Arch Linux dual secure boot with Windows 11

secure boot
encrypted root Arch Linux partition
Windows 11 with bitlocker on C partition
enable TPM2

Download Arch Linux and Windows 11 ISO

Arch Linux ISO: https://archlinux.org/download/ Windows 11 ISO: https://www.microsoft.com/software-download/windows11

Create bootable usb drive

Prepare at least 8 GiB flash drive Download ventoy: https://www.ventoy.net/en/index.html

For those that already have Arch Linux installed, install ventoy-bin^AUR Before plug in your usb drive, view all available drive fisrt

$ lsblk

Then, plug in your usb drive and once again view the available drive

$ lsblk

A new drive should appear, for example /dev/sda1.

NAME                      MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
sda                         8:64   1  14.9G  0 disk
└─sda1                      8:66   1  14.9G  0 part
nvme0n1                   259:0    0 465.8G  0 disk
└─nvme0n1p1               259:1    0 465.8G  0 part

Install ventoy on /dev/sda

Disable Windows 11 hardware check

Copy the ISOs to /dev/sda1

Install Windows 11

Boot into UEFI, choose ventoy. Select Windows 11 ISO Allocate 250 GiB for Windows Proceed to installation Reboot

Install Arch Linux

Boot into UEFI, choose ventoy. Select Arch Linux ISO

Create EFI and root partition

$ lsblk

nvme0n1                   259:0    0 465.8G  0 disk
├─nvme0n1p1               259:1    0   100M  0 part
├─nvme0n1p2               259:2    0    16M  0 part
├─nvme0n1p3               259:3    0 243.4G  0 part
└─nvme0n1p4               259:4    0   633M  0 part

# cgdisk /dev/nvme0

Format EFI partition

# mkfs.fat -F32 -n EFI /dev/nvme0n1p5

Encrypt root partition

# crypsetup luksFormat /dev/nvme0n1p6

Open the encrypted root partition

# cryptsetup open /dev/nvme0n1p6 crypt_root

Format the encrypted root partition

# mkfs.btrfs -L ArchOS /dev/mapper/crypt_root

Mount the encrypted root partition

# mount /dev/mapper/crypt_root /mnt

Create BTRFS subvolume

# btrfs su cr /mnt/@
# btrfs su cr /mnt/@home
# btrfs su cr /mnt/@snapshots

Unmount the encrypted root partition

# umount -R /mnt

Mount the encrypted root partition with specific option

# mount -o noatime,space_cache=v2,ssd,discard=async,subvol=@ /dev/mapper/crypt_root /mnt

Create directories

# mkdir /mnt/{boot,home,.snapshots}

Mount the EFI partition

# mount /dev/nvme0n1p5 /mnt/boot

Mount home and .snapshots directory

# mount -o noatime,space_cache=v2,ssd,discard=async,subvol=@home /dev/mapper/crypt_root /mnt/home
# mount -o noatime,space_cache=v2,ssd,discard=async,subvol=@snapshots /dev/mapper/crypt_root /mnt/.snapshots

Edit pacman configuration

# vim /etc/pacman.conf

Edit the following content

# Misc options
UseSyslog
Color
ILoveCandy
#NoProgressBar
CheckSpace
VerbosePkgLists
ParallelDownloads = 10

Refresh pacman mirrorlist

# reflector --save /etc/pacman.d/mirrorlist --protocol https --sort rate --latest 5 --thread 12

Pacstrap

# pacstrap /mnt linux linux-headers linux-firmware base base-devel btrfs-progs amd-ucode bash-completion zsh zsh-completions git neovim

Generate fstab

# genfstab -U /mnt > /mnt/etc/fstab

Copy pacman configuration and mirrorlist

# cp /etc/pacman.conf /mnt/etc/pacman.conf
# cp /etc/pacman.d/mirrorlist /mnt/etc/pacman.d/mirrorlist

ch-root into /mnt

# arch-chroot /mnt /bin/zsh

Set root password

# passwd

Change root shell

# chsh -s /bin/zsh

Create user

useradd -mG wheel -s /bin/zsh <your_username>

Change user password

passwd <your_username>

Add wheel groups into sudoers

export EDITOR=nvim
visudo

## Uncomment to allow members of group wheel to execute any command
%wheel ALL=(ALL:ALL) ALL

Set locale and timezone edit /etc/locale.gen uncomment your locale, for example

en_SG.UTF-8

locale-gen

edit /etc/locale.conf, and insert your locale

LANG=en_SG.UTF-8

Set hostname

edit /etc/hostname

<your_hostnaem>

Set hosts edit /etc/hosts

# <ip-address>	<hostname.domain.org>	<hostname>
127.0.0.1	localhost
::1		localhost
127.0.1.1	$HOSTNAME.localdomain	$HOSTNAME

Configure mkinitcpio

edit /etc/mkinitcpio.conf

MODULES=(btrfs)
BINARIES=(/usr/bin/btrfs)
HOOKS=(base systemd autodetect keyboard modconf block sd-encrypt filesystems fsck)

sudo mkinitcpio -P

Install essential packages

Install bootloader

bootctl --boot-path /boot install

Create default boot entries ROOT_UUID=blkid -s UUID -o value /dev/disk/by-partlabel/ArchOS

blkid -s UUID -o value /dev/nvme0n1p6 >> /boot/loader/entries/arch.conf
blkid -s UUID -o value /dev/nvme0n1p6 >> /boot/loader/entries/arch.conf

edit /boot/loader/entries/arch.conf

title Arch Linux
linux /vmlinuz-linux
initrd /amd-ucode.img
initrd /initramfs-linux.img
options rd.luks.name=$ROOT_UUID=crypt_root rd.luks.options=ROOT_UUID=discard root=/dev/mapper/crypt_root rootflags=subvol=@ rw quiet

Edit loader configuration, /boot/loader/loader.conf

default arch.conf
editor no
timeout 10
console-mode max

Copy Windows EFI

mkdir /tmp/win_boot
mount /dev/nvme0n1p1 /tmp/win_boot
mkdir /boot/EFI
cp /tmp/win_boot/EFI/Microsoft /boot/EFI

View bootloader status

bootctl status

Configure network

sudo paru -S networkmanager dialog wpa_supplicant
sudo systemctl enable NetworkManager

Secure boot

Enable setup mode for secure boot in UEFI Install sbctl

sudo pacman -S sbctl

Check sbctl status

sbctl status

Create keys

sudo sbctl create-keys

Enroll Microsoft keys

sudo sbctl enroll-keys -m

Verify keys

sudo sbctl verify

Sign keys

sudo sbctl sign -s /boot/efi/BOOT/BOOTX64.EFI
sudo sbctl sign -s /boot/vmlinuz-linux
sudo sbctl sign -s /boot/efi/systemd/systemd-bootx64.efi
sudo sbctl sign -s /boot/efi/Microsoft/Boot/bootmgfw.efi
sudo sbctl sign -s /boot/efi/Microsoft/Boot/bootmgr.efi
sudo sbctl sign -s /boot/efi/Microsoft/Boot/memtest.efi

Create bunldes

sudo sbctl bundle -s -a /boot/amd-ucode.img -l /usr/share/systemd/bootctl/splash-arch.bmp -c /proc/cmdline -k /boot/vmlinuz-linux -f /boot/initramfs-linux.img /boot/EFI/Linux/linux.efi
sudo sbctl bundle -s -a /boot/amd-ucode.img -l /usr/share/systemd/bootctl/splash-arch.bmp -c /proc/cmdline -k /boot/vmlinuz-linux -f /boot/initramfs-linux-fallback.img /boot/EFI/Linux/linux-fallback.efi

Sign bundles

sudo sbctl sign -s /boot/efi/Linux/linux.efi
sudo sbctl sign -s /boot/efi/Linux/linux-fallback.efi

View secure boot status

sbctl status

Reboot into UEFI, enable secure boot.

Test pacman post install hook Install linux kernel

TPM2

View TPM2 device

systemd-cryptenroll --tpm2-device=list

Enroll TPM2 keys

sudo systemd-cryptenroll --tpm2-device=/path/to/tpm2_device --tpm2-pcrs=0+7 /dev/nvme0n1p6

Edit boot loader entry,

sudo nvim /boot/loader/entries/arch.conf

options rd.luks.name=$ROOT_UUID=crypt_root rd.luks.options=$ROOT_UUID=tpm2-device=auto,discard root=/dev/mapper/crypt_root rootflags=subvol=@ rw quiet

Post-installation

Paru

sudo pacman -S rustup
rustup default stable
git clone https://aur.archlinux.org/paru-bin.git
cd paru-bin
makepkg -si
cd ..
rm -rf paru-bin

Snapper

Firewall

Fonts

sudo paru -S noto-fonts noto-fonts-cjk noto-fonts-emoji noto-fonts-extra nerd-fonts-jetbrains-mono

Window manager

sudo paru -S qtile

Display manager

sudo paru -S lighdm lightdm-gtk-greeter
sudo systemctl enable lightdm

Terminal emulator

sudo paru -S alacritty

Japanese input

Samba

sudo paru -S samba
sudo curl "https://git.samba.org/samba.git/?p=samba.git;a=blob_plain;f=examples/smb.conf.default;hb=HEAD" -o /etc/samba/smb.conf

edit /etc/samba/smb.conf

[global]
workgroup = MYGROUP
server string = Samba Server
server role = standalone server
log file = /usr/local/samba/var/log.%m
max log size = 50
dns proxy = no 
mangled names = no

[Some name]
comment = Some description
path = /some/path
browsable = yes
writeable = yes
create mask = 0700
directory mask = 0700
read only = no
guest ok = no

Create samba user

sudo pdbedit -au $USER_NAME

Enable samba service

sudo systemctl enable --now smb.service

Nvidia

sudo paru -S nvidia-dkms nvidia-settings

edit /etc/mkinicpio.conf

MODULES=(... nvidia nvidia_modeset nvidia_uvm nvidia_drm ..)

sudo mkinitcpio -P

avoid screen tearing

nvidia-settings --assign CurrentMetaMode="nvidia-auto-select +0+0 { ForceFullCompositionPipeline = On }"
sudo nvidia-xconfig
sudo mv /etc/X11/xorg.conf /etc/X11/xorg.conf.d/20-nvidia.conf

edit /etc/X11/xorg.conf.d/20-nvidia.conf

Section "Device"
        Identifier "NVIDIA Card"
        Driver     "nvidia"
        VendorName "NVIDIA Corporation"
        BoardName  "GeForce GTX 1050 Ti"
EndSection

Section "Screen"
    Identifier     "Screen0"
    Device         "Device0"
    Monitor        "Monitor0"
    Option         "ForceFullCompositionPipeline" "on"
    Option         "AllowIndirectGLXProtocol" "off"
    Option         "TripleBuffer" "on"
EndSection

ZSH

Audio

sudo paru -S pipewire pipewire-alsa pipewire-pulse pipewire-jack

Pacman mirror

sudo paru -S reflector
sudo systemctl enable reflector.service
sudo systemctl enable reflector.timer

edit /etc/xdg/reflector/reflector.conf

# Set the output path where the mirrorlist will be saved (--save).
--save /etc/pacman.d/mirrorlist
# Select the transfer protocol (--protocol).
--protocol https
# Use only the  most recently synchronized mirrors (--latest).
--latest 5
# Sort the mirrors by MirrorStatus score
--sort rate

Neofetch

# paru -S neofetch

mpv

# paru -S mpv

Theme Qt GTK

File explorer

Advance cp and mv

# paru -S advcpmv

edit ~/.alias

alias cp="advcp -g"
alias mv="advmv -g"

edit ~/.zshrc

source ~/.alias

Android tools

# paru -S android-tools

HiDPI

Miniconda

# paru -S miniconda3
$ conda init zsh
$ source ~/.zshrc
$ conda config --set auto_activate_base false

Browser

# paru -S firefox

Others

Fix clock

# timedatectl set-local-rtc true

vortexavalanche/dual_secure_boot.md