View source for Full disk encryption secure boot

{{Draft}}

This guide is to explain step by step how to setup Alpine Linux with Full Disk Encryption using LUKS2, /boot & / together on the same partition, encrypted swap for hibernation on a nvme drive, with UEFI & Secure Boot.
The goal of this guide is to follow the KISS principle, lvm can be added, another file system can be used, multiple partitions for /home; /var/log etc.. can also be added, if running everything in one partition is not meeting your requirements.

= Sequence of Events =

* Installing packages
* Partitioning the disk
* Configuring LUKS
* Mounting points and File System
* Installing Alpine
* mkinitfs settings & modules
* Grub settings
* Configuring Secure Boot

= Installing packages =

To facilitate the partitioning we will use gdisk :
<pre># apk add lsblk gptfdisk</pre>

For encryption, we will use cryptsetup :
<pre># apk add cryptsetup</pre>

For using and managing UEFI, multiple packages are needed :
<pre># apk add efibootmgr e2fsprogs grub grub-efi</pre>

= Partitioning the disk =

Let's assume the disk is /dev/nvme0n1 and no partition is present, we will create three partitions :
 
* one for UEFI
* one for /
* one for swap (hibernation)

<pre># gdisk /dev/nvme0n1
GPT fdisk (gdisk) version 1.0.9.1

Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with protective MBR; using GPT.

Command (? for help): d
No partitions

Command (? for help): n
Partition number (1-128, default 1): 
First sector (2048-1000215182, default = 2048) or {+-}size{KMGTP}: 
Last sector (2048-1000215182, default = 1000214527) or {+-}size{KMGTP}: 512M
Current type is 8300 (Linux filesystem)
Hex code or GUID (L to show codes, Enter = 8300): ef00
Changed type of partition to 'EFI system partition'

Command (? for help): n
Partition number (2-128, default 2): 
First sector (1048577-1000215182, default = 1050624) or {+-}size{KMGTP}: 
Last sector (1050624-1000215182, default = 1000214527) or {+-}size{KMGTP}: 16G
Current type is 8300 (Linux filesystem)
Hex code or GUID (L to show codes, Enter = 8300): 8200
Changed type of partition to 'Linux swap'

Command (? for help): n
Partition number (3-128, default 3): 
First sector (1048577-1000215182, default = 33556480) or {+-}size{KMGTP}: 
Last sector (33556480-1000215182, default = 1000214527) or {+-}size{KMGTP}: 
Current type is 8300 (Linux filesystem)
Hex code or GUID (L to show codes, Enter = 8300): 8309
Changed type of partition to 'Linux LUKS'

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): Y
OK; writing new GUID partition table (GPT) to /dev/nvme0n1.
The operation has completed successfully.
</pre>

= Configuring LUKS =

<pre># cryptsetup -v -c aes-xts-plain64 -s 512 --hash sha512 --pbkdf pbkdf2 --iter-time 5000 --use-random luksFormat /dev/nvme0n1p2

WARNING!
========
This will overwrite data on /dev/nvme0n1p2 irrevocably.

Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /dev/nvme0n1p2: 
Verify passphrase: 
Key slot 0 created.
Command successful.

cryptsetup -v -c aes-xts-plain64 -s 512 --hash sha512 --pbkdf pbkdf2 --iter-time 5000 --use-random luksFormat /dev/nvme0n1p3

WARNING!
========
This will overwrite data on /dev/nvme0n1p3 irrevocably.

Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /dev/nvme0n1p3: 
Verify passphrase: 
Key slot 0 created.
Command successful.
</pre>

= Mounting points and File System =

Open the LUKS partitiond we just created:
<pre># cryptsetup luksOpen /dev/nvme0n1p2 nvme0n1p2-crypt
# cryptsetup luksOpen /dev/nvme0n1p3 nvme0n1p3-crypt
</pre>

Create vfat file system for UEFI partition:
<pre># mkfs.vfat /dev/nvme0n1p1</pre>

Create ext4 file system for swap partition:
<pre># mkfs.ext4 /dev/mapper/nvme0n1p2-crypt</pre>

Create ext4 file system for / partition:
<pre># mkfs.ext4 /dev/mapper/nvme0n1p3-crypt</pre>

Create mounting points and mount partitions :
Mount / partition to /mnt :
<pre># mount -t ext4 /dev/mapper/nvme0n1p3-crypt /mnt</pre>
Create /boot/efi:
<pre># mkdir /mnt/boot/efi -p</pre>
Mount UEFI partition to /mnt/boot/efi :
<pre># mount -t vfat /dev/nvme0n1p1 /mnt/boot/efi</pre>
Activate SWAP:
<pre># mkswap /dev/mapper/nvme0n1p2-crypt
# swapon /dev/mapper/nvme0n1p2-crypt</pre>
Check partition scheme:
<pre># lsblk
NAME                MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
nvme0n1             259:0    0 476.9G  0 disk  
├─nvme0n1p1         259:1    0   511M  0 part  /mnt/boot/efi
├─nvme0n1p2         259:2    0  15.5G  0 part  
│ └─nvme0n1p2-crypt 253:0    0  15.5G  0 crypt [SWAP]
└─nvme0n1p3         259:3    0 460.9G  0 part  
  └─nvme0n1p3-crypt 253:1    0 460.9G  0 crypt /mnt
</pre>

= Installing Alpine =

<pre># setup-disk -m sys /mnt/</pre>

= mkinitfs settings & modules =
Edit the /mnt/etc/mkinitfs/mkinitfs.conf file and append the cryptsetup module to the features parameter (keymap only needed if QWERTY is not used):
<pre>features="...keymap cryptsetup"</pre>
Regenerate the initram:
<pre># mkinitfs -c /mnt/etc/mkinitfs/mkinitfs.conf -b /mnt/ $(ls /mnt/lib/modules/)</pre>

= Grub settings =

Create a crypto_keyfile.bin to avoid typing the passphrase twice during the boot process (one for Grub partition, one for Alpine partition):
<pre># touch /mnt/crypto_keyfile.bin
# chmod 600 /mnt/crypto_keyfile.bin
# dd bs=512 count=4 if=/dev/urandom of=/mnt/crypto_keyfile.bin
# cryptsetup luksAddKey /dev/nvme0n1p3 /mnt/crypto_keyfile.bin
</pre>

Then, let's mount and chroot to our fresh installation:
<pre># mount -t proc /proc /mnt/proc
# mount --rbind /dev /mnt/dev
# mount --make-rslave /mnt/dev
# mount --rbind /sys /mnt/sys
# chroot /mnt
</pre>

Let's show the UUID of our partition scheme:
<pre># lsblk -f</pre>

Edit /etc/default/grub and add a new line starting with GRUB_CMDLINE_LINUX parameter, replacing <UUID> with the UUID of the encrypted partition (in this case /dev/nvme0n1p3):
<pre>GRUB_TIMEOUT=2
GRUB_DISABLE_SUBMENU=y
GRUB_DISABLE_RECOVERY=true
GRUB_CMDLINE_LINUX_DEFAULT="cryptroot=UUID=XXXX cryptdm=nvme0n1p3-crypt cryptkey modules=sd-mod,usb-storage,ext4,nvme quiet rootfstype=ext4"
GRUB_PRELOAD_MODULES="luks cryptodisk part_gpt ext4"
GRUB_ENABLE_CRYPTODISK=y
GRUB_DISABLE_OS_PROBER=y
</pre>

Re-install Grub:
<pre># grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=AlpineLinux --modules="luks2 part_gpt cryptodisk ext2 gcry_rijndael pbkdf2 gcry_sha512"
# grub-mkconfig -o /boot/grub/grub.cfg
</pre>

= Configuring Secure Boot =