Arch Linux

qqmkk

Member

Registered: 2017-05-05

Posts: 1

Dual Boot Windows and Encrypted Arch

Hello,

Wasted 5 hours, but can't understand how to solve the problem.
I have:
/dev/sda2 - EFI partition, all linux files are deleted, only windows stuff remain. Windows is bootable, no problems here.
/dev/sda4 - Windows C:\ partition
/dev/sda5 - installed, configured and encrypted arch linux

The question is - how to install grub to /dev/sda2, so that arch become bootable.

I chroot to installed arch, mount /dev/sda2, grub-install to EFI partition, no problems here, installation finished, arch entry added to UEFI.
But when i try to boot arch - all i got is grub loader. Looks like it can't see installation and i don't understand why.

I tried to add GRUB_ENABLE_CRYPTODISK=y  to /etc/default/grub before grub-install with no success.

Am i understand this correctly: generated grubx64.efi should point to /dev/sda5 and load some decrypting modules?

tom.ty89

Member

Registered: 2012-11-15

Posts: 897

Re: Dual Boot Windows and Encrypted Arch

For grub to know which encrypted partition to open and load kernels from, grub modules and grub.cfg needs to be unencrypted, which can be done by:

specify --boot-directory $esp_mountpoint in addition to --efi-directory $esp_mountpoint when grub-install; this way the grub directory that by default goes under /boot would now goes under the tree of the ESP, while the kernels and initramfs stays in the encrypted partition.

I am not sure if grub-mkconfig work well with this since I write grub.cfg from scratch. At least the value for the -o switch would now need to be $esp_mountpoint/grub/grub.cfg. Note that you now have a EFI/grub and a grub under $esp_mountpoint/. The latter is where to put the grub.cfg.

Note that grub supports only LUKS but not plain encryption, AFAIK.That said, if you have yet another encrypted partition for /boot, only that needs to be LUKS-encrypted; while the root/OS partition can be plain-encrypted, since it's opened by the encrypt hook in the initramfs.

You will want to include the paraphrase as a key file in the initramfs so you don't need to enter it again when the init script mount the real root. (Yeah that's needed even when it's the same encrypted partition grub opened)

You can also _instead_ have unencrypted /boot; in this case the simplest way is to use the ESP for /boot. You don't even use grub to open the encrypted partition in this case, but only the encrypt hook in the initramfs)

Last edited by tom.ty89 (2017-05-07 07:38:49)

tom.ty89

Member

Registered: 2012-11-15

Posts: 897

Re: Dual Boot Windows and Encrypted Arch

Sorry I made a wrong point, it is actually possible to have the grub directory encrypted, which is done via:

GRUB_ENABLE_CRYPTODISK=y

as you mentioned, which should make grub-install embed its luks module and so in the efi executable and make it run cryptomount automatically.

So my best bet is that sda5 has plain encryption (which is not supported) instead of LUKS. Does grub-install warn about encrypted disk when you comment out GRUB_ENABLE_CRYPTODISK=y in /etc/default/grub btw?

You can also try grub-install again outside chroot with the Arch ISO:

cryptsetup open /dev/sda5 root
mount /dev/mapper/root /mnt
mount /dev/sda2 /mnt/mnt
grub-install --efi-directory /mnt/mnt --boot-directory /mnt/boot
umount /mnt/mnt
umount /mnt

Note that you still edit /etc/default/grub in this case, not /mnt/etc/default/grub, since you are using the grub-install in the Arch ISO, not the one in your new installation.

Last edited by tom.ty89 (2017-05-07 08:06:46)