Howto Full disk encryption manjaro and detached header (with keyboard)
This is a howto, from following the arch wiki, on how to encrypt the root partition with LUKS.

I'm using a Pinephone Pro with a keyboard, but you could probably explorer other methods if a keyboard is not available.

The SD card will contain the boot partition and the LUKS header. If it is removed, then there should be no way to access the phone or see what kind of data is present.

The internal eMMC will contain the encrypted LUKS volume.

Boot the phone from Manjaro SD and then fill the eMMC disk with random encrypted data
cryptsetup open --type plain -d /dev/urandom /dev/mmcblk2 to_be_wiped
dd if=/dev/zero of=/dev/mapper/to_be_wiped status=progress

Format the eMMC as an encrypted disk and save our header file
cryptsetup luksFormat /dev/mmcblk2 --header /boot/header.img

I was not able to get LVM to work from the Manjaro SD (2022-03-09). Creating an lvm volume group and volume worked, but after the disk was closed, the LVM volume group would not be detected when it was re-opened. I created a single partition instead.
cryptsetup open /dev/mmcblk2 crypt --header /boot/header.img
mkfs.ext4 /dev/mapper/crypt

Update our initramfs image
Follow the step in to copy and modify the 'encrypt' hook to a custom 'encrypt2' hook to support our detached header and then modify mkinitcpio.conf
HOOKS=(base udev keyboard autodetect keymap modconf block encrypt2 shell filesystems fsck)
Make sure to remove the bootspash-manjaro hook, so that we can see the password prompt.

Copy the system on the sd card to the encrypted partition and resize it to fit the remaining space
dd if=/dev/mmcblk1p2 of=/dev/mapper/crypt bs=4096
resize2fs /dev/mapper/crypt

Update the bootloader to boot our new system.
setenv bootargs loglevel=4 console=tty0 console=${console} earlycon=uart8250,mmio32,0xff1a0000 consoleblank=0 boot=PARTUUID=${uuid_boot} root=/dev/mapper/crypt cryptdevice=/dev/mmcblk2:crypt:header rw rootwait quiet audit=0

Finally build the initramfs and boot.scr
mkinitcpio -P

After reboot, we should have a password prompt and boot into our encrypted system.

The /dev/mmcblk1p2 partition can be wiped and used for something else.

Messages In This Thread
Howto Full disk encryption manjaro and detached header (with keyboard) - by robocone - 03-09-2022, 06:53 AM

Possibly Related Threads…
Thread Author Replies Views Last Post
  Is Manjaro Plasma stable for anyone? projectcato 90 17,977 12-03-2022, 07:22 AM
Last Post: mburns
  using dreemurrs distro; callee cannot hear me after full upgrade. james8880 8 272 12-02-2022, 05:19 PM
Last Post: Ralt
  PinePhone Pro Manjaro Plasma Mobile Beta 13 & No Audio with Phone Calls X0X0X0X0X0 0 176 11-02-2022, 02:09 PM
Last Post: X0X0X0X0X0
  manjaro or arch fox95 1 275 10-19-2022, 07:22 AM
Last Post: mikehenson
  Battery meter slowly reducing under keyboard charger robocone 0 229 09-23-2022, 10:19 PM
Last Post: robocone
  Waydroid on PinePhone Pro PPP (Stock Manjaro Plasma) mhedhli 7 3,054 09-18-2022, 06:54 PM
Last Post: nroth
  OBS Studio on Manjaro Fred Zyphal 0 380 08-06-2022, 08:32 PM
Last Post: Fred Zyphal
  No display on early boot after Manjaro update robocone 0 376 07-07-2022, 05:47 AM
Last Post: robocone
  Latest Manjaro-Phosh and Arch-Phosh won't boot grinzie 6 1,367 07-01-2022, 02:01 PM
Last Post: Chief
  Wrong pin (default manjaro install) senorsmile 5 1,347 06-11-2022, 03:59 PM
Last Post: senorsmile

Forum Jump:

Users browsing this thread: 1 Guest(s)