Arch Linux

Enable auto-decrypt for LUKS encrypted boot drive (Btrfs) with TPM 2.0

• Install the necessary tools: sudo pacman -S tpm2-tss tpm2-tools
• Identify the LUKS partition (the one with FSTYPE as crypto), and note down its NAME and UUID: lsblk -f
• Enroll the TPM keyslot: sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/<NAME>
• Open /etc/mkinitcpio.conf, and fine the HOOKS=(...) line. Within the braces, replace udev with systemd, and encrypt with sd-encrypt.
• Open /etc/default/grub, and find the line GRUB_CMDLINE_LINUX="...". Look for cryptdevice=<UUID>=...:root, and replace it with rd.luks.name=<UUID>=root root=/dev/mapper/root
• Regenerate and reboot:

  sudo mkinitcpio -P
  sudo grub-mkconfig -o /boot/grub/grub.cfg