1

i am trying to do arch(or any distro)-install with encrypted boot partition(lvm - uefi) during installation i am trying really hard to get it to working but i get this error i searched a lot but i didn't get anywhere i believe it is possible because of this option (GRUB_ENABLE_CRYPTODISK=1) in grub config

Inside arch-chroot /mnt

Inside arch-chroot /mnt << EFI is FAT 32 Rest is EXT4>>

New contributor
Hoodad Tabibi is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

2 Answers 2

2

grub-install is expecting to find /boot, but cannot, because according to your lsblk, it's at /mnt/boot... so you aren't chrooted into the new installation at this time.

But I agree with Sheldon: having the EFI System Partition (ESP for short) inside a Linux encrypted partition won't work.

The UEFI firmware wants to find a readable FAT partition (optimally FAT32, but newer UEFI releases accept other forms of FAT too) which satisfies one of the following conditions:

  • either its PARTUUID matches the value written into the UEFI boot NVRAM variable (accessible in Linux using efibootmgr) and the partition contains the boot file whose pathname is specified in that NVRAM variable (e.g. \EFI\Arch\grubx64.efi or \EFI\Arch\shimx64.efi if using the Secure Boot compatibility shim)
  • or the partition contains a file whose pathname can be expressed in Windows-style as \EFI\BOOT\BOOTx64.efi (= removable media/fallback boot path)

With your current configuration, the firmware will see the sda1 partition, but since its contents are apparently random nonsense (because encrypted) the firmware won't be able to proceed with the boot at all. Unless your UEFI firmware includes support for the exact disk encryption scheme you're planning to use, the ESP partition must remain unencrypted: normally the UEFI firmware cannot boot from an encrypted ESP partition. This should not be a major problem in practice, as ESP should contain standard bootloader components only. If Secure Boot is in effect, the firmware will check the validity of the bootloader's cryptographic signature.

If the UEFI firmware implementation allows you to change the Secure Boot keys, you could replace the factory default keys with keys you've generated yourself, and then the system would accept only bootloaders signed by your key.

ArchWiki has this example configuration for full-disk encryption with UEFI boot.

+---------------------+----------------------+----------------------+----------------------+----------------------+
| BIOS boot partition | EFI system partition | Logical volume 1     | Logical volume 2     | Logical volume 3     |
|                     |                      |                      |                      |                      |
|                     | /efi                 | /                    | [SWAP]               | /home                |
|                     |                      |                      |                      |                      |
|                     |                      | /dev/MyVolGroup/root | /dev/MyVolGroup/swap | /dev/MyVolGroup/home |
| /dev/sda1           | /dev/sda2            |----------------------+----------------------+----------------------+
| unencrypted         | unencrypted          | /dev/sda3 encrypted using LVM on LUKS1                             |
+---------------------+----------------------+--------------------------------------------------------------------+

It also includes the BIOS boot partition for maximum compatibility, but if you plan to boot in UEFI native style only, you can omit the BIOS boot partition and all steps related to it. In this layout, ESP is mounted as /efi in the resulting installation (and it would be /mnt/efi in the situation of your screenshot, if it existed there) and /boot is not a separate filesystem, but just an ordinary directory within the root filesystem.

1
  • well i was hoping for a solution but apparently it's not possible to have true full-disk encryption the only way for me was to encrypted boot partition and install efi in another non-encrypted partition May 15 at 11:59
0

I'm pretty sure that the ESP must be a simple (FAT-formatted) partition, not wrapped by LVM. While you can encrypt your boot partition, an encrypted ESP inside LVM is not gonna fly.

i am trying to do arch(or any distro)-install with encrypted boot partition(lvm - uefi)

The arch documentation covers a lot. This is good, but can also be confusing because there are multiple different scenarios described. It might be easier if you try Ubuntu, their howto includes an encrypted '/boot/' and is less complex.

1
  • well i was hoping for a solution but apparently it's not possible to have true full-disk encryption the only way for me was to encrypted boot partition and install efi in another non-encrypted partition May 15 at 11:59

Your Answer

Hoodad Tabibi is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.