Dual Linux System with Whole Disk Encryption

Question

(This is a continuation of my question on Ask Ubuntu.)

My goal is I want to have a Xubuntu/Ubuntu dual boot, with a catch - I want the disk to be fully encrypted with the dm-crypt (native supplied) whole disk encryption. Now I know, out of the box the ubuntu installer is not going to make this simple for me, and maybe this is not doable, because I am not sure I can ultimately trick the tools into creating the two different initrd configurations for each root filesystem.

So questions:

Has anyone done this before and is there a simple way I am missing to do this?

Given (1) is a negative...

1. Should I create separate base encryptedf volumes for each installation (xubuntu/ubuntu) or should I just create 1 encrypted volume and separate install partitions inside it? I am leaning toward the latter to make the process simpler. However I am not sure how the boot loader will handle this.

2. Once I get the first laid in, if I go with 1 encrypted volume, how do I decrypt it and install the second distro (and get the boot loader, initrd, etc updated properly)?

Thank you... Any insight is appreciated.

Answer 1

You should create a single volume if you want the same password(s) to be valid for both installations, or two separate volumes if you want different passwords. In other words, create as many separate volumes as you need separate sets of authorized users.

The kernel and initrd of both installations need to be outside the encrypted volume. From a security perspective, it doesn't matter whether you keep the two /boot volumes separate or not.

If you do trusted boot from a TPM, watch out that the non-primary OS is also integrity-protected; I think in that case you should keep the two installations separate and register them independently with UEFI (but I don't have experience of UEFI to tell you what to watch out for).

Note that you may not need dual boot at all. You may well be able to implement your desired security policy by issuing separate accounts or by creating separate virtualized containers, each with its own root users.

See my answer on AU for the more technical aspects.