Arch Linux

Laetansky

Member

Registered: 2020-04-04

Posts: 5

[SOLVED] Does chainloader not work with LUKS encrypted paritions?

Hello. I have some issues with grub and LUKS. Now my disk partition is:

/sdb5 - EF00 /boot/efi
/sdb6 - LUKS1 /boot
/sdb7 - LUKS2 /

It is full encrypted disk with separated EFI on /sdb5. I copied Windows Boot Loader files to the /boot directory, is it a LUKS container that decrypt by GRUB.
I enter in the GRUB's console and set root to the encryption container. But execution chainloader /win/Microsoft/Boot/bootmgfw.efi falls with error error: not a valid root device.
If i move windows loader's files to the separated not encrypted partition it works fine and starts windows. I looked into the code of that command and linux command that loads linux kernel and initrd,
the second one loads images from a encrypted partition but these commands are different in the code. Is it possible to load windows loader from encrypted partition and stay only grub loader non-encrypted?

Thanks.

Last edited by Laetansky (2020-04-13 13:47:18)

ua4000

Member

Registered: 2015-10-14

Posts: 565

Re: [SOLVED] Does chainloader not work with LUKS encrypted paritions?

after /boot decrytion go into grub shell and examine if the path /win/Microsoft/Boot/bootmgfw.efi is valid.
I think it's not, it's more likely to be something like (crypto0)/...

Also it would useful to have your full /boot/grub/grub.cfg posted here.

Edit: I think you might get windows problems someday, beause windows can't see bootmgfw.efi, and can't update it.

Last edited by ua4000 (2020-04-07 17:40:52)

Laetansky

Member

Registered: 2020-04-04

Posts: 5

Re: [SOLVED] Does chainloader not work with LUKS encrypted paritions?

Here is how it looks:

http://prnt.sc/ruwc99
http://prnt.sc/ruwc99
http://prnt.sc/ruwdt4
http://prnt.sc/ruwe8z

Is it safe to keep a windows loader open? There is a lot of dlls and efi files in it, and it can be used for attack.

ua4000

Member

Registered: 2015-10-14

Posts: 565

Re: [SOLVED] Does chainloader not work with LUKS encrypted paritions?

Also it would useful to have your full /boot/grub/grub.cfg posted here.

here is a lot of dlls and efi files in it

That could be the root cause of the problem and a question to Microsoft: Are those files required for boot - or only optional ?
If required: grub loads only the bootmgfw.efi and starts it, so if the running bootmgfw.efi need any of the other files there - they cannot be found - windows can't read luks1 for sure.

Laetansky

Member

Registered: 2020-04-04

Posts: 5

Re: [SOLVED] Does chainloader not work with LUKS encrypted paritions?

I want to encrypt every file, include bootmgfw.efi. Seems like grub’s chainloader does not see luks1 container.

Laetansky

Member

Registered: 2020-04-04

Posts: 5

Re: [SOLVED] Does chainloader not work with LUKS encrypted paritions?

Also it would useful to have your full /boot/grub/grub.cfg posted here.

here is a lot of dlls and efi files in it

That could be the root cause of the problem and a question to Microsoft: Are those files required for boot - or only optional ?
If required: grub loads only the bootmgfw.efi and starts it, so if the running bootmgfw.efi need any of the other files there - they cannot be found - windows can't read luks1 for sure.

That makes sense. Even if i load bootmgfw.efi, will it find all files in the luks1 container? That files are required and loader does not works without them.

ua4000

Member

Registered: 2015-10-14

Posts: 565

Re: [SOLVED] Does chainloader not work with LUKS encrypted paritions?

Even if i load bootmgfw.efi, will it find all files in the luks1 container? That files are required and loader does not works without them.

Try it out!
Copy only bootmgfw.efi to an unencrypted folder and try to chainload it - according to out theory win boot fails.
Then verify it will boot fine, if you add the other files in this unencryptet folder - that will hopefully work.
Now you have your answer :-)

If your question is solved, please edit your 1st post, and place a [SOLVED] in front of the Subject.

Laetansky

Member

Registered: 2020-04-04

Posts: 5

Re: [SOLVED] Does chainloader not work with LUKS encrypted paritions?

I came to the conclusion.

If you copy windows loader's files to the another ESP it won't boot for some reason. Possibly windows interact with partitions and you can not just change it.
Also, EFI loaders requires all files which contain in a /EFI/Microsoft folder, they will not work without ddls and others files.
Grub's chainloader does not work with encrypted partitions.