You are not logged in.
Encrypting_an_entire_system#Encrypted_boot_partition_(GRUB) /boot following that setup would be a normal directory on / .
It could also be a seperate filesystem within the lvm. Your layout has it as a separate luks volume outside the lvm.
cryptlvm is being opened by either the encrypt hook or the sd-encrypt hook. If it is the sd-encrypt hook it could open cryptboot as well otherwise add an entry for cryptboot to crypttab.
Offline
Encrypting_an_entire_system#Encrypted_boot_partition_(GRUB) /boot following that setup would be a normal directory on / .
It could also be a seperate filesystem within the lvm. Your layout has it as a separate luks volume outside the lvm.
cryptlvm is being opened by either the encrypt hook or the sd-encrypt hook. If it is the sd-encrypt hook it could open cryptboot as well otherwise add an entry for cryptboot to crypttab.
I changed the hook from encrypt to sd-encrypt but the kernel fails the dependency for /root and swap and I am dropped in emergency shell. But sd-encrypt should unlock the lvm container for fstab entries to be read.
Offline
Did you change the boot options to match the change from encrypt to sd-encrypt? Encrypting_an_entire_system#Configuring_GRUB_2
Offline
Did you change the boot options to match the change from encrypt to sd-encrypt? Encrypting_an_entire_system#Configuring_GRUB_2
Yes. This is how my hooks look like
HOOKS=(base systemd autodetect keyboard sd-vconsole modconf block sd-encrypt sd-lvm2 filesystems fsck)followed by mkninitcpio -p linux.
Edit: Ok, I didn't made that.
Last edited by arifcatalyst (2019-01-25 23:50:16)
Offline
Did you also change /etc/default/grub ?
Offline
Here are the changes -
GRUB_CMDLINE_LINUX="rd.luks.name=295d538a-4368-4691-b2db-d1b08aa97020=cryptlvm"And changed the hook from encrypt to sd-encrypt.
Offline
Did you also change /etc/default/grub ?
Ok, it does boot now but still the /boot isn't mounted. It still is encrypted. Do I need to make an entry in crypttab ?
Offline
If the intent is to eventually use cryptboot that would appear to normally have /boot and /boot/efi unmounted but the script checks /etc/crypttab for entry for cryptboot .
If you want both cryptlvm and cryptboot both unlocked you can add another command line option for cryptboot or a crypttab entry.
If you want /boot and /boot/efi mounted on boot then you would need to revert the changes to fstab that disable auto mounting.
Last edited by loqs (2019-01-26 00:10:38)
Offline
If the intent is to eventually use cryptboot that would appear to normally have /boot and /boot/efi unmounted but the script checks /etc/crypttab for entry for cryptboot .
If you want both cryptlvm and cryptboot both unlocked you can add another command line option for cryptboot or a crypttab entry.
If you want /boot and /boot/efi mounted on boot then you would need to revert the changes to fstab that disable auto mounting.
Yes, I intent to use cryptboot for Secure Boot. What changes do I need to make ? And, in the wiki, it says that
You can use cryptboot script from cryptbootAUR package for simplified encrypted boot management (mounting, unmounting, upgrading packages) and as a defense against Evil Maid attacks with UEFI Secure Boot. For more information and limitations see cryptboot project page.
Will it handle mounting and unmounting automatically ?
Offline
Create a crypttab entry for cryptboot in the options (the fourth field) specify noauto so the volume will not be unlocked on boot.
That should then allow the cryptboot script to open and mount /boot and mount /boot/efi when performing system updates then unmount and close afterwards.
On normal operation /boot will be empty.
Offline
Create a crypttab entry for cryptboot in the options (the fourth field) specify noauto so the volume will not be unlocked on boot.
That should then allow the cryptboot script to open and mount /boot and mount /boot/efi when performing system updates then unmount and close afterwards.
On normal operation /boot will be empty.
Having mounted /boot is a security risk ? I always had mounted boot whether encrypted or unencrypted.
Offline
I am not suggesting it is or is not a security risk just providing instructions so that your system is configured as cryptboot expects.
Edit:
cryptboot upgradeFrom my inspection would unmount / close /boot /boot/efi if they were mounted.
Last edited by loqs (2019-01-26 00:54:10)
Offline