Encrypting asahi linux installation

howto.md

Outline

• Install Asahi
• Add cryptsetup into initrd
• Make initrd spawn a shell before mounting disk
• Reencrypt the partition in-place
• Configure grub and rebuild initramfs to open LUKS device during startup.
• Cleanup

Steps

Install Asahi

Just curl https://alx.sh | sh and follow the prompts. Move on to the next step once you boot into Asahi.

Reconfigure initrd

Add crypt dracut module

echo 'add_dracutmodules+=" crypt "' >/etc/dracut.conf.d/crypt.conf

Add cryptsetup and dependencies

cat >/etc/dracut.conf.d/cryptsetup.conf <<EOF
# cryptsetup binary
install_items+=" /usr/sbin/cryptsetup "

# cracklib because cryptsetup checks the password using it
install_items+=" /usr/share/cracklib/* "
EOF

Make dracut stop before mounting root - edit the GRUB_CMDLINE_LINUX_DEFAULT entry in /etc/default/grub:

• remove rhgb and quiet
• add rd.break=pre-mount to it.

Rebuild the initrd

dracut -f

All should be set now, reboot away.

reboot

In the initrd

Hopefully the boot process should stop and you should be able to log in as root.

Follow https://davidalger.com/posts/fedora-asahi-remix-on-apple-silicon-with-luks-encryption/ starting from "Shrink the btrfs filesystem to make room for the LUKS header."

The arch-chroot utility is not available in the initrd, but we can work around that. Assuming you have your fedora partition mounted under $FEDORA_MNT you can do the following:

mount --bind /dev $FEDORA_MNT/dev
mount --bind /sys $FEDORA_MNT/sys
mount -t proc none proc

$FEDORA_MNT/usr/sbin/chroot $FEDORA_MNT bash

Cleanup

Edit the GRUB_CMDLINE_LINUX_DEFAULT entry in /etc/default/grub to not include rd.break=pre-mount and add back the previously removed options (rhgb and quiet).

Drop the things we previously added to the initrd

rm /etc/dracut.conf.d/cryptsetup.conf

Rebuild initrd and regenerate grub config once more

grub2-mkconfig -o /boot/grub2/grub.cfg
dracut -f

Thanks for the awesome guide. Tested and it works fine. No need to boot from USB anymore.

Some random minor comments:

User "root" has to be unlocked and password set before you boot into emergency mode otherwise you will see an error "Cannot open access to console, the root account is locked".

passwd -u root
passwd

Font on emergency console by defauilt is way to small to read. You may need to run this to double font size:

setfont -d

You can setup any test key during initial setup with "--force-password" and change it into more secure later (when you have normal terminal):

cryptsetup reencrypt --encrypt --reduce-device-size 32M --force-password /dev/nvme0n1p6

Encryption of 1TB take ~11 min

Change the password

cryptsetup luksAddKey /dev/nvme0n1p6
# Reboot and test new passphrase works (new keyslot will be used. 
# Be carefull to be sure if all special / symbol keys works as you may expect in early terminal
cryptsetup luksKillSlot /dev/nvme0n1p6 1

Good tips all around, thank you.

Font on emergency console by defauilt is way to small to read. You may need to run this to double font size:

Yeah, that's definitely better than squinting real hard just like I did