2

This is more of a educational and curiosity question, rather than tying to fix a problem. I have an Ubuntu system using LUKS. lsblk shows this:

Noteably, / is encrypted but /boot and /boot/efi are not. This is important because LUKS needs /boot to be unencrypted in order to boot GRUB.

But... / contains /boot. So it seems that if / is encrypted, that would force /boot to be too. After all, how would you know where on disk /boot starts, since /'s pointer to /boot is encrypted? (i assume)

Thank you!

1 Answer 1

5

The devices (partitions) that / and /boot reside on are different, and one can be encrypted while the other is not.  GRUB knows how to find /boot by using something like set root=(hd0,1) or search --hint=... as defined in grub.cfg.

Since GRUB can handle booting into multiple OS's installed simultaneously, the / file system (or C:) cannot be used to locate /boot unambiguously.

4
  • I see, thank you! Do you know anywhere I could read up on how the devices that these two directories reside on might be different? I think it's interesting that a directory's direct child might be on a different device. Commented May 23 at 17:54
  • 1
    /boot can be encrypted too at least in Debian, I successfully tried it. Commented May 23 at 18:16
  • @SuperDialga Using multiple devices has been around for decades. Perhaps wikipedia would be a good start?
    – doneal24
    Commented May 23 at 18:19
  • @schrodingerscatcuriosity You still can't encrypt /boot/efi but enabling secure boot (if possible with your distribution) will make it reasonably safe.
    – doneal24
    Commented May 23 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .