Arch Linux

ewon_c

Member

Registered: 2018-12-06

Posts: 10

LVM on LUKS installtion failed

Hi All,

Been using Arch for some time now, installed on multiple BIOS and UEFI machines with traditional partitioning, no problem encountered.
Recently I'm trying to set up disk encryption for / and /home, following ArchWiki LVM on LUKS . Both dm-crypt/LUKS and LVM are new to me, so I carefully read all relevant wiki pages in addition to the set up guide.

My laptop is Dell Inspiron 7573 with NVMe SSD and 16GB RAM. I created two partitions:
/dev/nvme0n1p1 as EFI partition
/dev/nvme0n1p2 as LUKS encrypted partition, formatted as ext4 and created LVM on top containing swap, root and home as logical volumes.
After minimal installation, the laptop booted into GRUB rescue console (grub rescue>) without the prompt of LUKS passphrase. I installed several times, using both udev and systemd hooks, still no luck whatsoever.

Questions:
1. Is my approach reasonable, i.e., does LVM on LUKS support mixture of non-encrypted EFI partition and encrypted LVM on a single SSD (I don't see why not)?
2. I didn't configure fstab nor crypttab as the Wiki example didn't mention them. Does it matter?
3. When partitioning using cfdisk, I set EFI partition type as "EFI system". nvme0n1p2 can be set as "Linux filesystem" or "Linux LVM". Not sure which one to use. I tried both.

Please take a look at the last iteration of my installation scripts:

cryptsetup luksFormat /dev/nvme0n1p2
cryptsetup open /dev/nvme0n1p2 cryptlvm

vgcreate VolGroup /dev/mapper/cryptlvm
lvcreate -L 16G VolGroup -n swap
lvcreate -L 80G VolGroup -n root
lvcreate -l 100%FREE VolGroup -n home

mkfs.fat -F32 /dev/nvme0n1p1
mkfs.ext4 /dev/VolGroup/root
mkfs.ext4 /dev/VolGroup/home
mkswap /dev/VolGroup/swap

mkdir /mnt/home
mount /dev/VolGroup/root /mnt
mount /dev/VolGroup/home /mnt/home
swapon /dev/VolGroup/swap

After normal installation steps, below are for initramfs (mkinitcpio), bootloader (GRUB) and kernel parameters:

nano /etc/mkinitcpio.conf (I tried both busybox and systemd hooks, below are systemd)
HOOKS=(base systemd autodetect keyboard sd-vconsole modconf block sd-encrypt sd-lvm2 filesystem fsck)
mkinitcpio -p linux

mkdir /efi
mount /dev/nvme0n1p1 /efi
grub-install --target=x86_64-efi --bootloader-id=GRUB --efi-directory=/efi
grub-mkconfig -o /boot/grub/grub.cfg

nano /etc/default/grub (added kernel parameters)
rd.luks.name=....nvme0n1p2's UUID....=cryptlvm rd.luks.options=discard root=/dev/VolGroup/root resume=/dev/VolGroup/swap
grub-mkconfig -o /boot/grub/grub.cfg

exit
umount -R /mnt
reboot

Begging for a clew! Thank you all.

frostschutz

Member

Registered: 2013-11-15

Posts: 1,658

Re: LVM on LUKS installtion failed

In your description I don't see you ever mentioning what /boot is supposed to be.

So it seems like your /boot is simply part of the / filesystem, which is encrypted.

GRUB cannot read encrypted grub.cfg. ArchLinux uses LUKS2 by default but GRUB only supports LUKS1. And even with LUKS1 you should think twice about letting GRUB deal with encryption. It complicates things a great deal and offer little benefits.

ewon_c

Member

Registered: 2018-12-06

Posts: 10

Re: LVM on LUKS installtion failed

So it seems like your /boot is simply part of the / filesystem, which is encrypted.

Thank you. I realized what the problem is. For solutions, I think I can either do:
1. Following Alternative GRUB install method by forcing GRUB to install config file to EFI partition, instead of /boot
2. Create a separate, non-encrypted partition between EFI partition and LUKS/LVM Partition for /boot

I think I’ll try method 1, since it’s easier.

———————————

Update:

Tried re-installing with method 1, was able to see GRUB menu, but then I was greeted with

error: no such devices: xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Loading linux linux-lts
error: disk `lvmid/xxxxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxxxx/xxxxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxxxx` not found
Loading initial RAM disk ...
error: you need to load the kernel first

Press any key to continue...

I do realize at this point that all the image files are still located at /boot, which is under / and therefore encrypted. Not sure if this is a concern.

Last edited by ewon_c (2019-06-02 18:26:39)

ewon_c

Member

Registered: 2018-12-06

Posts: 10

Re: LVM on LUKS installtion failed

Update 2:

Inspired by this post , I mounted EFI partition to /boot, in order to avoid creating a separate partition for /boot
After reboot I was able to see GRUB menu, and greeted with this

Starting version 242.29-1-arch
ERROR: device ‘/dev/mapper/VolGroup-root’ not found. Skipping fsck.
mount: /new_root: no filesystem type specified.
You str now being dropped into an emergency shell.
sh: can’t access tty: job control turned off
[rootfs ] #

I’m so frustrated at this point. It seems a separate partition for /boot is unavoidable

frostschutz

Member

Registered: 2013-11-15

Posts: 1,658

Re: LVM on LUKS installtion failed

No, you booted successfully. Nothing wrong with the way you boot. The kernel and initramfs was loaded, if you `cat /proc/cmdline` and also see the kernel parameters you expected, then you're done with the bootloader.

All that's left then is figure out how the initrd was misconfigured to be unable to find your root partition. If you don't fix that then no matter how you change your boot partition, it won't work.

So this is mkinitcpio configuration issue, or missing kernel parameter.

Last edited by frostschutz (2019-06-03 07:26:21)

ewon_c

Member

Registered: 2018-12-06

Posts: 10

Re: LVM on LUKS installtion failed

Hi frostschutz, thanks for confirming. I haven't had time to investigate into it, I'll definitely spend some time on the weekend.

Just want to confirm the possibility that GRUB can be installed on EFI partition, and that the img files can also be stored on it.  i.e., mount EFI partition to /boot before installing linux kernel and "grub-install ... --boot-directory=/boot ...", in order to avoid creating a separate partition for /boot.