Arch Linux

LichenEater

Member

Registered: 2026-08-22

Posts: 4

Need help understanding how encrypted boot partitions work (GRUB+BIOS)

TLDR: Erroneously (I think) mounted /boot due to a gap in knowledge, and Arch didn't install properly.

Hello, this is my first time installing Arch Linux, and my goal was to encrypt my entire drive during the install process, including the boot partition. I am doing a Legacy/BIOS install not UEFI, for context. I am following the guide linked here (as well as the default Arch installation guide): https://wiki.archlinux.org/title/Dm-cry … ion_(GRUB)

Where I believe I made a mistake was when I attempted to mount /boot to the 1MiB BIOS boot partition I created. For context, I have an SSD I'm installing on and I formatted the SSD to the GPT scheme with fdisk, then created two partitions: A 1MiB BIOS boot partition (/dev/nvme0n1p1), and a LUKS encrypted partition taking up the rest of the drive space (/dev/nvme0n1p2). The guide said to create a 1 MiB BIOS boot partition if you are doing a Legacy/BIOS install. I then did all of the same steps in Section 8.1 and 8.2 of the above linked guide. This is when I then typed the following commands:

"mkfs.ext4 /dev/nvme0n1p1"
"mount --mkdir /dev/nvme0n1p1 /mnt/boot".

Apparently, you are not supposed to format the BIOS boot partition nor mount /boot to it (even though its called the boot partition). My assumption here was that /boot and GRUB and all of the bootloader stuff was supposed to be in the 1MiB BIOS partition, but apparently, /boot actually sits inside the LUKS encrypted partition (I was confused why the guide never encrypts the 1MiB BIOS partition, or the UEFI partition for if you are using UEFI). The errors started coming in after i did pacstrap and the /boot stuff got partially installed into my BIOS partition, which messed up the "mkinitcpio -P" command required to regenerate mkinitcpio after editing it to work for LUKS (Error: early uncompressed CPIO image generation failed, bsdtar step 1 reported an error).

I then attempted to unmount /boot from the 1MiB BIOS boot partition, wipe the BIOS boot partition of erroneously installed files, and redo pacstrap so /boot gets installed inside the LUKS partition which seemed to make "mkinitcpio -P" work. However, there were still problems. My /mnt/etc/fstab file still showed /boot mounted to the BIOS partition, so I deleted that line. I then did the GRUB configuration as outlined in the guide and GRUB seemed to install with no problems.

However, when rebooting and trying to boot into the drive I installed Arch on, it doesn't boot at all (so I am assuming that mounting /boot to my BIOS boot partition must've messed something up along the way, so I will try a reinstall). My question is then, how does encrypted /boot really work? Is /boot something that sits inside the /root or /home directory in the LUKS encrypted partition? What then is the purpose of the 1MiB BIOS boot partition, if it is not /boot or where GRUB lives?

Last edited by LichenEater (Yesterday 05:13:14)

frostschutz

Member

Registered: 2013-11-15

Posts: 1,652

Re: Need help understanding how encrypted boot partitions work (GRUB+BIOS)

The 1MiB partition can't be mounted (no filesystem), it is just for grub core to embed itself in (still needs additional modules from /boot/grub/...). grub core is also usually just around a hundred kilobytes in size, 1MiB is done for alignment reasons. If you're using uefi boot you don't need it at all, grub core is put on the efi partition as a regular file then.

It's still a good idea to have a dedicated /boot partition so Grub does not have to handle the entire rootfs plus additional headaches like RAID, LVM, btrfs/zfs checksums and snapshots, etc. (if you use any of those). Grub sometimes stop working with filesystems that are still under active development when it encounters unknown filesystem flags.

If you changed your partition/mounting layout, you might have to re-run grub-install and grub-mkconfig.

Last edited by frostschutz (Yesterday 05:20:42)

LichenEater

Member

Registered: 2026-08-22

Posts: 4

Re: Need help understanding how encrypted boot partitions work (GRUB+BIOS)

Thank you for the information. As for having a dedicated /boot partition, do you mean creating a partition alongside the 1MiB partition and the LUKS encrypted partition, or creating a directory inside the LUKS partition and mounting /boot there? I am trying to also have an encrypted boot partition, and the documentation guide has the partition scheme set up as follows (it shows both an EFI and BIOS boot partition for generality, but I assume only the one that is necessary for your system should actually be there):

NAME                              MAJ:MIN RM   SIZE   RO  TYPE  MOUNTPOINT
sda                                   8:0           0      200G  0      disk
├─sda1                            8:1           0      1M      0     part
├─sda2                            8:2           0      550M  0     part      /mnt/efi
└─sda3                            8:3           0     100G   0     part
  └─cryptlvm                    254:0       0      100G  0     crypt
    ├─MyVolGroup-swap  254:1       0       4G     0     lvm       [SWAP]
    ├─MyVolGroup-root    254:2       0       32G   0     lvm       /mnt
    └─MyVolGroup-home 254:3       0       60G   0     lvm       /mnt/home

Would /boot then sit inside cryptlvm? In the documentation, the guide for an encrypted boot partition with GRUB only has a LUKS-encrypted container on sda3, so I assume /boot does sit inside cryptlvm, unless I am mistaken on how GRUB or how LUKS-encrypted logical volumes work (I am just learning all of this now).

jonno2002

Member

Registered: 2016-11-21

Posts: 894

Re: Need help understanding how encrypted boot partitions work (GRUB+BIOS)

save yourself alot of hassle and dont encrypt the boot partition, theres really no need as theres zero important data there.
this is my partition layout:

NAME                  FSTYPE      FSVER    MOUNTPOINTS
nvme0n1                                    
├─nvme0n1p1           vfat        FAT32    /boot
└─nvme0n1p2           crypto_LUKS 2        
  └─cryptlvm          LVM2_member LVM2 001 
    ├─MyVolGroup-swap swap        1        [SWAP]
    └─MyVolGroup-root ext4        1.0      /

/boot is boot and efi

you said you were using legacy boot but you have an EFI partition, all you need to do is mount that to /boot and wipe it and setup as boot with efi as well, having a dual boot method (bios/efi) is quite handy anyway, i have a few drives like that so i can boot them in any device.

i plan on removing the LVM and just using a swap file soon to simplify my setup even more, and the fact that my swap is basically never used anyway..

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 767

Re: Need help understanding how encrypted boot partitions work (GRUB+BIOS)

I am trying to also have an encrypted boot partition

How firmware (BIOS) is supposed to decrypt boot partition to continue booting?
Neither 1MB grub core partition for legacy boot scheme, nor EFI system partition for UEFI boot should be encrypted.