With the current methods to implement encryption on LVM volumes, one can not encrypt /boot
. If one did, it would be impossible to boot the operating system unless the hardware on your motherboard supports it. I have not seen or heard of hardware that can do this so far, but it might exist.
From the Archwiki: In most setups, a dedicated /boot partition is not necessary, but it is in a complex setup like this one, because GRUB needs to be able to read the kernel, initramfs, it's own configuration files, etc. from the /boot directory. Since GRUB does not itself know how to unlock a LUKS partition (that's the kernel's job), /boot must not be encrypted, and therefore must be a separate disk partition.
What this means is that in order for your operating system to boot, the bootloader has to be able to read its own configuration settings which it finds in /boot
, and it can not do that if the volume is encrypted. This is true no matter which encryption routine/method you use.
Is this a weakness? Yes. It is possible to install some sort of password sniffer to /boot
, but encrypted LVM was not designed to protect you against this. If you are this much paranoid, then someone getting physical access to your machine or root
access to your system while it is running, will force you to assume you have been compromised.
This might be a wrong conclusion from me, but I think that encryption on LVM partitions are made in the case where you loose your computer or it get stolen. In this case they will have to somehow get your password before they can get access to the content of the drive or manually hack the key, which is, unless the person has unlimited access to resources, impossible.