[Bug 1773457] Re: Full-system encryption needs to be supported out-of-the-box including /boot and should not delete other installed systems

[JRT]

Any updates on this? This is really critical in my opinion. My user
case:

- I work in a large, 1st rank university.

- Unfortunately, moronic administration decides that the default system
is mac, or if specific programs needed Windows, for laptops (we have
RedHat desktop PCs though).

- However, our IT has a tradition of allowing people to drift their own
laptops, and they used to say yes to letting us be roots and buying what
we wanted to dual boot Windows / Ubuntu. We do need windows in my group,
so the only option is dual boot Windows / Ubuntu.

- Since the option to have encrypted Ubuntu at installation side by side
with Windows in just one click has disappeared, we have had an epidemic
of people techies enough to use Ubuntu, but not techies enough to
understand / care about encryption etc, installing non-encrypted Ubuntu
on the side of windows. IT has learnt about it, and was furious (this is
a violation of the IT agreement we sign together with our work contract
since it is a clear security breach), and has now forbidden people to
install ubuntu / drift university laptops on their own.

- This means that we more or less cannot use Ubuntu any more until the
one click encryption side-by-side with windows is back, and IT gets cool
again. Really annoying. People either need to buy a separate laptop, and
/ or stop having ubuntu and move to mac.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to ubiquity in Ubuntu.
https://bugs.launchpad.net/bugs/1773457

Title:
  Full-system encryption needs to be supported out-of-the-box including
  /boot and should not delete other installed systems

Status in grub2 package in Ubuntu:
  Confirmed
Status in ubiquity package in Ubuntu:
  Confirmed

Bug description:
  In today's world, especially with the likes of the EU's GDPR and the
  many security fails, Ubuntu installer needs to support full-system
  encryption out of the box.

  This means encrypting not only /home but also both root and /boot. The
  only parts of the system that wouldn't be encrypted are the EFI
  partition and the initial Grub bootloader, for obvious reasons.

  It should also not delete other installed systems unless explicitly
  requested.

  On top of this, the previous method of encrypting data (ecryptfs) is
  now considered buggy, and full-disk encryption is recommended as an
  alternative. Unfortunately, the current implementation of full-disk
  encryption wipes any existing OS such as Windows, making the
  implementation unusable for most users.

  Now, using LUKS and LVM, it is already possible to have full-disk
  encryption (strictly, full-partition encryption because it leaves any
  existing OS alone), while encrypting /boot. Reference:

  https://help.ubuntu.com/community/ManualFullSystemEncryption

  ... but with one major limitation: Grub is incorrectly changed after
  an update affecting the kernel or Grub, so that a manual Grub update
  is required each time this happens (this is fully covered in the
  linked instructions).

  If the incorrect Grub change is fixed, it should be (relatively)
  simple to support full-system encryption in the installer.

  Further information (2018-08-17):

  The NCSC recommends, "Use LUKS/dm-crypt to provide full volume encryption."
  References:
  • https://blog.ubuntu.com/2018/07/30/national-cyber-security-centre-publish-ubuntu-18-04-lts-security-guide
  • https://www.ncsc.gov.uk/guidance/eud-security-guidance-ubuntu-1804-lts

  **EDIT**
  Refer to comment #47 for an alternative version.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1773457/+subscriptions