In Archlinux, the initial ramdisk which contains kernel modules needed for booting the system is generated by a bash script named mkinitcpio. In /etc/mkinitcpio.conf you specify which kernel modules you need at boot and then you build the initrd image (which Archlinux calls initramfs-linux.img) with mkinitcpio -p linux
mkinitcpio will work OOTB for most standard configurations, i.e. root partition in a regular, non-LVM partition, no encrypted partitions, etc. But in my case, I use LVM2 partitions for my root, home, var and other system partitions with only /boot being a regular partition. In addition, these LVM2 partitions are stored inside of a LUKS encrypted container. The initramfs-linux.img created by default mkinitcpio settings cannot handle such things as encrypted partitions and root partitions located inside LVM2 partitions, so you must customize mkinitcpio.conf accordingly.
mkinitcpio.conf settings for root partition located inside of LVM2 in LUKS (using sd-encrypt hook)
Inside /etc/mkinitcpio.conf locate the line starting with HOOKS=
The default settings as of Dec. 31, 2016 should look something like:
HOOKS="base udev autodetect modconf block filesystems keyboard fsck"
You should edit this line so it looks like:
HOOKS="base systemd sd-encrypt autodetect modconf block sd-lvm2 filesystems keyboard fsck"
Instead of the udev module, you will use systemd, and LUKS partitions will be handled by systemd's sd-encrypt module. Also notice there is a LVM2 kernel module present, but this module is the systemd version sd-lvm2.
Once you have edited mkinitcpio.conf, generate your initial ramdisk with mkinitcpio -p linux
The next step is to add kernel boot options to GRUB (for BIOS machines) or systemd-bootctl (for UEFI machines).
Kernel boot options for sd-encrypt and sd-lvm2 in /etc/default/grub (BIOS)
If you have an older computer that doesn't have UEFI firmware but uses BIOS, Archlinux uses GRUB to boot your system. You have to edit /etc/default/grub with the appropriate options for sd-encrypt and then regenerate your grub configuration in /boot/grub/grub.cfg
Find the line GRUB_CMDLINE_LINUX_DEFAULT= and edit it as follows:
GRUB_CMDLINE_LINUX_DEFAULT="luks.uuid=72369889-3971-4039-ab17-f4db45aeeef2 root=UUID=f4dbfa30-35ba-4d5e-8d43-a7b29652f575 rw"
Note that the luks.uuid is the UUID for your LUKS encrypted partition BEFORE it has been opened with cryptsetup open
You can find the UUID for all partitions with blkid
root=UUID= refers to the UUID of your root partition which resides inside of a LVM partition which itself is inside of a LUKS encrypted container.
If you haven't written the GRUB bootloader to your disk yet, you would then execute:
grub-install --recheck /dev/sda
(assuming sda is the HDD from which you will boot)
And then (re)generate your grub.cfg:
grub-mkconfig -o /boot/grub/grub.cfg
Kernel boot options for sd-encrypt and sd-lvm2 in /boot/loader/entries/arch.conf
Archlinux uses systemd-bootctl as the bootloader for newer machines with UEFI firmware. The main boot menu is located in /boot/loader/loader.conf which looks like:
[archjun@gl553rog loader]$ cat loader.conf
timeout 5
default arch
This particular menu contains only a single entry, but you can add entries for other Linux distros (systemd-bootctl can chainload to GRUB) and OS'es like Windows.
The OS-specific config files are stored under /boot/loader/entries/ and my arch-specific config is in /boot/loader/entries/arch.conf
title Archlinux
linux /vmlinuz-linux
initrd /intel-ucode.img
initrd /initramfs-linux.img
options luks.uuid=ba04cb93-328c-4f9a-a2a9-4a86cee0f592 luks.name=UUID=ba04cb93-328c-4f9a-a2a9-4a86cee0f592=luks root=/dev/mapper/ARCH-rootvol rw
options acpi_osi=! acpi_osi="Windows 2009"
The kernel boot options appear on the line starting with the keyword options
For luks.uuid you need to specify the UUID of your LUKS partition BEFORE it has been opened by cryptsetup. luks.name is not strictly necessary; it simply assigns an easy-to-read name to your LUKS partition. Finally, root specifies which partition your root partition is located on so that the kernel can proceed with booting. For the root parameter, you can specify the partition using /dev/mapper syntax or UUID. If you use UUID you must use the syntax root=UUID=...
After editing your arch.conf it is not necessary to rebuild any images or regenerate configs as is the case with GRUB.
Warning: Do not mix up the syntax for sd-encrypt and encrypt mkinitcpio HOOKS
Before systemd became popular, the initial ramdisk for Archlinux used busybox. When booting from an encrypted root and LVM2 with busybox, the mkinitcpio HOOKS used are encrypt and lvm2 (as opposed to sd-encrypt and sd-lvm2 for systemd)
An /etc/mkinitcpio.conf customized for LUKS and LVM2 (without systemd) would look like:
HOOKS="base udev encrypt autodetect modconf block lvm2 filesystems keyboard fsck"
Notice that the encrypt hook comes just after udev. If you were using systemd boot, however, udev would be replaced by systemd.
The related settings in /etc/default/grub (BIOS) or /boot/loader/entries/arch.conf (UEFI) would then look something like the following:
/etc/default/grub
GRUB_CMDLINE_LINUX_DEFAULT="cryptdevice=UUID=5a2527d8-8972-43f6-a32d-2c50f734f7a9:ARCH root=/dev/mapper/ARCH-rootvol"
/boot/loader/entries/arch.conf
title Arch
linux /vmlinuz-linux
initrd /intel-ucode.img
initrd /initramfs-linux.img
options cryptdevice=UUID=f121bc44-c8c2-4881-b9d5-da4d1b49f3e4:ARCH root=/dev/mapper/ARCH-rootvol rw
The keyword cryptdevice will only work with the encrypt module in your initial ramdisk. If you are using sd-encrypt, however, you must replace cryptdevice=UUID= with luks.uuid=
References:
https://wiki.archlinux.org/index.php/Dm-crypt/System_configuration#mkinitcpio
댓글 없음:
댓글 쓰기