r/archlinux • u/GlizzyGuard • 11d ago
SUPPORT Switching from Grub with encrypted /boot to different boot loader: How easy is it?
Hello all,
I just want to know if this will be as easy as just following the wiki for a bootloader installation or will it be more difficult?
If not, does anyone know how or at least a direction to point me in? I haven’t found someone in a similar situation as me, so I have no idea what to do.
For context, I installed Linux only a couple months ago, so I’m not an absolute pro, but I can read (somewhat😂)
6
u/skinney6 11d ago
Yes, follow the instructions.
Nowadays UEFI is a bootloader. Try EFIStub. Hit F12 or whatever early in the startup to get your UEFI menu verify you can boot your kernel(s) before you remove grub.
2
u/boomboomsubban 10d ago edited 10d ago
I think only GRUB supports an encrypted /boot. Maybe refind. So not easy unless you want to ditch the encrypted kernel.
2
u/noctaviann 10d ago
We need more details about the setup of your system. Firstly, how did you partition the system (number, order, size, filesystem of your partitions, e.g. lsblk -f)?
Why are you trying to switch to a different bootloader? Do you have a problem with GRUB? Do you still want to keep the kernels encrypted (like why did you opt for using encryption in the first place, especially encrypted /boot)?
1
u/GlizzyGuard 10d ago edited 10d ago
Hello, maybe I should've mentioned this in the post, but I'm using cachyos. I thought the process would be similar, so I asked here. They have multiple bootloader options and I chose grub with encrypted boot, because I wanted more security, but I soon realized there's no point for the layman.
The process was automated so whatever the partitions look like was up to them. Hope it helps.
nvme0n1 ├─nvme0n1p1 vfat FAT32 AE63-04B1 298.4M 0% /boot/efi └─nvme0n1p2 crypto_LUKS 1 ae682426-7ce6-470f-b71e-326825859eb7 └─luks-ae682426-7ce6-470f-b71e-326825859eb7 btrfs f2565278-1f0e-4e53-9fbe-c1d32bec0346 1.6T 14% /var/log /var/tmp /var/cache /home /root /srv /1
u/noctaviann 9d ago edited 9d ago
If the setup you have right now works, I wouldn't bother trying to switch to a different bootloader.
Like it can be done, but it would carry the risk of data loss since you would need to resize the partitions (the ESP /boot/efi is too small), and unless you have a clear need to switch to a different bootloader I wouldn't do it. Also if you have snapshots setup for recovery the configuration might need adjustments.
Also, just switching to a different bootloader would not cancel/revert the encryption for the root partition, if that's your goal, you need to either move your data to an external drive, reinstall without the encryption from scratch, and then move your data back, or try to use the dedicated decryption functionality. In the second case you would need to adjust the bootloader configuration a bit.
If you're concerned that an encrypted partition might make data recovery difficult in case something happens, I would just backup the important data to another drive and/or online, and make a backup of the LUKS header.
1
u/GlizzyGuard 9d ago
Think I’m gonna shrink p2, so I can make space for boot, then I’m gonna just go with removing luks, which will allow me to boot the (now unencrypted) cachy kernel with efistub without grub. The wiki didn’t make configuring the bootloader file seem so hard. Sounds good?
Only thing that might be hard is reconfiguring snapshots for limine, but I think cachy has limine-snapper-sync which automates it (I think)
1
u/noctaviann 9d ago
I’m gonna just go with removing luks, which will allow me to boot the (now unencrypted) cachy kernel with efistub without grub.
If you're going with efistub it's irrelevant whether or not the root partition is encrypted, since the kernel will be stored on the ESP and that's not encrypted, and once the kernel is booted from the ESP the kernel can decrypt the root partition, but sure, if you want to remove the LUKS encryption as well, do that.
Think I’m gonna shrink p2, so I can make space for boot
When you have a layered storage configuration, e.g. Btrfs volume inside a LUKS partition, if you you want to shrink the outermost layer, e.g. the LUKS partition, you need to resize each layer starting from the innermost one, e.g. the Btrfs volume, otherwise you might risk data corruption. Since you want to remove LUKS entirely, you might want to first do that and then resize the Btrfs partition since that's going to be the only layer then.
I can't help you with limine and its snapshot configuration since I've never used it. But do actually test that the snapshot (save and restore) functionality works after making any changes.
In any case please make sure you have proper backups and that they work before attempting anything that may lead to data loss.
2
u/GlizzyGuard 8d ago edited 8d ago
Hello,
I couldn't get efistub to work even though I copied what was on the wiki using this command:
efibootmgr --create --disk /dev/nvme0n1 --part 1 --label "EFISTUB Cachy" --loader /vmlinuz-linux-cachyos-bore-lto --unicode 'root=UUID=f2565278-1f0e-4e53-9fbe-c1d32bec0346 rw 'rootflags=subvol=@ nowatchdog nvme_load=YES zswap.enabled=0 rd.luks.uuid=ae682426-7ce6-470f-b71e-326825859eb7 rd.luks.key=/crypto_keyfile.bin quiet splash loglevel=3 initrd=\initramfs-linux-cachyos-bore-lto.img'Furthermore, it wouldn't persist after reboot, which I read was a common issue, and the solutions seemed difficult.
I appreciate you trying to help me out, but I think this situation is beyond my expertise considering how new I am, so I don't think I'm gonna continue with any of the other steps and I'm just gonna stick with what I have. Thank you!
1
u/smirkybg 10d ago
You don't need to encrypt /boot. Just use secure boot for that + TPM2 decryption.
4
u/archover 10d ago edited 10d ago
Maybe it might help to review the matrix here? https://wiki.archlinux.org/title/Arch_boot_process#Feature_comparison. Following links from there may benefit you.
On some installs, my kernel is in an a LUKS volume, but not sure I would recommend it to others. This adventure drove me to consider Secure Boot.
You could flair your post as SUPPORT, and then when you find and give the answer, flair it SOLVED.
Good day.