Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
i am trying to do arch(or any distro)-install with encrypted boot partition(lvm - uefi) during installation. i am trying really hard to get it to working but i get this error in picture below. i searched a lot but i didn't get anywhere i believe it is possible because of this option (GRUB_ENABLE_CRYPTODISK=1) in grub config
Inside arch-chroot /mnt << EFI Partition is FAT 32 Rest is EXT4>>
grub-install is expecting to find /boot, but cannot, because according to your lsblk, it's at /mnt/boot... so you aren't chrooted into the new installation at this time.
But I agree with Sheldon: having the EFI System Partition (ESP for short) inside a Linux encrypted partition won't work.
The UEFI firmware wants to find a readable FAT partition (optimally FAT32, but newer UEFI releases accept other forms of FAT too) which satisfies one of the following conditions:
efibootmgr) and the partition contains the boot file whose pathname is specified in that NVRAM variable (e.g. \EFI\Arch\grubx64.efi or \EFI\Arch\shimx64.efi if using the Secure Boot compatibility shim)\EFI\BOOT\BOOTx64.efi (= removable media/fallback boot path)With your current configuration, the firmware will see the sda1 partition, but since its contents are apparently random nonsense (because encrypted) the firmware won't be able to proceed with the boot at all. Unless your UEFI firmware includes support for the exact disk encryption scheme you're planning to use, the ESP partition must remain unencrypted: normally the UEFI firmware cannot boot from an encrypted ESP partition. This should not be a major problem in practice, as ESP should contain standard bootloader components only. If Secure Boot is in effect, the firmware will check the validity of the bootloader's cryptographic signature.
If the UEFI firmware implementation allows you to change the Secure Boot keys, you could replace the factory default keys with keys you've generated yourself, and then the system would accept only bootloaders signed by your key.
ArchWiki has this example configuration for full-disk encryption with UEFI boot.
+---------------------+----------------------+----------------------+----------------------+----------------------+
| BIOS boot partition | EFI system partition | Logical volume 1 | Logical volume 2 | Logical volume 3 |
| | | | | |
| | /efi | / | [SWAP] | /home |
| | | | | |
| | | /dev/MyVolGroup/root | /dev/MyVolGroup/swap | /dev/MyVolGroup/home |
| /dev/sda1 | /dev/sda2 |----------------------+----------------------+----------------------+
| unencrypted | unencrypted | /dev/sda3 encrypted using LVM on LUKS1 |
+---------------------+----------------------+--------------------------------------------------------------------+
It also includes the BIOS boot partition for maximum compatibility, but if you plan to boot in UEFI native style only, you can omit the BIOS boot partition and all steps related to it. In this layout, ESP is mounted as /efi in the resulting installation (and it would be /mnt/efi in the situation of your screenshot, if it existed there) and /boot is not a separate filesystem, but just an ordinary directory within the root filesystem.
I'm pretty sure that the ESP must be a simple (FAT-formatted) partition, not wrapped by LVM. While you can encrypt your boot partition, an encrypted ESP inside LVM is not gonna fly.
i am trying to do arch(or any distro)-install with encrypted boot partition(lvm - uefi)
The arch documentation covers a lot. This is good, but can also be confusing because there are multiple different scenarios described. It might be easier if you try Ubuntu, their howto includes an encrypted '/boot/' and is less complex.
