Currently my setup is:

  • cryptsetup
    • lvm
      • root
      • home
      • swap

I would like to achieve something like

  • cryptsetup
    • lvm
      • root
      • home
  • swap (one-time key)

The steps i am thinking of are:

  1. remove swap (can do)
  2. shrink LVM itself (cannot do)
  3. create swap with one-time key (somewhat can do)

However, i am thinking, is there a way to just "move" a partition outside of LVM? I am sure that it is on a single drive and has never been resized, so it should be contiguous.


What you have inside the LVM are LVM logical volumes, not partitions. Logical volumes (LVs for short) cannot exist outside LVM volume groups.

Transforming a LV into a partition without moving the data would require deleting the LV configuration and reducing the LVM PV size without overwriting the data blocks of the former LV, and finally adjusting the partition table to 1) reduce the size of the partition containing the LVM PV, and to 2) define a new partition around the data blocks of the former LV. Without encryption, it would be technically doable, although I don't think there is a tool for it, so careful use of individual commands would be required.

But since you are moving the contents of the LV from inside a cryptsetup container to outside it (and into another cryptsetup container), the process outlined above makes no sense: if accessed without the master key of the original cryptsetup container, the actual disk blocks will be useless encrypted gibberish.

But since you're moving a swap partition, migrating the data is not necessary.

The steps you actually need to do are:

  1. remove swap (disable swap with swapoff, remove swap LV with lvremove, remove reference to it from /etc/fstab)
  2. shrink LVM PV with pvresize <PV device> --setphysicalvolumesize <new-size>. If this does not complete without errors, do not go any further without fixing the problem first.
  3. shrink the cryptsetup container with cryptsetup --size <new-size> resize <PV device>. Be very sure you don't shrink this container more than you shrunk the LVM PV - you don't want to violently cut off the tail end of an active PV.
  4. edit the partition table to shrink the partition containing the cryptsetup container. Be very sure you don't shrink the partition more than you shrunk the cryptsetup container. You may have to run partprobe /dev/sda or reboot at this point to make the changes fully effective.
  5. edit the partition table to create a new partition for the second cryptsetup container
  6. create a script or other configuration that will initialize the second cryptsetup container with a random key and run mkswap on it on every boot. Your Linux distribution may already have some facilities to make this easier. Make sure this works as intended.
  7. Add a reference to the new encrypted swap partition to /etc/fstab.
  8. Run swapon -a or reboot to verify it all works as intended.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.