Unable to install Fedora 42 with LUKS, regardless of whether LUKS1 or LUKS2 is used

Ask Fedora
, ,
1

Hi,

I’ve been trying to install Fedora Workstation 42 with LUKS over the weekend, but I haven’t been able to get it working completely. Upon reboot, I end up in the GRUB emergency shell, regardless of whether I use LUKS1 or LUKS2.

I’m using a custom Btrfs setup with the following partitions:

  • /boot/efi
  • Btrfs

Subvolumes:

  • root → /
  • home → /home
  • pkg → /var/cache/dnf
  • log → /var/log
  • snapshots → /.snapshots

Does LUKS not work in Fedora Workstation 42?

/Isak

2

Aren’t you missing a boot partition mounted at /boot? In case you just forgot to list it here, you cannot easily encrypt /boot as grub2 does understand luks2 with whatever the default key derivation function is.

(Luks works on my F42, though upgraded from f41 (and previous releases).

3

The installer states that /boot is optional, but could it actually be required for LUKS?

I think that can be my mistake that i need /boot outside the ecrypted BTRFS partition. Will test later tonight :slight_smile:

4

I don’t believe that /boot is optional because from what I know grub2 doesn’t talk btrfs, neither luks2.

Yes, that’s how I see it.

5

I tried an reinstall with LUKS2 and with /boot in an nonencrypted partition it worked great. Thanks for the quick help :slight_smile:

6

GRUB does have read support for the Btrfs, LUKS1 and LUKS2 on-disk formats.

The issue here is Anaconda doesn’t support configuring GRUB to unlock the LUKS partition. GRUB has limited internationalization and keyboard encoding support. Next the user would be faced with a minimum of 2 password prompts, and by default there’d be three: bootloader unlock to find and boot the kernel, plymouth unlock to find rootfs and start up the system, and again at desktop login.