[SOLVED] Is separate boot partition needed for UEFI + disk encryption?

Martinsos · 2019-07-01 19:18:02

Hi all,
I have been using Arch for some time but never with disk encryption, and I would like to start encrypting my root and home partitions.

I learned that dm-crypt + LUKS may be the good way to go, so I am going with that. I am using UEFI.

From ArchWiki and some other resources I learned that for such setup it is important to have a separate non-encrypted boot partition (so all together we need ESP, boot partition and root partition (+ home and other partitions if we are organizing stuff like that)).
Reason is that bootloader (which is located on ESP) requires files like initram and microcode and similar while booting the system, so they have to be non-encrypted, and we can achieve that by having separate boot/ partition (where those files reside) which we don't encrypt (we encrypt root and home if we have it).

I also found some examples of performing such setup: https://gist.github.com/HardenedArray/3 … a9ba458b07 and https://gist.github.com/mattiaslundberg/8620837, where they create separate boot/ partition, which further reinforces this.

However, I also found here https://wiki.archlinux.org/index.php/EF … _partition that right now recommended way to mount ESP is at /efi, not /boot/efi as before, and that it is the simplest setup because we don't need to copy initram and other files once they are regenerated.
From this I concluded that if we mount EPS to /efi, and initram and other files are written to /efi when regenerated, we don't need separate boot partition since both bootloader and these files are on ESP and therefore accessible and non-ecrypted during boot time.
Which would be cool because then I don't have to create that extra boot partition. However, since nobody else mentioned anything like this, I am skeptical and guessing I probably overlooked / misunderstood something.

Please let me know if this makes sense and if not, what did I miss! Thanks

P.S.
Extra information about my setup:
Currently I have dual boot with Win 10, I am using native UEFI, bootloader is GRUB, ESP is mounted at /boot/efi, initram and microcode and similar are in /boot, no disk encryption, no swap, no separate home partition (just root partition).
I am considering if I can introduce disk encryption without reinstalling Arch, that is why not needing boot partition would make my life easier (at least I am guessing so). But even if I am going to reinstall / re-partition, I would like not having extra partition if not needed.

Last edited by Martinsos (2019-07-02 07:10:15)

V1del · 2019-07-01 19:42:57

Your initramfs is written into /boot by default, however you can just mount the ESP to /boot and store your initramfs there, so you wouldn't technically need the extra partition. If you want your /boot and ESP to be separate (and no separate partition), you would need a boot loader that could decrypt your decryption which AFAIK only applies to GRUB (and only to LUKS1 setups)

So the easiest, given your ESP is big enough to house the initramfs, would be just using the ESP for /boot.

Last edited by V1del (2019-07-01 19:47:13)

Martinsos · 2019-07-01 19:53:05

Thanks, that sounds great!
I wonder why that is not mentioned anywhere, it sounds like the easiest option? Is there some good reason for not having ESP mount on /boot that is going to bite me later, besides space?

Omar007 · 2019-07-01 20:50:33

That option is mentioned directly next to the /efi option that you have

- mount ESP to /efi and use a boot loader which has a driver for your root file system (eg. GRUB, rEFInd).
- mount ESP to /boot. This is the preferred method when directly booting a EFISTUB kernel from UEFI."

Using EFI for /boot could allow your initramfs image to be tampered with since it's not on an encrypted partition. It's up to you if that's a threat you need to worry about or not.
Though I guess you could also cover that with Secure Boot? Never really looked into that much though. There is a wiki page about that if you're interested; https://wiki.archlinux.org/index.php/Secure_Boot

Last edited by Omar007 (2019-07-01 20:52:44)

V1del · 2019-07-01 20:51:23

It is mentioned, literally on the wiki link you linked.

One thing that might be "problematic" is that the ESP has to be some variant of a FAT filesystem. They are known for being simple to implement support for, but it does lack in resiliency, e.g. there's a chance your initramfs will be corrupted if you haven't yet explicitly flushed changes after a write (in practice this becomes relevant mostly/only during kernel updates, when the initramfs is written) as you are advised to reboot after kernel updates anyway at which point a flush will happen this isn't *that* problematic (there are other things to help and mitigate this should you not want to reboot immediately, like not using a persistent mount, but a systemd.automount which will mount the partition on access and unmount after a while, or setting up a pacman hook that calls an explicit sync on /boot post-transaction if packages change anything on /boot (man alpm-hook literally uses this as it's usage example))

Last edited by V1del (2019-07-01 21:07:05)

Simaryp · 2019-07-02 04:53:48

As I recently learned you can also mount ESP to /efi create an folder eg. arch and mount this folder to /boot. For a single os machine it might be not worth the extra effort, but for multi boot systems it's neat.

Martinsos · 2019-07-02 07:09:22

In that same wiki, somewhat below, it says: "A separate /boot partition is only needed if your boot loader cannot access your root filesystem. For example, if the boot loader does not have a filesystem driver for it, or if / is on software RAID, a encrypted volume or a LVM volume.". Plus, on the parts of wiki related to encryption, it is also mentioned separate boot partition is needed. So while one can come up with the idea of not having boot partition when doing encryption, I was worried there is a reason it is not explicitly mentioned as an option in that context.

Thanks for all the answers, this helps a lot! Marking as solved.

Martinsos · 2019-07-02 07:12:00

Simaryp wrote:

As I recently learned you can also mount ESP to /efi create an folder eg. arch and mount this folder to /boot. For a single os machine it might be not worth the extra effort, but for multi boot systems it's neat.

Sorry, how would that be useful for multi OS machine?

Simaryp · 2019-07-02 11:31:06

If you mount ESP directly to /boot, all Kernels, initramfs and bootmanager related files will be in the root folder oft ESP. In the other case they will be in a folder arch. Its not technicall,y Vetter, but NEAT.

Martinsos · 2019-07-02 12:18:35

Simaryp wrote:

If you mount ESP directly to /boot, all Kernels, initramfs and bootmanager related files will be in the root folder oft ESP. In the other case they will be in a folder arch. Its not technicall,y Vetter, but NEAT.

Ah sure, that is cool! That is because they are by default generated in /boot directory? I guess that can also be configured differently.

Simaryp · 2019-07-02 13:11:49

I don't know whether and how to configure it. This works really easy and I got the hint just some days ago here. Sry because of bad typing; foreign auto correction .

Arch Linux

#1 2019-07-01 19:18:02

[SOLVED] Is separate boot partition needed for UEFI + disk encryption?

#2 2019-07-01 19:42:57

Re: [SOLVED] Is separate boot partition needed for UEFI + disk encryption?

#3 2019-07-01 19:53:05

Re: [SOLVED] Is separate boot partition needed for UEFI + disk encryption?

#4 2019-07-01 20:50:33

Re: [SOLVED] Is separate boot partition needed for UEFI + disk encryption?

#5 2019-07-01 20:51:23

Re: [SOLVED] Is separate boot partition needed for UEFI + disk encryption?

#6 2019-07-02 04:53:48

Re: [SOLVED] Is separate boot partition needed for UEFI + disk encryption?

#7 2019-07-02 07:09:22

Re: [SOLVED] Is separate boot partition needed for UEFI + disk encryption?

#8 2019-07-02 07:12:00

Re: [SOLVED] Is separate boot partition needed for UEFI + disk encryption?

#9 2019-07-02 11:31:06

Re: [SOLVED] Is separate boot partition needed for UEFI + disk encryption?

#10 2019-07-02 12:18:35

Re: [SOLVED] Is separate boot partition needed for UEFI + disk encryption?

#11 2019-07-02 13:11:49

Re: [SOLVED] Is separate boot partition needed for UEFI + disk encryption?

Board footer