I'd like to setup Arch Linux with encryption. I found the tutorial on the Arch wiki, and think that the second option (LVM on LUKS) is the best option for me. Here's the partitioning I'd like to use (Thinkpad X1 Carbon, ~ 500 GB SSD, 16 GB RAM):

  1. [alignment gap] 1 MB
  2. /boot 256 MB (FAT 32)
  3. swap 16 GB (size of memory)
  4. / (root) 64 GB (ext4)
  5. /var 8 GB (ext4)
  6. /tmp 4 GB (ext4)
  7. /home ~400 GB (ext4, remainder)

The disk has the name nvme0n1. After booting the installer (September 2020 release) and connecting to the WiFi, I overwrite the disk with random data:

# shred --random-source=/dev/urandom --iterations=3 /dev/nvme0n1

Then I setup a new GPT partition schema:

# parted -s /dev/nvme0n1 mklabel gpt

Next, I create and format a boot partition with a 1 MB alignment gap in front of it.

# parted -s /dev/nvme0n1 mkpart boot fat32 1MiB 257MiB
# parted -s /dev/nvme0n1 set 1 esp on
# mkfs.fat -F 32 /dev/nvme0n1p1

Now comes the part, where the wiki is unclear. (It only mentions that it's possible to have /boot on a different device, which I don't.) I decided to make another partition, on top of which my encrypted volume will be located:

# parted -s /dev/nvme0n1 mkpart cryptlvm 257MiB '100%'

This creates a second partition /dev/nvme0n1p2 with the remainder disk size. (Maybe this step causes the problem.) I continue to setup the encryption:

# cryptsetup luksFormat /dev/nvme0n1p2     # YES, entering passphrase  twice
# cryptsetup open /dev/nvme0n1p2 cryptlvm  # entering passphrase
# pvcreate /dev/mapper/cryptlvm
# vgcreate VolumeGroup /dev/mapper/cryptlvm

Then I create the partitions as described above:

# lvcreate -L 16G VolumeGroup -n swap
# lvcreate -L 64G VolumeGroup -n root
# lvcreate -L 8G VolumeGroup -n var
# lvcreate -L 4G VolumeGroup -n tmp
# lvcreate -l '100%FREE' VolumeGroup -n home

The partitions are now being formatted:

# mkswap /dev/VolumeGroup/swap
# mkfs.ext4 -F /dev/VolumeGroup/root
# mkfs.ext4 -F /dev/VolumeGroup/var
# mkfs.ext4 -F /dev/VolumeGroup/tmp
# mkfs.ext4 -F /dev/VolumeGroup/home

And mounted:

# mount /dev/VolumeGroup/root /mnt

# mkdir /mnt/boot
# mount /dev/nvme0n1p1 /mnt/boot

# mkdir /mnt/var
mount /dev/VolumeGroup/var /mnt/var

# mkdir /mnt/tmp
mount /dev/VolumeGroup/tmp /mnt/tmp

# mkdir /mnt/home
mount /dev/VolumeGroup/home /mnt/home

The system can now be bootstrapped together with lvm2:

# pacstrap /mnt base liux linux-firmware lvm2

I also create and store the fstab:

# genfstab -U /mnt >> /mnt/etc/fstab

I chroot into the bootstrapped system:

# arch-chroot /mnt

As mentioned in the wiki, I add the hooks encrypt and lvm2 in /etc/mkinitcpio.conf:

HOOKS=(base udev autodetect keyboard keymap consolefont modconf block filesystems fsck encrypt lvm2)

I continue with the usual setup tasks (setup root password, install base packages, set timezone, locale, language, hostname):

# passwd
# pacman -S iw wpa_supplicant dialog intel-ucode netctl dhcpcd
# ln -sf /usr/share/zoneinfo/Europe/Zurich /etc/localtime
# timedatectl set-ntp true
# hwclock --systohc
# echo 'en_US.UTF-8 UTF-8' >> /etc/locale.gen
# locale-gen
# echo 'LANG=en_US.UTF-8' > /etc/locale.conf
# echo -n 'x1' > /etc/hostname

Now comes the bootloader. Here I traditionally use the systemd bootloader instead of grub. Here's how I set it up:

# systemd-machine-id-setup
# bootctl --path=/boot install

I figure out the UUID (not PARTUUID) of the root partition as follows:

# blkid | grep /dev/VolumeGroup/root | egrep -o 'UUID="[^"]!"'

Then I create the boot entry in /boot/loader/entries/arch.conf:

title   Arch Linux
linux   /vmlinuz-linux
initrd  /initramfs-linux.img
options cryptdevice=UUID=6d5b4777-2621-4bec-8bbc-ebd4b5ba9faf:cryptlvm root/dev/VolumeGroup/root

And an accordng /boot/loader/loader.conf:

default arch
timeout 0
editor  0

Last but not least, I run mkinitcpio, before leaving for a fresh boot:

# mkinitcpio -P
# exit
# umount -R /mnt
# shutdown -h now

So that was my setup procedure. I remove the USB dongle and boot the system. The bootloader shows up, but then I get the following screen:

:: running early hook [udev]
Starting version 246.6-1-arch
:: running early hook [lvm2]
:: running hook [udev]
:: Triggering uevents...
:: running hook [encrypt]
Waiting 10 seconds for device /dev/disk/by-uuid/6d5b4777-2621-4bec-8bbc-ebd4b5ba9faf ...
Waiting 10 seconds for device /dev/VolumeGroup/root ...
ERROR: device '/dev/VolumeGroup/root' not found. Skippng fsck.
:: mounting '/dev/VolumeGroup/root' on real root
mount: /new_root: no filesystem type specified.
You are now being dropped into an emergency shell.

Now I'm pretty clueless what I've done wrong. One suspicion is the second partition (/dev/nvme0n1p2) that I needed to create. Another suspicion is that I did something wrong with the bootloader. On regular setups, I always use the PARTUUID instead of the UUID. (However, there's no PARTUUID in the output of blikd, so this probably isn't the issue.)

  • 2
    wrong UUID, you specified the rootfs UUID for cryptdevice but it needs the LUKS UUID – frostschutz Sep 25 '20 at 19:37
  • 1
    Allow me a comment unrelated to your actual question: I suppose you have good reasons to have separate partitions for /var and others. From experience I find your /var volume awfully small. I have had to repartition mine on a box very similar to yours to increase over the years from 12GB to 48GB. I repeatedly found myself limited because I tend to use it as an ad-hoc scratch pad when I deal with massive data files. Just a heads up. Of course your mileage will vary depending on your use-case. ;-) Post with great style btw. – Cbhihe Sep 25 '20 at 19:55
  • @frostschutz Do you mean the one of /dev/mapper/cryptlvm or /dev/nvme0n1p2? EDIT: /de/nvme0n1p2 is it! Many thanks, I was able to boot my system! – Patrick Bucher Sep 25 '20 at 19:59
  • 1
    @frostschutz: can you make an answer out of your comment, so the post can be made whole ? – Cbhihe Sep 25 '20 at 21:15
  • 1
    One more comment on the size of storage volumes: leaving some free space in your VG (instead of creating an LV using 100%FREE) allows you to grow an LV when needed, simply typing lvresize LV -L new_size -r PV, automatically resizing the contained file system too, even if mounted (while shrinking requires unmounting). The (possible) fragmentation resulting from several lvresize would hardly be a relevant issue when using flash memory. – fra-san Sep 26 '20 at 13:36

Since @frostschutz hasn't written his correct solution to the problem as an answer yet, I'll summarize the issue here quickly: I picked the UUID of the wrong partition. The root partition under /dev/VolumeGroup/root is not the one to be chosen, but the actual partition /dev/nvme0n1p2. Here's how to extract that UUID:

# uuid=$(blkid --match-tag UUID -o value /dev/nvme0n1p2)

Which then can be used in the boot loader entry config:

# cat <<EOF >/boot/loader/entries/arch.conf
title   Arch Linux
linux   /vmlinuz-linux
initrd  /initramfs-linux.img
options cryptdevice=UUID=${uuid}:cryptlvm root=/dev/volgrp/root

I summarized the whole procedure on my private website. Thanks also to @Cbhihe for the advice on partition sizes.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.