Arch Linux 安全启动 + Systemd-boot + Btrfs + 全盘加密 + TPM 自动解锁

lsblkCopy

root@archiso ~ # lsblk
NAME  MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
loop0   7:0    0 813.4M  1 loop /run/archiso/airootfs
sda     8:0    0     8G  0 disk
sr0    11:0    1   1.1G  0 rom  /run/archiso/bootmntCopy

export disk="/dev/sda"Copy

wipefs -af $diskCopy

sgdisk --zap-all --clear $diskCopy

partprobe $diskCopy

root@archiso ~ # export disk="/dev/sda"
root@archiso ~ # wipefs -af $disk
root@archiso ~ # sgdisk --zap-all --clear $disk
Creating new GPT entries in memory.
GPT data structures destroyed! You may now partition the disk using fdisk or
other utilities.
The operation has completed successfully.
root@archiso ~ # partprobe $diskCopy

cryptsetup open --type plain -d /dev/urandom $disk targetCopy

dd if=/dev/zero of=/dev/mapper/target bs=1M status=progress oflag=directCopy

cryptsetup close targetCopy

root@archiso ~ # cryptsetup open --type plain -d /dev/urandom $disk target
WARNING: Using default options for cipher (aes-xts-plain64, key size 256 bits) that could be incompatible with older versions.
For plain mode, always use options --cipher, --key-size and if no keyfile is used, then also --hash.
WARNING: Device /dev/sda already contains a 'gpt' partition signature.

WARNING!
========
Detected device signature(s) on /dev/sda. Proceeding further may damage existing data.

Are you sure? (Type 'yes' in capital letters): YES
root@archiso ~ # dd if=/dev/zero of=/dev/mapper/target bs=1M status=progress oflag=direct
8424259584 bytes (8.4 GB, 7.8 GiB) copied, 18 s, 468 MB/s
dd: error writing '/dev/mapper/target': No space left on device
8193+0 records in
8192+0 records out
8589934592 bytes (8.6 GB, 8.0 GiB) copied, 18.3393 s, 468 MB/s
1 root@archiso ~ # cryptsetup close targetCopy

sgdisk -n 0:0:+512MiB -t 0:ef00 -c 0:esp $diskCopy

sgdisk -n 0:0:0 -t 0:8309 -c 0:luks $diskCopy

partprobe $diskCopy

root@archiso ~ # sgdisk -n 0:0:+512MiB -t 0:ef00 -c 0:esp $disk
Creating new GPT entries in memory.
The operation has completed successfully.
root@archiso ~ # sgdisk -n 0:0:0 -t 0:8309 -c 0:luks $disk
The operation has completed successfully.
root@archiso ~ # partprobe $diskCopy

sgdisk -p $diskCopy

root@archiso ~ # sgdisk -p $disk
Disk /dev/sda: 16777216 sectors, 8.0 GiB
Model: VBOX HARDDISK
Sector size (logical/physical): 512/512 bytes
Disk identifier (GUID): 9F19AB5D-08A8-40F7-9FAE-AE36F939123B
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 16777182
Partitions will be aligned on 2048-sector boundaries
Total free space is 2014 sectors (1007.0 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1            2048         1050623   512.0 MiB   EF00  esp
   2         1050624        16777182   7.5 GiB     8309  luksCopy

cryptsetup luksFormat --type luks2 ${disk}2Copy

root@archiso ~ # cryptsetup luksFormat --type luks2 ${disk}2

WARNING!
========
This will overwrite data on /dev/sda2 irrevocably.

Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /dev/sda2:
Verify passphrase:
cryptsetup luksFormat --type luks2 ${disk}2  15.59s user 0.33s system 151% cpu 10.487 totalCopy

cryptsetup open ${disk}2 linuxrootCopy

root@archiso ~ # cryptsetup open ${disk}2 linuxroot
Enter passphrase for /dev/sda2:
cryptsetup open ${disk}2 linuxroot  6.92s user 0.05s system 229% cpu 3.032 totalCopy

mkfs.vfat -F32 -n EFI /dev/sda1Copy

root@archiso ~ # mkfs.vfat -F32 -n EFI /dev/sda1
mkfs.fat 4.2 (2021-01-31)Copy

mkfs.btrfs -f -L linuxroot /dev/mapper/linuxrootCopy

root@archiso ~ # mkfs.btrfs -f -L linuxroot /dev/mapper/linuxroot
btrfs-progs v6.11
See https://btrfs.readthedocs.io for more information.

Performing full device TRIM /dev/mapper/linuxroot (7.48GiB) ...
NOTE: several default settings have changed in version 5.15, please make sure
      this does not affect your deployments:
      - DUP for metadata (-m dup)
      - enabled no-holes (-O no-holes)
      - enabled free-space-tree (-R free-space-tree)

Label:              linuxroot
UUID:               d6e9359c-b5e0-471b-9b6d-4d2c9e8f6caa
Node size:          16384
Sector size:        4096 (CPU page size: 4096)
Filesystem size:    7.48GiB
Block group profiles:
  Data:             single            8.00MiB
  Metadata:         DUP             256.00MiB
  System:           DUP               8.00MiB
SSD detected:       no
Zoned device:       no
Features:           extref, skinny-metadata, no-holes, free-space-tree
Checksum:           crc32c
Number of devices:  1
Devices:
   ID        SIZE  PATH
    1     7.48GiB  /dev/mapper/linuxrootCopy

mount /dev/mapper/linuxroot /mntCopy

btrfs subvolume create /mnt/@
btrfs subvolume create /mnt/@home
btrfs subvolume create /mnt/@cache
btrfs subvolume create /mnt/@log
btrfs subvolume create /mnt/@rootCopy

root@archiso ~ # btrfs subvolume create /mnt/@
btrfs subvolume create /mnt/@home
btrfs subvolume create /mnt/@cache
btrfs subvolume create /mnt/@log
btrfs subvolume create /mnt/@root
Create subvolume '/mnt/@'
Create subvolume '/mnt/@home'
Create subvolume '/mnt/@cache'
Create subvolume '/mnt/@log'
Create subvolume '/mnt/@root'Copy

root@archiso ~ # btrfs subvolume list /mnt
ID 256 gen 10 top level 5 path @
ID 257 gen 10 top level 5 path @home
ID 258 gen 10 top level 5 path @cache
ID 259 gen 10 top level 5 path @log
ID 260 gen 10 top level 5 path @rootCopy

umount /mntCopy

mount -t btrfs -o subvol=@,compress=zstd:1 -m /dev/mapper/linuxroot /mnt
mount -t btrfs -o subvol=@home,compress=zstd:1 -m /dev/mapper/linuxroot /mnt/home
mount -t btrfs -o subvol=@cache,compress=zstd:1 -m /dev/mapper/linuxroot /mnt/var/cache
mount -t btrfs -o subvol=@log,compress=zstd:1 -m /dev/mapper/linuxroot /mnt/var/log
mount -t btrfs -o subvol=@root,compress=zstd:1 -m /dev/mapper/linuxroot /mnt/rootCopy

mount -m /dev/sda1 /mnt/efiCopy

reflector --country China --age 24 --protocol http,https --sort rate --save /etc/pacman.d/mirrorlistCopy

genfstab -U /mnt >> /mnt/etc/fstabCopy

root@archiso ~ # cat /mnt/etc/fstab
# Static information about the filesystems.
# See fstab(5) for details.

# <file system> <dir> <type> <options> <dump> <pass>
# /dev/mapper/linuxroot LABEL=linuxroot
UUID=d6e9359c-b5e0-471b-9b6d-4d2c9e8f6caa /          btrfs      rw,relatime,compress=zstd:1,space_cache=v2,subvol=/@ 0 0

# /dev/mapper/linuxroot LABEL=linuxroot
UUID=d6e9359c-b5e0-471b-9b6d-4d2c9e8f6caa /home      btrfs      rw,relatime,compress=zstd:1,space_cache=v2,subvol=/@home 0 0

# /dev/mapper/linuxroot LABEL=linuxroot
UUID=d6e9359c-b5e0-471b-9b6d-4d2c9e8f6caa /var/cache btrfs      rw,relatime,compress=zstd:1,space_cache=v2,subvol=/@cache 0 0

# /dev/mapper/linuxroot LABEL=linuxroot
UUID=d6e9359c-b5e0-471b-9b6d-4d2c9e8f6caa /var/log   btrfs      rw,relatime,compress=zstd:1,space_cache=v2,subvol=/@log 0 0

# /dev/mapper/linuxroot LABEL=linuxroot
UUID=d6e9359c-b5e0-471b-9b6d-4d2c9e8f6caa /root      btrfs      rw,relatime,compress=zstd:1,space_cache=v2,subvol=/@root 0 0

# /dev/sda1 LABEL=EFI
UUID=AB14-F139       /efi       vfat       rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro 0 2Copy

sed -i -e "/^#"en_US.UTF-8"/s/^#//" /mnt/etc/locale.genCopy

systemd-firstboot --root /mnt --promptCopy

root@archiso ~ # systemd-firstboot --root /mnt --prompt

Welcome to your new installation of Arch Linux!

Please configure your system!

-- Press any key to proceed --
‣ Please enter system keymap name or number (empty to skip, "list" to list options): us
/mnt/etc/vconsole.conf written.

‣ Please enter timezone name or number (empty to skip, "list" to list options): Asia/Shanghai
/mnt: /etc/localtime written

‣ Please enter hostname for new system (empty to skip): arch-tmp
/mnt: /etc/hostname written.Copy

arch-chroot /mnt locale-genCopy

root@archiso ~ # arch-chroot /mnt locale-gen
Generating locales...
  en_US.UTF-8... done
Generation complete.Copy

LANG=en_US.UTF-8Copy

arch-chroot /mnt useradd -G wheel -m adminCopy

arch-chroot /mnt passwd adminCopy

root@archiso ~ # arch-chroot /mnt useradd -G wheel -m admin
root@archiso ~ # arch-chroot /mnt passwd admin
New password:
Retype new password:
passwd: password updated successfullyCopy

echo "admin ALL=(ALL:ALL) ALL" >> /mnt/etc/sudoers.d/adminCopy

MODULES=()

BINARIES=()

FILES=()

HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole sd-encrypt block filesystems fsck)Copy

MODULES=()

BINARIES=()

FILES=()

HOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block filesystems fsck)
HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole sd-encrypt block filesystems fsck)Copy

# mkinitcpio preset file for the 'linux' package

-#ALL_config="/etc/mkinitcpio.conf"
+ALL_config="/etc/mkinitcpio.conf"
ALL_kver="/boot/vmlinuz-linux"

PRESETS=('default' 'fallback')

#default_config="/etc/mkinitcpio.conf"
-default_image="/boot/initramfs-linux.img"
+#default_image="/boot/initramfs-linux.img"
-#default_uki="/efi/EFI/Linux/arch-linux.efi"
-#default_options="--splash /usr/share/systemd/bootctl/splash-arch.bmp"
+default_uki="/efi/EFI/Linux/arch-linux.efi"
+default_options="--splash /usr/share/systemd/bootctl/splash-arch.bmp"

-fallback_config="/etc/mkinitcpio.conf"
-fallback_image="/boot/initramfs-linux-fallback.img"
+#fallback_config="/etc/mkinitcpio.conf"
+#fallback_image="/boot/initramfs-linux-fallback.img"
-#fallback_uki="/efi/EFI/Linux/arch-linux-fallback.efi"
-#fallback_options="-S autodetect"
+fallback_uki="/efi/EFI/Linux/arch-linux-fallback.efi"
+fallback_options="-S autodetect"Copy

# mkinitcpio preset file for the 'linux' package

ALL_config="/etc/mkinitcpio.conf"
ALL_kver="/boot/vmlinuz-linux"

PRESETS=('default' 'fallback')

#default_config="/etc/mkinitcpio.conf"
#default_image="/boot/initramfs-linux.img"
default_uki="/efi/EFI/Linux/arch-linux.efi"
default_options="--splash /usr/share/systemd/bootctl/splash-arch.bmp"

#fallback_config="/etc/mkinitcpio.conf"
#fallback_image="/boot/initramfs-linux-fallback.img"
fallback_uki="/efi/EFI/Linux/arch-linux-fallback.efi"
fallback_options="-S autodetect"Copy

mkdir -p /mnt/efi/EFI/LinuxCopy

arch-chroot /mnt mkinitcpio -PCopy

root@archiso ~ # arch-chroot /mnt mkinitcpio -P
==> Building image from preset: /etc/mkinitcpio.d/linux.preset: 'default'
==> Using configuration file: '/etc/mkinitcpio.conf'
  -> -k /boot/vmlinuz-linux -c /etc/mkinitcpio.conf -U /efi/EFI/Linux/arch-linux.efi --splash /usr/share/systemd/bootctl/splash-arch.bmp
==> Starting build: '6.12.1-arch1-1'
  -> Running build hook: [base]
  -> Running build hook: [systemd]
  -> Running build hook: [autodetect]
  -> Running build hook: [microcode]
  -> Running build hook: [modconf]
  -> Running build hook: [kms]
  -> Running build hook: [keyboard]
  -> Running build hook: [sd-vconsole]
  -> Running build hook: [sd-encrypt]
==> WARNING: Possibly missing firmware for module: 'qat_420xx'
  -> Running build hook: [block]
  -> Running build hook: [filesystems]
  -> Running build hook: [fsck]
==> Generating module dependencies
==> Creating zstd-compressed initcpio image
  -> Early uncompressed CPIO image generation successful
==> Initcpio image generation successful
==> Creating unified kernel image: '/efi/EFI/Linux/arch-linux.efi'
  -> Using cmdline file: '/etc/kernel/cmdline'
  -> Using cmdline file: '/etc/cmdline.d/root.conf'
==> Unified kernel image generation successful
==> Running post hooks
  -> Running post hook: [sbctl]
Secureboot key directory doesn't exist, not signing!
==> Post processing done
==> Building image from preset: /etc/mkinitcpio.d/linux.preset: 'fallback'
==> Using configuration file: '/etc/mkinitcpio.conf'
  -> -k /boot/vmlinuz-linux -c /etc/mkinitcpio.conf -U /efi/EFI/Linux/arch-linux-fallback.efi -S autodetect
==> Starting build: '6.12.1-arch1-1'
  -> Running build hook: [base]
  -> Running build hook: [systemd]
  -> Running build hook: [microcode]
  -> Running build hook: [modconf]
  -> Running build hook: [kms]
==> WARNING: Possibly missing firmware for module: 'ast'
  -> Running build hook: [keyboard]
==> WARNING: Possibly missing firmware for module: 'xhci_pci_renesas'
  -> Running build hook: [sd-vconsole]
  -> Running build hook: [sd-encrypt]
==> WARNING: Possibly missing firmware for module: 'qat_420xx'
  -> Running build hook: [block]
==> WARNING: Possibly missing firmware for module: 'aic94xx'
==> WARNING: Possibly missing firmware for module: 'bfa'
==> WARNING: Possibly missing firmware for module: 'qed'
==> WARNING: Possibly missing firmware for module: 'qla1280'
==> WARNING: Possibly missing firmware for module: 'qla2xxx'
==> WARNING: Possibly missing firmware for module: 'wd719x'
  -> Running build hook: [filesystems]
  -> Running build hook: [fsck]
==> Generating module dependencies
==> Creating zstd-compressed initcpio image
  -> Early uncompressed CPIO image generation successful
==> Initcpio image generation successful
==> Creating unified kernel image: '/efi/EFI/Linux/arch-linux-fallback.efi'
  -> Using cmdline file: '/etc/kernel/cmdline'
  -> Using cmdline file: '/etc/cmdline.d/root.conf'
==> Unified kernel image generation successful
==> Running post hooks
  -> Running post hook: [sbctl]
Secureboot key directory doesn't exist, not signing!
==> Post processing done
arch-chroot /mnt mkinitcpio -P  25.02s user 26.74s system 110% cpu 46.944 totalCopy

root@archiso ~ # ls -lR /mnt/efi
/mnt/efi:
total 4
drwxr-xr-x 3 root root 4096 Dec  7 04:51 EFI

/mnt/efi/EFI:
total 4
drwxr-xr-x 2 root root 4096 Dec  7 04:52 Linux

/mnt/efi/EFI/Linux:
total 170064
-rwxr-xr-x 1 root root  30520832 Nov 29 21:43 arch-linux.efi
-rwxr-xr-x 1 root root 143618560 Nov 29 21:43 arch-linux-fallback.efiCopy

arch-chroot /mnt bootctl install --esp-path=/efiCopy

root@archiso ~ # arch-chroot /mnt bootctl install --esp-path=/efiCopy

root@archiso ~ # ls -lR /mnt/efi
/mnt/efi:
total 8
drwxr-xr-x 5 root root 4096 Dec  7 05:00 EFI
drwxr-xr-x 3 root root 4096 Dec  7 05:00 loader

/mnt/efi/EFI:
total 12
drwxr-xr-x 2 root root 4096 Dec  7 05:00 BOOT
drwxr-xr-x 2 root root 4096 Dec  7 04:52 Linux
drwxr-xr-x 2 root root 4096 Dec  7 05:00 systemd

/mnt/efi/EFI/BOOT:
total 104
-rwxr-xr-x 1 root root 105472 Nov 29 21:43 BOOTX64.EFI

/mnt/efi/EFI/Linux:
total 170064
-rwxr-xr-x 1 root root  30520832 Nov 29 21:43 arch-linux.efi
-rwxr-xr-x 1 root root 143618560 Nov 29 21:43 arch-linux-fallback.efi

/mnt/efi/EFI/systemd:
total 104
-rwxr-xr-x 1 root root 105472 Nov 29 21:43 systemd-bootx64.efi

/mnt/efi/loader:
total 16
drwxr-xr-x 2 root root 4096 Dec  7 05:00 entries
-rwxr-xr-x 1 root root    6 Dec  7 05:00 entries.srel
-rwxr-xr-x 1 root root   30 Dec  7 05:00 loader.conf
-rwxr-xr-x 1 root root   32 Dec  7 05:00 random-seed

/mnt/efi/loader/Copy

sync
systemctl rebootCopy