{"id":1033,"date":"2026-09-21T16:44:29","date_gmt":"2026-09-21T14:44:29","guid":{"rendered":"https:\/\/members.loria.fr\/AScheuer\/?p=1033"},"modified":"2026-09-21T16:44:29","modified_gmt":"2026-09-21T14:44:29","slug":"splitting-ubuntu-encrypted-partition","status":"publish","type":"post","link":"https:\/\/members.loria.fr\/AScheuer\/system\/splitting-ubuntu-encrypted-partition\/","title":{"rendered":"Splitting an Ubuntu encrypted partition"},"content":{"rendered":"

Context<\/h1>\n

When using a laptop, having an encrypted partition is now a security requirement. The simplest way to have one under Ubuntu is to ask for it during the installation. However, the default LVM + encrypted installation only creates one partition, containing both \/<\/code> and \/home<\/code>.<\/p>\n

Objective<\/h1>\n

Having two partitions allows to separate the system (in \/<\/code>) from the configurations and data (in \/home<\/code>). In that situation, any system modification (e.g., an update or an upgrade) operates in a separate partition of the disk, and has nearly no risk to modify your configurations and data.<\/p>\n

It does not mean you don’t have to save them, it just limits the risks of system operations.<\/p>\n

Process<\/h1>\n

Splitting the partition in two has two drawbacks: you cannot do it on your system (you need to run an external one, e.g. on a USB key, as a mounted ext4<\/code> partition cannot be shrank), and it uses some line commands (I did not find any GUI – as e.g. gparted<\/code> – able to do it) which are rarely used.<\/p>\n

As I did not find any help on that process online, I did some mistakes and had to reinstall my system from scratch twice. Reading this page should help you to avoid that!<\/p>\n

Once your system is installed (on an encrypted partition with a single LVM logical volume), you will have to:<\/p>\n

    \n
  1. Start your laptop on an external system, using for example the USB key used to install your system.
    \nThis may require some change in the BIOS (which can prevent a boot on USB).<\/li>\n
  2. Unlock your encrypted partition (but do not decrypt it<\/strong><\/span>, as re-encryption is not possible without data loss), using\n

    sudo<\/a> cryptsetup open<\/a><\/code> <partition_device> <partition_name><\/p>\n

    where <partition_device> is your partition device (\/dev\/<\/code>…, which can be found either using gparted<\/code> or with lsblk<\/a><\/code>), and <partition_name> is the name you choose for the decrypted device. The command will ask for your passphrase.<\/li>\n

  3. Shrink the logical volume containing your system, using\n

    sudo lvresize<\/a> -r -L<\/code> <size> <LV system name><\/p>\n

    where <size> is the desired size of your system logical volume (e.g. 128G<\/code> for 128 GB) and <LV system name> is the name of this logical volume, which can be found using lvs<\/a><\/code>, and is of the form <VG name>\/<\/code><LV name>, i.e. is composed of the name of the volume group and the name of the logical volume in it.<\/p>\n

    This is the action which requires to be on an external system<\/strong>, as the -r<\/code> argument will also ask fsadm<\/a><\/code> to shrink the contained ext4<\/code> partition using resize2fs<\/a><\/code>, which cannot be done on a mounted partition.<\/li>\n

  4. Create the additional logical volume,\u00a0using\n

    sudo lvcreate<\/a> -l 100%FREE -n<\/code> <LV data name> <VG name><\/p>\n

    where <VG name> is the name of the volume group containing your system logical volume (in which you add the new logical volume) and <LV data name> is the name of this new logical volume.<\/p>\n

    You also have to format this logical volume to add an ext4<\/code> partition, using<\/p>\n

    sudo mkfs<\/a> -t ext4 \/dev\/mapper\/<\/code><VG name>-<\/code><LV data name><\/p>\n<\/li>\n

  5. Mount the two partitions (\/<\/code> and \/home<\/code>) and move your data from the home<\/code> directory of the \/<\/code> partition to the \/home<\/code> partition : using two\u00a0tar<\/code>\u00a0allows to keep any special file (as, e.g., symbolic links).<\/li>\n
  6. Update the file system table (etc\/fstab<\/code> in \/<\/code>) to mount the two partitions : you can use \/dev\/disk\/by-id\/dm-name-<\/code><VG name>-<\/code><LV data name> as first parameter, to identify your partitions ; last parameter is 1 for\u00a0\/<\/code> partition and 2 for the \/home<\/code> partition.<\/li>\n<\/ol>\n

    You can then restart your computer normally, and check with df -h \/ \/home<\/code> that system and data are separated.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Context<\/p>\n

    When using a laptop, having an encrypted partition is now a security requirement. The simplest way to have one under Ubuntu is to ask for it during the installation. However, the default LVM + encrypted installation only creates one partition, containing both \/ and \/home.<\/p>\n

    Objective<\/p>\n

    Having two partitions allows to separate the system (in \/) from the configurations and data (in \/home). In that situation, any system modification (e.g., an update or an upgrade) operates in a separate partition of the disk, and has nearly no risk to modify your configurations and data.<\/p>\n

    It does not mean you don’t have to save them,<\/p>\n","protected":false},"author":105,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[],"class_list":["post-1033","post","type-post","status-publish","format-standard","hentry","category-system"],"_links":{"self":[{"href":"https:\/\/members.loria.fr\/AScheuer\/wp-json\/wp\/v2\/posts\/1033","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/members.loria.fr\/AScheuer\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/members.loria.fr\/AScheuer\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/members.loria.fr\/AScheuer\/wp-json\/wp\/v2\/users\/105"}],"replies":[{"embeddable":true,"href":"https:\/\/members.loria.fr\/AScheuer\/wp-json\/wp\/v2\/comments?post=1033"}],"version-history":[{"count":12,"href":"https:\/\/members.loria.fr\/AScheuer\/wp-json\/wp\/v2\/posts\/1033\/revisions"}],"predecessor-version":[{"id":1045,"href":"https:\/\/members.loria.fr\/AScheuer\/wp-json\/wp\/v2\/posts\/1033\/revisions\/1045"}],"wp:attachment":[{"href":"https:\/\/members.loria.fr\/AScheuer\/wp-json\/wp\/v2\/media?parent=1033"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/members.loria.fr\/AScheuer\/wp-json\/wp\/v2\/categories?post=1033"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/members.loria.fr\/AScheuer\/wp-json\/wp\/v2\/tags?post=1033"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}