2

I remember reading a blog entry that someone at Canonical was working on making LUKS work without a boot partition for 17.04. However when I did a fresh install of 17.10 I was unable to find anything. I know that it is possible to make grub handle LUKS encryption, and could probably hack it up myself, but does anyone know what happened to said work? I searched for a while and failed to find the blog entry.

michaeljt
  • 211
  • 1
    as I understand it, the boot partition is required for the BIOS/EFI to load and launch grub, since the firmware can not decrypt the disk. – ravery Nov 03 '17 at 15:34

1 Answers1

4

Assuming you're running an EFI system, the EFI System Partition (usually the first partition on your disk, mounted at /boot/efi) will always need to be decrypted so that your system can actually load into GRUB.

However, you can now stick /boot itself inside LUKS. A guide for that is available in this answer on the site, however this has a few caveats:

  • Every time you update your kernel/GRUB, you will need to "re-install" it on your system, and make sure things recognize it. As far as I can tell, there's no automated hook.
  • GRUB won't be taking over LUKS entirely. If I remember correctly, it'll prompt for the password and go from there, but it will not replace LUKS.
  • This setup, as far as I can tell, has a very decent potential to break in potentially amazing ways.

To be honest, there's little to no reason to actually stick /boot inside of LUKS. It just causes quite a bit of unnecessary pain and makes one's life much worse for not too much of a gain. The main risk (tampering with the kernel) can easily be mitigated by using Secure Boot to sign the kernel and any modules. If you want to run this digital signature enforcement, please read through the entire wiki page linked.

Kaz Wolfe
  • 34,122
  • 21
  • 114
  • 172
  • In fact I am using BIOS and need to load self-compiled kernel modules, so I am steering clear of secure boot for now. But what I was actually looking for was information about what had happened to the plans I seem to recall to make single partition (probably excluding a mini-partition for grub) a supported option. And the main advantage I see would be an end to updates aborting because of full /boot partitions. – michaeljt Nov 04 '17 at 19:34