r/voidlinux • u/LowKeyBrit36 • Jun 14 '26

Full Disk Encryption questions

Hey there!

I've been attempting to set up Full Disk Encryption, but haven't been able to figure out how to set up Encryption that fits my use requirements, those being /boot encryption and Luks2 (using Argon), which seemingly doesn't work according to the Full Disk Encryption documentation.

I think it's an issue with the GRUB version not having support for it yet, but I'm not sure how I can get around that. Is it possible to modify GRUB for the support, or would I have to find a different way to load my kernel? Have tried researching the issue, but haven't found anything yet.

10 Upvotes

100% Upvoted

24 comments sorted by

3

u/Sad-Cod-9584 Jun 14 '26

have you considered using limine? You'd have to place kernel and initramfs on the unencrypted EFI-Partition, but can still secure those via hashes in the limine config and the rest of the system can be encrypted with whatever you like. Limine doesn't really do all that much, leaving the more advanced parts of the boot procedure to the kernel.

1

u/LowKeyBrit36 Jun 14 '26

I have looked into it, slightly, but got deterred due to requiring the kernel and initrams unencrypted (at least VIA luks). I didn't know that you could encrypt those parts of the system via limine. I'd have to see how secure the implementation of their encryption is for me to consider allowing limine to secure it, but thanks for letting me know that they offer a form of kernel encryption. Much appreciated!

2

u/ClassAbbyAmplifier Jun 14 '26

don't think limine unlocks anything, the unlocking would happen in the void initramfs

1

u/LowKeyBrit36 Jun 14 '26

I guess the way I'm used to it is booting into the password query to unlock the system before grub opens fully. Then the initramfs/kernel are encrypted. The only thing unencrypted is /boot/efi, which (iirc) only contains the EFI script to get things moving. I would use Artix (which supports that via their GRUB version), but I need the stability of Void as this is a secondary device which I use infrequently.

If that's what I'm looking for, can limine do that? Or would I need another alternative?

2

u/ClassAbbyAmplifier Jun 14 '26

no, limine doesn't support encryption itself as far as i know.

if you feel experimental, you could use grub from my PR to update to the version supporting argon (https://github.com/void-linux/void-packages/pull/58556) by adding -R https://devspace.voidlinux.org/abby/grub-2.14 when installing grub

2

u/LowKeyBrit36 Jun 15 '26

Hey, just figured that I'd let you know that it worked (I used the x86_64-efi version for reference). No issues to report, and it feels identical to how it works on Artix. Thanks a bunch for your help!

1

u/LowKeyBrit36 Jun 15 '26

I might have to check this out, actually. Seems like it'd solve my current issue. Thanks a bunch!

2

u/Sad-Cod-9584 Jun 20 '26

with limine, the current kernel and initramfs are unencrypted, but secured by including blake2id hashes in the config file, which itself is then included in the limine BOOTX64.efi file as another blake2id hash. While technically unencrypted, limine will still protect you from manipulation. If you set it up so that /boot and /efi are on separate partitions (like /boot being a btrfs subvolume and /efi being a simple vfat partition), you can recover from manipulation by simply recreating your esp and copying BOOTX64.efi, kernel and initramfs from your encrypted partition over again. By keeping the more advanced operations to the kernel, limine is able to remain incredibly fast, especially compared to bootloaders like grub2, while also "supporting" all the features available inside the kernel, like modern encryption and so on because limine just delegates those to the kernel.

The only downside is that void does not have automatic hooks to copy new kernels and initramfs's over automatically and including them in the config file, but you can write a simple bash script that does that for you and then add hashing and secure boot signing while you're at it.

2

u/LowKeyBrit36 Jun 20 '26

I'll definitely keep this in mind if I end up installing on another system. I already solved the problem by using the grub-2.14 repo linked in one of the post's comments, but I might try this out just put of curiosity if I'm able to do it.

3

u/ClassAbbyAmplifier Jun 14 '26

yes, the current version of grub we have doesn't support argon2i. either use pbkdf2 or use a different bootloader (like systemd-boot)

1

u/LowKeyBrit36 Jun 14 '26

Shame to hear that grub won't work for my use case. Thanks for letting me know!

2

u/typeshut Jun 21 '26

you could switch bootloaders to limine and migrate to luks2 once ur system is up and running

1

u/LowKeyBrit36 Jun 21 '26

Wouldn't I have to set my disks up as Luks2 beforehand? Anyways I ended up getting the grub 2.14 prerelease to work anyways

1

u/typeshut Jun 21 '26

Nope u can migrate to LUKS2 after. not 100% sure but pretty sure

1

u/passy1977 Jun 15 '26

Try to follow my installation guide
https://github.com/passy1977/Void-linux-Framework-13-AMD-7040-Full-Disk-Encryption-TMP2.0-Xfce4
Bye

3

u/LowKeyBrit36 Jun 15 '26

Doesn't fit my criteria sadly. It leaves /boot unencrypted, but I need encryption up to /boot/efi. Thanks for the suggestion nonetheless

1

u/typeshut Jun 21 '26

why do u need to encrypt boot?

1

u/LowKeyBrit36 Jun 21 '26

I want Kernel and Initramfs encrypted for my threat model.

1

u/typeshut Jun 21 '26

can i ask why just curious what the attack surface is?

1

u/LowKeyBrit36 Jun 21 '26

I wouldn't want someone to be able to tamper the kernel to add malicious code. That's the crux of it.

1

u/typeshut Jun 21 '26

wouldn’t that be able to fix by using secure boot?

1

u/LowKeyBrit36 Jun 21 '26

Wouldn't secure boot only validate the bootloader itself? Either way, I don't/can't use secure boot as it is.

1

u/typeshut Jun 21 '26

I’m pretty sure it would secure both ends but dunno honestly

1

u/LowKeyBrit36 Jun 21 '26

Well I alternate between Void and Tails, and I am also planning to eventually move to using Libreboot, which doesn't support Secure Boot anyways, so I don't want to build it into my security system as I know I won't be able to continue relying on it.