So after using a Fedora/Macbook for a while, I got a new work laptop. This time I opted for the Dell XPS 15 with all the bells and whistles1. It has received great reviews and has been compared to the quality of the Macbook Pro’s.
Installing a UNIX distro is always time-consuming and depending on your desires, the configuration varies a lot. This applies especially to bare-bones distros like Arch Linux: It only provides a compiled kernel and a minimal set of system components (systemd). Rest of the system layout you have to devise yourself.
The overall layout of the final Arch Linux system will be:
- UEFI for the boot-system
- GPT for the partition table
- LUKS for full-disk encryption
- LVM for managing volumes on top of LUKS
- root and home logical volumes (ext4) and a swap volume
- systemd-boot for the boot manager
- Booting up Arch Linux
- Partitioning: UEFI, GPT and ESP
- Disk encryption: LUKS
- Volume management: LVM
- Install Arch Linux
- Boot manager: systemd-boot
Booting up Arch Linux
My favorite way of booting up a Linux distro is just writing the ISO image to a USB drive.
This is fast and efficient. The USB drive is ready to be booted from. ‘Nuff said.
If the system does not detect the bootable USB drive, try disabling Secure Boot if you have UEFI enabled. Extra note regarding the NVMe-based SSD drive: I had to change SATA configuration to AHCI (not RAID) from BIOS to get it visible as a block device.
Alternatively, you can check out a way of PXE booting Arch Linux from my previous blog post.
Partitioning: UEFI, GPT and ESP
First, wipe the hard disk. This is important for enhancing the security of the disk encryption, since if the disk is full of random data, info about it is harder to deduce:
Now, make sure you have booted with UEFI:
Since we zeroed out the main disk, we need to install a partition table to it. GPT is the recommended approach with UEFI:
Next, we’ll set up the EFI System Partition (ESP) and the main root partition:
Disk encryption: LUKS
Several methods for achieving full disk encryption are available. I chose to use LUKS (dm-crypt), since it is pretty standard and performant in Linux. LUKS utilizes block device encryption, meaning that it operates below the filesystem and everything written to the device is guaranteed to be encrypted. LUKS also adds ease-of-use into the key management.
Utilizing full disk encryption is no panacea - you will still be vulnerable to e.g. cold boot attack2, bootloader malware and all other sorts of nasty things. And in the end, if your system is compromized while the disk encryption is unlocked, it is absolutely of no help at that point. I am planning a separate blog post on hardening the boot process.
Encrypt your root partition. Choose a strong passphrase (I prefer the diceware3 method). Also notice, that cryptsetup requires an uppercase ‘yes’ for confirmation. :-)
Volume management: LVM
The Arch Linux wiki puts it more concisely than I ever could:
Logical Volume Management utilizes the kernel’s device-mapper feature to provide a system of partitions independent of underlying disk layout. With LVM you abstract your storage and have “virtual partitions”, making extending/shrinking easier (subject to potential filesystem limitations).4
In other words, it just makes your life easier. I chose the method of using the Logical Volume Manager (LVM) on top of the LUKS-encrypted partition5. No real reason as to why, just that it seemed to be the most simple and robust choice. The major disadvantage of it is that the LVM cannot be used to span multiple physical volumes. For a laptop, this shouldn’t be that much of a problem, however.
Let’s now create the Physical Volume (pv) and Logical Volumes (lv’s) for the main partition layout (swap, root, home):
Install Arch Linux
Now it is time to install Arch Linux to our root partition.
First, mount your boot partition that we made earlier:
Now let’s install the Arch base system with
Other configuration, comments inlined:
Then, configure and regenerate a new initial ramdisk environment:
Boot manager: systemd-boot
systemd-boot is a boot manager for UEFI systems. It only operates on ESPs and EFI-configured images. The project was previously known as ‘gummiboot’, but was merged into systemd in May 20156.
The kernels we boot with systemd-boot have to be configured with
CONFIG_EFI_STUB enabled. This allows the UEFI firmware to act as a bootloader and start the kernel, without needing a separate boot loader such as GRUB. Luckily, the Arch Linux kernels have already been configured so.
After that, you should have a folder
/boot/loader/entries. Add the following boot entry file there:
initrd /intel-ucode.img is the microcode for Intel processors - if you have one, install the
Now you can exit the chroot (
exit) and reboot. If all went well, you should be asked to unlock the root partition’s encryption and be awarded with a login shell.
In the next post, I’ll describe the steps to configure a straightforward userspace setup for Arch Linux.