Setting up disk encryption with Asahi Linux. #

Disk encryption is very important for devices like laptops that could be easily stolen. I really hope Asahi integrates disk encryption into the installer or first-time setup in the future. But for now, this guide should help you get things set up.

It's not too difficult, but I could probably improve the instructions for less technical people. If you need help understanding something, feel free to comment.

Warning

Follow these steps at your own risk, I am not responsible for any damage. Be careful and have backups of important data. I've only tested this on one device, so it may be different for you. This should be a good starting point to figure it out though.

Install the OS you want and run first-time setup: curl https://alx.sh | sh
Boot back into macOS and install the minimal version of asahi in a new 16gb partition: curl https://alx.sh | sh
Boot into the new temporary partition and run setup
Log in and connect to wifi: nmcli device wifi connect --ask {SSID}
Clone asahi-encrypt: sudo dnf install git && git clone https://github.com/osx-tools/asahi-encrypt.git && cd asahi-encrypt/bin
Get the partition of the target install: ./asahi-encrypt -l
Encrypt the disk: ./asahi-encrypt {device_path}
Boot into the target OS and verify the encryption worked: systemctl poweroff
(optional) Boot back into macOS and remove the tempoary partition (follow the next section)

Removing the temporary partition (optional) #

Find the partitions to erase with diskutil list. You're looking for something like this:

/dev/disk3 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +2.5 GB     disk3
                                 Physical Store disk0s3
   1:                APFS Volume Fedora Linux Recover... 1.9 MB     disk3s1
   2:                APFS Volume Fedora Linux Recovery   1.3 MB     disk3s2
   3:                APFS Volume Preboot                 193.3 MB   disk3s3
   4:                APFS Volume Recovery                806.5 MB   disk3s4

Also note the 3 partitions that follow the virtual disk ID in the real disk:

/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk0
   1:             Apple_APFS_ISC Container disk1         524.3 MB   disk0s1
   2:                 Apple_APFS Container disk5         481.3 GB   disk0s2
   3:                 Apple_APFS Container disk3         2.5 GB     disk0s3
   4:                        EFI EFI - FEDOR             524.3 MB   disk0s4
   5:           Linux Filesystem                         1.1 GB     disk0s5
   6:           Linux Filesystem                         11.9 GB    disk0s6
   7:                 Apple_APFS Container disk2         2.5 GB     disk0s7
   8:                        EFI EFI - FEDOR             524.3 MB   disk0s8
   9:           Linux Filesystem                         1.1 GB     disk0s9
  10:           Linux Filesystem                         493.2 GB   disk0s10
  11:        Apple_APFS_Recovery Container disk4         5.4 GB     disk0s11

In this case, look for the partitions that follow Apple_APFS Container disk3 since the virtual disk was /dev/disk3.

You'd want to note down the following lines in this case:

   3:                 Apple_APFS Container disk3         2.5 GB     disk0s3
   4:                        EFI EFI - FEDOR             524.3 MB   disk0s4
   5:           Linux Filesystem                         1.1 GB     disk0s5
   6:           Linux Filesystem                         11.9 GB    disk0s6

Important

Replace the IDs with the ones you found in the previous steps. If you're unsure, please comment and don't try to continue. Saving 16GB of space isn't worth accedentally deleting your data and requiring recovery.

Now remove the APFS partition and free the linux partitions:

diskutil apfs deleteContainer disk{ID}
diskutil eraseVolume free free disk0s{PARTITION_ID} (in this case disk0s4)
diskutil eraseVolume free free disk0s{PARTITION_ID} (in this case disk0s5)
diskutil eraseVolume free free disk0s{PARTITION_ID} (in this case disk0s6)

Expand the macOS partition back into the free space:

diskutil apfs resizeContainer /dev/disk{MACINTOSH_HD_ID} 0

Note

It's normal for the device to freeze at this point, just wait for it to finish resizing.

Finally, verify everything looks correct: diskutil list

Troubleshooting #

If booting into the target OS fails after step 8:

reboot again
select the first kernel version entry in GRUB
you should get a password prompt now
unlock the disk and log in
note the default kernel version entry with sudo grubby --default-kernel (e.g. 7.1.13-402.asahi.fc44.aarch64+16k)
rebuild initramfs with sudo dracut -f --kver={version}

I hope this helps you! Feel free to comment if you need help ❤️