When I moved to Coreboot, I also elected to encrypt my /boot partition, which is decrypted by the GRUB payload of Coreboot. I mostly worked on this by trial-and-error, which resulted in the workflow:

  1. GRUB unlocks /boot
  2. Keyfile in /boot opens /
  3. Partition for /boot is listed in /etc/crypttab, with another keyfile to unlock /boot again from within Linux
  4. /boot is mounted via /etc/fstab

Steps 3 and 4 always seemed inelegant to me, but after doing systemd-analyze, I realized how much those steps consume when booting (9 sec).

My questions:

  • After GRUB unlocks /boot and boots into Linux proper, is there any way to access /boot without unlocking again?
  • Are the keys discarded when initramfs hands off to the main Linux system?
  • If GRUB supports encrypted /boot, was there a ‘correct’ way to set it up?
  • Or am I left with mounting /boot manually for kernel updates if I want to avoid steps 3 and 4?
    • monovergent@lemmy.mlOP
      4·
      3 days ago

      This was the way on my UEFI desktop, but I gave up getting UEFI to work with Coreboot on the X230, so I settled for the next best thing.