Arch Linux

luanpotter

Member

Registered: 2019-04-14

Posts: 9

Website

[SOLVED] Fresh install with root LUKS encryption, but GRUB fails

I installed Arch many times before, but this time I got into a lot of trouble. I'm posting because I'm really sad and I tried everything I saw everywhere that made sense, basically, to no avail. But maybe the gods here could help me out a bit.

What I wanted: fresh install on my Dell Inspiron, wiped the 120GB SSD clean because Windows was taking up my precious space (I had it dual-boot before). As per company policy, now I have to have root encryption, so I read all about in wiki and other places.

Decided to create two partitions, /boot (non-encrypted), added 4gb or so for good measure and / (root) with the rest. I don't like to have more partitions because they tend to run out of space. Great. I encrypted root using cryptsetup and it works, I can cryptsetup open and such. In fact, everything works, I'm booted with chroot right now and running x and firefox as root user. Works fine.

But I can't for my life configure grub.

Here's my lsblk -f config:

sdb
├─sdb1   vfat                    7594-xxxx       3.7G     2% /boot
└─sdb2   crypto_LUKS             dd7axxxx-xx...
  └─root ext4                    5a05xxxx-xx...  104.1G     3% /

Also my /etc/fstab file.

I can mount everything by hand doing:

cryptsetup open /dev/sdb2 cryptroot
> inputs password
mount /dev/mapper/cryptroot /mnt
mount /dev/sdb1 /mnt/boot
arch-chroot /mnt

Works fine. Now for the grub config; what I did (or one version of what I did, because I tried in many, many different ways)(I did this inside arch-chroot with the root user):

1. Added to /etc/mkinitcpio.conf (full file here):

HOOKS=(base udev keyboard keymap autodetect modconf block encrypt filesystems fsck)

(though I tried some other orderings, no avail)

then run:

mkinitcpio -p linux

(full output here)

2. Edited the /etc/default/grub file (full file here):

GRUB_CMDLINE_LINUX="cryptdevice=UUID=dd7axxxx-xx...:cryptroot root=/dev/mapper/cryptroot"
GRUB_ENABLE_CRYPTODISK=y

3. Run grub commands:

rm -rf /boot/EFI
mkdir /boot/EFI

grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=GRUB
grub-mkconfig -o /boot/grub/grub.conf
grub-mkconfig -o /boot/EFI/GRUB/grubx64.efi # not sure why, saw somewhere, didn't work either

output:

> grub-install ...
Installing for x86_64-efi platform.
Installation finished. No error reported.

> grub-mkconfig ... grub.conf
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-linux
Found initrd image: /boot/intel-ucode.img /boot/initramfs-linux.img
Found fallback initrd image(s) in /boot: initramfs-linux-fallback.img
done

> grub-mkconfig ...  grubx64.efi
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-linux
Found initrd image: /boot/intel-ucode.img /boot/initramfs-linux.img
Found fallback initrd image(s) in /boot: initramfs-linux-fallback.img
done

This is what my boot folder looks like.

Now, what happens? I can boot fine on the usb stick. To boot on the ssd, had to configure the Inspiron's setup screen, enabled UEFI, selected the path to the efi file, everything seem to work because when it doesn't, it boots straight to Dell useless Support Assistant thingy. Got that lots of times. Now it's working because it reaches grub. However, it goes to that grub console terminal, not to my OS. Not the rescue mode either, just grub>. I tried to start from there, because I can see my fat32 boot partition with ls, but the commands I saw (set prefix, root, insmod, initrd) did nothing (no error, but no results).

So, I'm stuck. Does anyone have a light to shed upon me? I'd be really grateful!

Last edited by luanpotter (2019-04-14 13:10:38)

JeanLucJ

Member

Registered: 2019-03-08

Posts: 59

Re: [SOLVED] Fresh install with root LUKS encryption, but GRUB fails

Hello,

Thanks for the very detailled explanations.
Can you provide /boot/grub.cfg to see what was generated?

Also, I spotted one inconsistancy.
Hook order is strange.
From the install guide :

A typical /etc/mkinitcpio.conf configuration using encrypt hook:

/etc/mkinitcpio.conf

...
HOOKS=(base udev autodetect keyboard keymap consolefont modconf block encrypt lvm2 filesystems fsck)
...

while yours is :

HOOKS=(base udev keyboard keymap autodetect modconf block encrypt filesystems fsck)

I don't believe it is related, but hook order should have autodetect before keyboard (ignore the hoook you don't use like lvm2)

And last, your /etc/default/grub contains literraly GRUB_CMDLINE_LINUX="cryptdevice=UUID=dd7axxxx-xx...:cryptroot root=/dev/mapper/cryptroot"
I'm not an expert on UUID, but this format seems wrong.
Is it the real file?

Regards,

Last edited by JeanLucJ (2019-04-14 08:02:14)

frostschutz

Member

Registered: 2013-11-15

Posts: 1,658

Re: [SOLVED] Fresh install with root LUKS encryption, but GRUB fails

I don't use EFI myself so I really should not comment,

but should grubx64.efi not be the grub binary?

in your example you have overwritten it with grub.conf

# ls -la boot/EFI/GRUB/
-rwxr-xr-x 1 root root 5226 Apr 14 00:11 grubx64.efi
# ls -la boot/grub/
-rwxr-xr-x 1 root root  5226 Apr 14 00:13 grub.conf

note identical file permission and file size

luanpotter

Member

Registered: 2019-04-14

Posts: 9

Website

Re: [SOLVED] Fresh install with root LUKS encryption, but GRUB fails

Thanks for the quick responses, friends! Sadly I'm still getting the same problem (straight to grub shell). Here are the answers:

1. Can you provide /boot/grub.cfg to see what was generated?
Of course, forgot that! This is the one after the fixes below.
You can see it`s generating the menu entries that I expected to see.
Also, I have not redacted the UUIDs on this file, so you should find them more natural looking.

2. Changed the hooks to the order specified, I had tried some other orders already (including the one of the wiki, both adding and removing the modules consolefont and lvm2 that I think are not needed), and nothing changed. Left exactly as you suggested, just changing the order, and tested again, no avail.

3. No, I redacted the UUIDs to make it easy for you guys to compare the ones from lsblk with the other files. 'dd7axxxx-xx...' here means the UUID of my 'sdb2 crypto_LUKS' partition.
In the actual generated grub.conf file I posted in (1), I left them as is, so that you can see if the actual values have anything weird in them.

4. frostschutz, you are 100% correct, what a nice eye and catch! I'd never have noticed that. The efi should be the binary, and it used to be. It was with my testing of the second grub-mkconfig that I saw somewhere that it got replaced. So I know for a fact that that's wrong now. However I had already tested without it, to no avail. Nonetheless, I run only the first mkconfig, verified the grub.conf is indeed the config file and the efi binary is indeed a binary file, changed the hook order as per (2) and ran again, to no avail. Exactly same problem.

It goes straight to grub shell. No error messages.

Last edited by luanpotter (2019-04-14 11:55:55)

JeanLucJ

Member

Registered: 2019-03-08

Posts: 59

Re: [SOLVED] Fresh install with root LUKS encryption, but GRUB fails

In your grub.cfg, I see :

    linux   /vmlinuz-linux root=UUID=5a0575b3-54b5-4a14-aa3e-c385bfe20442 rw cryptdevice=UUID=dd7ac0fd-3d86-43d6-829f-a74ff60c573b:cryptroot root=/dev/mapper/cryptroot 

There is a problem, root should only be /dev/mapper/cryptroot

Can you try with a custom.cfg in your /boot/grub?

Last edited by JeanLucJ (2019-04-14 12:02:48)

luanpotter

Member

Registered: 2019-04-14

Posts: 9

Website

Re: [SOLVED] Fresh install with root LUKS encryption, but GRUB fails

Hi, JeanLucJ, I have also concluded that that second mkconfig was incorrect, so I stopped doing that altogether. I think that was replacing the binary efi file with a copy of the config file that should reside in /boot/grub/grub.conf. Now install command generates the binary and mkconfig the config file.

About the command:

> efibootmgr -v
BootCurrent: 0002
Timeout: 0 seconds
BootOrder: 0003,0002
Boot0000* G     HD(1,GPT,3eafed6f-d7d9-4100-ac3d-29d362f0f7d6,0x800,0x773000)/File(\EFI\G\grubx64.efi)
Boot0001* GRUB  HD(1,GPT,3eafed6f-d7d9-4100-ac3d-29d362f0f7d6,0x800,0x773000)/File(\EFI\GRUB\grubx64.efi)
Boot0002* USB   PciRoot(0x0)/Pci(0x14,0x0)/USB(13,0)/HD(1,MBR,0x377032cf,0xa4,0x20000)/File(\EFI\boot\bootx64.efi)
Boot0003* SSD   PciRoot(0x0)/Pci(0x17,0x0)/Sata(4,32768,0)/HD(1,GPT,3eafed6f-d7d9-4100-ac3d-29d362f0f7d6,0x800,0x773000)/File(\grub\x86_64-efi\grub.efi)
Boot0004* arch  HD(1,GPT,3eafed6f-d7d9-4100-ac3d-29d362f0f7d6,0x800,0x773000)/File(\EFI\arch\grubx64.efi)

That was run from within the arch-chrooted installation. Weirdly it list past attempts of mine. Just to explain, G and arch where different bootloader-id options in the install. It created like named folders in the EFI directory, but I had deleted them. Actually, G was a typo on my part hehe. It is still listed there, though not mentioned on boot order.

The GRUB entry refers to the current GRUB install, I believe.

The entries USB and SSD I created in my notebook "bios" setup screen. I had to selected the hard drive and the path to the efi binary (I believe), I tried several and also leaving it blank (I think it tries to find it them), to no avail.

JeanLucJ

Member

Registered: 2019-03-08

Posts: 59

Re: [SOLVED] Fresh install with root LUKS encryption, but GRUB fails

OK I'm sorry we are online at the same time and I have the bad habit of editing my messages.

So I post again my previous edit :

In your grub.cfg, I see :

linux   /vmlinuz-linux root=UUID=5a0575b3-54b5-4a14-aa3e-c385bfe20442 rw cryptdevice=UUID=dd7ac0fd-3d86-43d6-829f-a74ff60c573b:cryptroot root=/dev/mapper/cryptroot 

There is a problem, root should only be /dev/mapper/cryptroot

Can you try with a custom.cfg in your /boot/grub?

-> Friends are coming I'm sorry I won't be available for the next couple of hours.

good luck!

frostschutz

Member

Registered: 2013-11-15

Posts: 1,658

Re: [SOLVED] Fresh install with root LUKS encryption, but GRUB fails

well, going to grub shell is good. that means grub itself is there.

that is if it's full grub and not minimal rescue grub?

can you explore the boot partition within the grub shell? ( ls and then tab completion to get (hd something,something)/somepath )

maybe the grub.cfg is in the wrong location? not sure where it's supposed to go with grub efi

load the cfg file (you have found with ls and/or tab completion) with 'configfile (hdx,y)/path/grub.cfg'

Last edited by frostschutz (2019-04-14 12:07:39)

luanpotter

Member

Registered: 2019-04-14

Posts: 9

Website

Re: [SOLVED] Fresh install with root LUKS encryption, but GRUB fails

1. JeanLucJ, indeed there are two root parameters there, but that was not something I added to the /etc/default/grub.conf file! It was added by grub itself, and I don't know how to change it. I could ater the generated file directly, but it's advised against in the file itself. About the custom.cfg, I'm not sure what's that. You mean adding to the /etc/grub.d/40_custom file, right? Add what to that? (please don't worry about any delays, you guys are already helping me a lot).

2. frostschutz, I believe it's the full, because it's not written rescue. Some photos that might help:
bios screen, with both options that I have configured
USB boots fine into usb and allows me to use the machine chrooted.
SSD goes to this grub screen here. it has the grub> thing only.

I can find the correct partition of the boot directory there, its (hd2,gpt1). I can see the files inside. I tried to run set prefix, set root, etc, a list of commands provided by the wiki. The last command, intird or something, that should boot the system, does nothing. I had not tried to run this configfile though. I'm going to boot again and see what it does, and I'll report back shortly.

Last edited by luanpotter (2019-04-14 12:26:24)

luanpotter

Member

Registered: 2019-04-14

Posts: 9

Website

Re: [SOLVED] Fresh install with root LUKS encryption, but GRUB fails

Holy cannoli, the divine and infallible frostschutz, I'm crying in joy in happiness! Had I known my salvation as a simple configfile command! I didn't know that was possible in the grub shell.

Indeed correct you are, in the shell, finding the file in (hd2,gpt1)/grub/grub.conf and running configfile boots to grub menu correctly, select Arch, put my encrypt password, logged in with my normal user and voila, my friend!

So now I was able to boot usb stick-less, with no chroot, startx and actually use firefox with my regular user (no super user) to answer you.

Now my problem is, my grub efi is not finding the correct grub.conf file, correct? Is there a way to fix that? Of course I can type config file grub.conf etc everytime, it's way simpler than what I had to do before, had a stick in, type 4 or 5 file lines to arch-chroot and be unable to startx with my regular user under chroot, but still, I think we are very close now! there must be a way to change the path to the config file for grub.

frostschutz

Member

Registered: 2013-11-15

Posts: 1,658

Re: [SOLVED] Fresh install with root LUKS encryption, but GRUB fails

I'm a little confused because your efibootmgr earlier listed no less than three different instances of grub? maybe it's just loading the wrong one? maybe remove the surplus ones?

you could dump a grub.cfg (is it grub.conf or grub.cfg with efi?!) in every folder under the heavens, uh, every folder in your /boot. then see if it loads one of them.

then you have to find out which one it loaded, well you could add a custom menuentry to each file, then you'd know

----

or wait until someone who understands grub/efi better :-P

Last edited by frostschutz (2019-04-14 12:45:23)

luanpotter

Member

Registered: 2019-04-14

Posts: 9

Website

Re: [SOLVED] Fresh install with root LUKS encryption, but GRUB fails

No need to wait when the expert is already here hahaha

I was trying different approaches you said when something caught my eye, you asking "is it grub.conf or grub.cfg with efi?". The config files per se have no extension, but this particular one, does. And I set it via the mkconfig command that I copied from somewhere. I gave the file name. And of course it was wrong. Its cfg, not confg. Now it works perfectly. Thank you so much!!! You saved my week

My very best regards!