Setup Manjaro with dual boot and SSD Encryption

setup_manjaro.md

Pre-install

First, I resized the Windows partition using the native Windows disk partition tool. Then, I've disabled the secure boot, so I can boot using the USB drive.

First attempt

This happened probably because the /boot folder was encrypted, and the passphrase happens before grub loads. At this point, the additional keyboard layout is not set up, so I probably typed the wrong password.

After a few seconds (as the grub decryption is slower than the root decryption), I received the following error and was left in the grub rescue state. This behavior is described here.

Workaround

As I'm using dual boot in the same storage device, I naively installed Manjaro entirely within a single encrypted partition by choosing the "Replace partition" option during the partition installation step.

The solution for my use case was to reinstall it by selecting the Manual Partition option, as described here:

• use the EFI partition as it is (without formatting, so Windows boot is kept)
• it should be flagged as boot
• The mount point should be /boot/efi
• create a new partition to contain the root
• It should be flagged as root
• The mount point should be /
• create a new 1024 MB partition to contain Linux boot info (grub data)
• The mount point should be /boot

Despite the installer alert about the lack of an /boot/efi partition with the recommended size (300 MB), the system could boot normally.

Windows boot

During the first Windows boot after the installation, I had to enter the recover key. After that, the boot work just fine.

Useful links

• https://wiki.manjaro.org/index.php/Main_Page
• https://wiki.archlinux.org/title/dm-crypt/System_configuration
• https://wiki.archlinux.org/title/Data-at-rest_encryption#Why_use_encryption?
• https://forum.manjaro.org/t/howto-boot-without-a-password-for-encrypted-root-partition/44684/3

extra

During the investigation, I had to boot with the USB stick a couple of times to check if the grub config files, kernel modules, and encrypted partition were configured correctly.

Decrypt and mount an encrypted partition

$ cryptsetup luksOpen /dev/nvme0n1p7 my_encypted_device
$ mount /dev/mapper/my_encypted_device /mnt

Mount EFI partition

$ mount /dev/nvme0n1p1 /mnt/boot/efi

Chroot to the new installation

$ cryptsetup luksOpen /dev/nvme0n1p7 my_encypted_device
$ mount /dev/mapper/my_encypted_device /mnt
$ manjaro-chroot -a /mnt /bin/zsh

Edit kernel modules

$ vi /etc/mkinitcpio.conf
# do the changes
mkinitcpio -P