在 grub menuentry 后输入 FDE 密码

Question

My system is a dual boot of Windows 10 (sdb) and Manjaro (sda) installed on separate hard drive. Windows system drive is encrypted with bitlocker and Manjaro is encrypted via LVM over LUKS as the following (lsblk).

NAME             MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda                8:0    0 931.5G  0 disk  
├─sda1             8:1    0   619M  0 part  /boot/efi
├─sda2             8:2    0 232.8G  0 part  
│ └─cryptroot    254:0    0 232.8G  0 crypt 
│   ├─vg0-swap   254:1    0    32G  0 lvm   [SWAP]
│   ├─vg0-system 254:2    0    20G  0 lvm   /
│   └─vg0-data   254:3    0 180.8G  0 lvm   /home
└─sda5             8:5    0 698.1G  0 part  
sdb                8:16   0 232.9G  0 disk  
├─sdb1             8:17   0   499M  0 part  
├─sdb2             8:18   0   100M  0 part  
├─sdb3             8:19   0    16M  0 part  
└─sdb4             8:20   0 232.3G  0 part

I setup grub2 as the default bootloader (installed on Manjaro) and it is able to ask me to choose whether I want to boot Windows or Manjaro via a menu. However, the problem is that it will ask the (LUKS FDE) password before giving me that menu. As a result, because Windows is already encrypted with bitlocker, I will have to enter the Windows bitlocker password after the LUKS password, which is quite inconvenient. (If I want to boot to Manjaro, suprisingly, I don't need to enter the LUKS password twice)

Because Windows and Manjaro is installed on different physical hard drive and the boot partition is not encrypted (as shown above), it shouldn't be necessary for grub to ask me the password for LUKS when I want to boot to Windows. It should first show the menu and ask me the LUKS password only if I choose to boot to Manjaro. But I am not sure how to configure this, and I can't find much resource about it.

Here is my grub config file (at /etc/default/grub )

GRUB_DEFAULT=saved
GRUB_TIMEOUT=10
GRUB_TIMEOUT_STYLE=hidden
GRUB_DISTRIBUTOR="Manjaro"
GRUB_CMDLINE_LINUX_DEFAULT="quiet udev.log_priority=3"
GRUB_CMDLINE_LINUX="cryptdevice=UUID=<uuid_is_hidden>:cryptroot"

# If you want to enable the save default function, uncomment the following
# line, and set GRUB_DEFAULT to saved.
GRUB_SAVEDEFAULT=true

# Preload both GPT and MBR modules so that they are not missed
GRUB_PRELOAD_MODULES="part_gpt part_msdos"

# Uncomment to enable booting from LUKS encrypted devices
GRUB_ENABLE_CRYPTODISK=y

# Uncomment to use basic console
GRUB_TERMINAL_INPUT=console

# Uncomment to disable graphical terminal
#GRUB_TERMINAL_OUTPUT=console

# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command 'videoinfo'
GRUB_GFXMODE=auto

# Uncomment to allow the kernel use the same resolution used by grub
GRUB_GFXPAYLOAD_LINUX=keep

# Uncomment if you want GRUB to pass to the Linux kernel the old parameter 
# format "root=/dev/xxx" instead of "root=/dev/disk/by-uuid/xxx" 
#GRUB_DISABLE_LINUX_UUID=true

# Uncomment to disable generation of recovery mode menu entries
GRUB_DISABLE_RECOVERY=true

# Uncomment and set to the desired menu colors.  Used by normal and wallpaper 
# modes only.  Entries specified as foreground/background.
GRUB_COLOR_NORMAL="light-gray/black"
GRUB_COLOR_HIGHLIGHT="green/black"

# Uncomment one of them for the gfx desired, a image background or a gfxtheme
#GRUB_BACKGROUND="/usr/share/grub/background.png"
GRUB_THEME="/usr/share/grub/themes/manjaro/theme.txt"

# Uncomment to get a beep at GRUB start
#GRUB_INIT_TUNE="480 440 1"

Answer 1

OK, after a lot of research, I figured out a solution, but it might not be the best solution (see caveats below).

Notice the below line in lsblk

├─sda1             8:1    0   619M  0 part  /boot/efi

The /boot partition is actually encrypted except for the efi partition /boot/efi . I remembered this is the recommended (and probably the default) setting when I installed manjaro. Because grub will read the menu entries from /boot/grub/grub.cfg , it must first decrypt the LUKS volume ( /boot/grub is encrypted). Therefore, if we want grub to display menu entries before entering password, we must make sure /boot/grub/grub.cfg is not encrypted.

One way to do this is to mount sda1 as /boot instead of /boot/efi . To do this, we first need to make change in /etc/fstab to change the mount destination. Then, we need to copy all files from /boot to the sda1 . You may want to reinstall grub and regenerate initramfs in the process. The following commands are useful for this.

sudo mkinitcpio -P
sudo grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=manjaro --recheck
sudo grub-mkconfig -o /boot/grub/grub.cfg

In the end, you need to comment out the line GRUB_ENABLE_CRYPTODISK=y in /etc/default/grub to disable decryption from grub. When everything is done, run the following command to update grub to write the change.

sudo update-grub

Several Caveats

1. As I mentioned in the question, the original setup does not require to enter the LUKS password again after entering it in grub. This is because a keyfile has been embedded into initramfs so it does not need password to unlock LUKS volume, for detail see here . Since /boot is not encrypted in the new setup, we must not include this keyfile in the initramfs . To do this, modify the config file for mkinitcpio (the default one should be /etc/mkinitcpio.conf ) to remove the keyfile (under FILES=(...) ), and regenerate initramfs .
2. From a security perspective, the default and recommended setting of mounting /boot/efi instead of /boot provides better security as the only unencrypted part is the EFI binary ( grubx64.efi ). In my setup, however, the initramfs and linux kernel image ( vmlinuz.img ) is also unencrypted. An attacker can inject malicious code into these files that get executed after you entered the password.

For the reason mentioned above, I don't think my solution is the best and not sure whether there are other solutions for this problem without compromise too much security.

Useful links:

https://wiki.manjaro.org/index.php/GRUB/Restore_the_GRUB_Bootloader https://wiki.archlinux.org/index.php/GRUB https://wiki.archlinux.org/index.php/Mkinitcpio#Image_creation_and_activation