boot at /dev/sda1 instead of /dev/sda.

• Now you have completed the the installation of Kali Linux. You will not be able to boot at this time. We will install Qubes OS first before we can fix this.

Install Qubes OS

I am referring to this guide for this part of the install process.

• Remove your Kali Linux USB drive and insert your Qubes OS Drive.

• Choose Install Qubes. Click “Installation Destination” and confirm that your hard drive is selected. Then click Done.

• As long as it offers to install Qubes in the disk’s free space, the Qubes installer will handle the rest of the partitioning. Choose “Automatically configure my Qubes installation to the disk(s) I selected and return me to the main menu”, and make sure “Encrypt my data” is checked as well. Click Continue.

• Type your Qubes disk encryption passphrase twice, and click Save Passphrase.

• Then click Begin Installation, and wait for Qubes to install. When it’s done, reboot.

Fix GRUB to Allow Dual Boot

Continuing using the guide I previously mentioned, we can can follow these steps to allow for being able to multi-boot.

You’re not done quite yet. When you turn on your computer this time, it will automatically boot into Qubes. Now we need to add Kali as a boot option.

When you boot into Qubes for the first time you’ll need to follow the setup wizard. Once this is done and you’ve logged in to Qubes, open a terminal in dom0 (in KDE, click the start button, System Tools > Konsole). Then edit /etc/grub.d/40_custom using vim (or nano):

sudo vim /etc/grub.d/40_custom

Add this to the bottom:

menuentry "Kali" {
set root=(hd0,1)
chainloader +1
}

Then reinstall grub:

sudo grub2-mkconfig -o /boot/grub2/grub.cfg
sudo grub2-install /dev/sda

Then reboot the computer.

After all of this you should be presented with a GRUB menu with these options:

• Qubes, with Xen hypervisor
• Advanced options for Qubes (with Xen hypervisor)
• Kali

When you boot to Qubes it will ask for your Qubes encryption password and when you boot to Kali it will ask for your Kali encryption password.

2. Create Kali VM Template for Qubes OS

This is an alternative option. You can install Qubes OS on your disk, use whole disk encryption, and after you boot into Qubes OS you can create a new template VM that is based on Kali Linux and use Kali in a VM that way. This guide is a good source of information on how to do this. It refers to Arch Linux but in the final steps instead of setting things up for Arch you use Kali.

Do not forget to reference the Qubes OS documentation to learn more about Qubes OS Virtualization.

However this solution comes with the issue of running Kali as a virtual machine and is not what you asking for help in.

Conclusion

If you made it this far, thank you for sticking around. Please do not hesitate to ask me for any clarification and if there is anything I got wrong I would appreciate corrections.

Sharing an unencrypted boot is a risk but if you keep physical security over your computer and take precautions you should be good. Security needs to be done in layers. Encryption can protect you but if you run compromised software there is no guarantees.

Best of Luck!

Answer 2

Kemotep's answer is a great place to start if you're looking to set up the same install. In the end, to fix my install it was as simple as copying the menu items from the qubes grub2 config to the kali grub config after reinstalling grub 1 to the MBR. I assume it would work the other way around.

Qubes must be using a legacy compatible grub because the drive numbering started from 0.

I'm marking kemotep's answer as accepted because it's more helpful, but if you're running into the same problem I was it might be more simple if you're willing to monkey around in grub for a bit.