4 ms·

You still need an unencrypted EFI partition given what you describe, and the signed unified kernel image lives there, which means that you do in fact have a boo

You still need an unencrypted EFI partition given what you describe, and the signed unified kernel image lives there, which means that you do in fact have a boot partition. My /boot mount is my EFI partition. However, an alternative is having your EFI partition reside on a USB drive that in turn boots into your encrypted partition.

dathinab 6y ago
/boot is not the same as the efi system partition (ESP), sure you need to copy the signed kernel blob into the ESP but I still wouldn't recommend mounting ESP as /boot if your linux distro allows it. The reason for this are many fold including that Linux assumes /boot is managed by it but the ESP isn't managed by Linux and might contain other EFI compatible programs. Another reason is that you want to make sure only the signed blob is in the ESP and nothing else, but depending on your distro and packages all kind of thinks might be put into /boot. Another reason is the dir structure. /boot is flat but ESP isn't meant to be flat e.g. in my case it's /EFI/<osname>/<efifiles> E.g. my /boot partition contains "initramfs-linux.img", "intel-ucode.img" and "vmlinuz-linux" but my /esp contains only linux-signed.efi which packs the necessary image files, linux kernel, kernel parameters, boot splash screen etc. Still what you can do (with reasonable effort) depends a bit on the Linux Distro you run. Also in many default setups you have a /boot parition and a ESP partition, in your case you just folded both into one. In my case I don't have a boot parition and could as far as I know tweak my system not not have a /boot folder at all as it's not really used, it's just not worth the effort to do so.
- encryptluks2 6y ago
  My apologies and thanks for the clarification. I suppose I could see how you'd want to create a hook to create the unified image, in which case /boot or whatever could simply be a directory that holds the non-unified images. I guess the point I was trying to make, is whether you call the partition that holds your unified kernel images /boot or /esp or whatever.. it is still a separate unencrypted partition that most people would associate with a boot partition, whether it is mounted at /boot or /esp.

dathinab 6y ago

/boot is not the same as the efi system partition (ESP), sure you need to copy the signed kernel blob into the ESP but I still wouldn't recommend mounting ESP as /boot if your linux distro allows it. The reason for this are many fold including that Linux assumes /boot is managed by it but the ESP isn't managed by Linux and might contain other EFI compatible programs. Another reason is that you want to make sure only the signed blob is in the ESP and nothing else, but depending on your distro and packages all kind of thinks might be put into /boot. Another reason is the dir structure. /boot is flat but ESP isn't meant to be flat e.g. in my case it's /EFI/<osname>/<efifiles> E.g. my /boot partition contains "initramfs-linux.img", "intel-ucode.img" and "vmlinuz-linux" but my /esp contains only linux-signed.efi which packs the necessary image files, linux kernel, kernel parameters, boot splash screen etc. Still what you can do (with reasonable effort) depends a bit on the Linux Distro you run. Also in many default setups you have a /boot parition and a ESP partition, in your case you just folded both into one. In my case I don't have a boot parition and could as far as I know tweak my system not not have a /boot folder at all as it's not really used, it's just not worth the effort to do so.

encryptluks2 6y ago
My apologies and thanks for the clarification. I suppose I could see how you'd want to create a hook to create the unified image, in which case /boot or whatever could simply be a directory that holds the non-unified images. I guess the point I was trying to make, is whether you call the partition that holds your unified kernel images /boot or /esp or whatever.. it is still a separate unencrypted partition that most people would associate with a boot partition, whether it is mounted at /boot or /esp.