Fedora 30 Aims To Use LUKS2 By Default For Full-Disk Encryption

[RahulSundaram]

Then how is it "full disk encryption"? When I hear that, I assume "everything is encrypted" and not "everything* is encrypted".

* except /boot, good thing you read the fine print.

"Full disk" is typically used as a moniker to differentiate it from per file encryption or home only encryption solutions. Given the lack of support in Grub2, usually distributions leave /boot unencrypted. You just have to accept that compromise or switch to a different bootloader if your system supports it

[darkbasic]

You just have to accept that compromise or switch to a different bootloader if your system supports it

There are no other bootloaders capable of doing so.

[skeevy420]

There are no other bootloaders capable of doing so.

systemd-boot does....but my system doesn't support that....

For GRUB systems, our only real, universal option is Random File System+LUKS+GRUB.

That BTRFS encryption article has me a little excited at the possibility of using a file system native encryption for /boot (the main reason I'm one of those ZFS weirdos is because ZFS removes unnecessary layers by handling what LVM handles, what LUKS handles, etc). I'd love to simplify it to BTRFS+GRUB.

[skeevy420]

"Full disk" is typically used as a moniker to differentiate it from per file encryption or home only encryption solutions. Given the lack of support in Grub2, usually distributions leave /boot unencrypted. You just have to accept that compromise or switch to a different bootloader if your system supports it

SUSE doesn't leave /boot unencrypted. GRUB & /boot become their own LVM+LUKS partition that's separated from the rest. Given the limitations (bios/uefi and software), it's an acceptable solution IMHO. I hope Fedora has a similar method as an install option (I do the same thing for my ZFS on Root systems). It's not the same encryption used full disk, but it is full disk encryption (and it should be simple enough to upgrade to LUKS2 whenever/if GRUB supports it).