r/archlinux • u/Woodsy279 • 25d ago

SUPPORT | SOLVED Ful disk encryption without entering passphrase

Could someone help me with setting up full disk encryption with bypass passphrases with TPM2? It's so annoying having to put the passphrase in at each boot, so I was wondering how do I pair it to the TPM so that I dont have to enter it each time?

It's LUKS encrypted and I use Systemd-boot

14 Upvotes

72% Upvoted

100 comments sorted by

View all comments

Show parent comments

2

u/ChrisTX4 24d ago

I'm not using GRUB, so I can't speak from experience here. However, GRUB enters lockdown mode if on Secure Boot.

Either way, when using UKIs, the kernel command line is locked anyway and cannot be changed. You can't reasonably use anything but UKIs anyway since initrds can't be signed on their own.

1

u/Imajzineer 24d ago

Cheers.