Calamares Uses LUKS1 When Encrypting Partitions in New Installations

General system EndeavourOS installation
21

Sort of?

The real difference is the location of the kernel and the initramfs. With systemd-boot, the kernel and initrd live in the EFI partition which is not encrypted. So the bootloader loads the kernel and initrd and the initrd asks for your password and decrypts the root filesystem.

With grub, the kernel and the initrd are inside the encrypted filesystem. So grub has to ask for your password and decrypt the filesystem before it can load the kernel and initrd. However, the initrd will still have to also decrypt the the root filesystem. To avoid getting asked for your password twice, we add a keyfile during the install. That way the initrd can decrpyt the filesystem without asking for your password.

22

So… is there any reason to not load initramfs from EFI with grub as well?

23

The biggest reason we continue to support grub is for people who want to boot off of snapshots.

If we put the kernel and initrds in the ESP, it will break that use case. This is because when the snapshot is rolled back the kernel & initrd will be out of sync with the installed system.

24

Got it. Thank you.

25

Ok sooo…
I just did testing. And everything works!

  1. Load to install iso, update grub package, made grub installation with encrypted volume.
  2. Boot to installed system check if everything works.
  3. Boot into installation iso.
  4. Convert LUKS partition to LUKS2 format
  5. Add new key slot - check that it is argon - by default
  6. Open luks partition, and mount it to /mnt
  7. Mount efi to /mnt/boot/efi
  8. chroot to /mnt
  9. Edit /etc/default/grub to include:
    GRUB_PRELOAD_MODULES="part_gpt part_msdos luks2 pbkdf2"
    And new luks part guuid in CMD field.
  10. check fstab to also refer right guuid.
  11. grub-install and grub-mkconfig -o /boot/grub/grub.cfg
  12. Exit chroot, rebbot

After this grub is working and unlocking LUKS2 partition by both keyslots (keyfrases)

26

Did you remove the other keys?

27

Just tested. Removed keyslot 0 with initial passphrase:
#cryptsetup luksKillSlot /dev/device 0
And everything works.

Note that you should not remove keyslot 1 - as it is for keyfile stored on initramfs image.

28

Sooo, should we remove this workarounds?

29

If you mean should we make the installer support luks2 with grub, it isn’t about removing workarounds, we would have to build support for it in Calamares first.

Ideally this would be done upstream in Calamares itself.

30

It suppors LUKS2. But have workaround to fallback to LUKS1 for GRUB.

From what Joe said I got the empression that its in EOS part of fork.

Mmmm, and where is upstream located?

31

In order to make it support luks2, you had to add options to GRUB_PRELOAD_MODULES. That is part of the Calamares config for grub.

The part that we added to our for was to let it have a different option for grub and systemd-boot.

Keep in mind, adding support upstream would need to be conditional on which version of luks was selected because Calamares is used with a lot of different distros. This includes LTS distros which won’t be getting the new version of grub for quite some time.

Here is the relevant module:

32

If its config config, it must not be a problem to change it?
Or its hardcoded in code?

33

Since it needs to be set conditionally on whether the disk is encrypted and if luks2 is selected, it would need to be added to the code.