Splitting an Ubuntu encrypted partition

scheuer System

Context

When using a laptop, having an encrypted partition is now a security requirement. The simplest way to have one under Ubuntu is to ask for it during the installation. However, the default LVM + encrypted installation only creates one partition, containing both / and /home.

Objective

Having two partitions allows to separate the system (in /) from the configurations and data (in /home). In that situation, any system modification (e.g., an update or an upgrade) operates in a separate partition of the disk, and has nearly no risk to modify your configurations and data.

It does not mean you don’t have to save them, it just limits the risks of system operations.

Process

Splitting the partition in two has two drawbacks: you cannot do it on your system (you need to run an external one, e.g. on a USB key, as a mounted ext4 partition cannot be shrank), and it uses some line commands (I did not find any GUI – as e.g. gparted – able to do it) which are rarely used.

As I did not find any help on that process online, I did some mistakes and had to reinstall my system from scratch twice. Reading this page should help you to avoid that!

Once your system is installed (on an encrypted partition with a single LVM logical volume), you will have to:

  1. Start your laptop on an external system, using for example the USB key used to install your system.
    This may require some change in the BIOS (which can prevent a boot on USB).
  2. Unlock your encrypted partition (but do not decrypt it, as re-encryption is not possible without data loss), using

    sudo cryptsetup open <partition_device> <partition_name>

    where <partition_device> is your partition device (/dev/…, which can be found either using gparted or with lsblk), and <partition_name> is the name you choose for the decrypted device. The command will ask for your passphrase.

  3. Shrink the logical volume containing your system, using

    sudo lvresize -r -L <size> <LV system name>

    where <size> is the desired size of your system logical volume (e.g. 128G for 128 GB) and <LV system name> is the name of this logical volume, which can be found using lvs, and is of the form <VG name>/<LV name>, i.e. is composed of the name of the volume group and the name of the logical volume in it.

    This is the action which requires to be on an external system, as the -r argument will also ask fsadm to shrink the contained ext4 partition using resize2fs, which cannot be done on a mounted partition.

  4. Create the additional logical volume, using

    sudo lvcreate -l 100%FREE -n <LV data name> <VG name>

    where <VG name> is the name of the volume group containing your system logical volume (in which you add the new logical volume) and <LV data name> is the name of this new logical volume.

    You also have to format this logical volume to add an ext4 partition, using

    sudo mkfs -t ext4 /dev/mapper/<VG name>-<LV data name>

  5. Mount the two partitions (/ and /home) and move your data from the home directory of the / partition to the /home partition : using two tar allows to keep any special file (as, e.g., symbolic links).
  6. Update the file system table (etc/fstab in /) to mount the two partitions : you can use /dev/disk/by-id/dm-name-<VG name>-<LV data name> as first parameter, to identify your partitions ; last parameter is 1 for / partition and 2 for the /home partition.

You can then restart your computer normally, and check with df -h / /home that system and data are separated.