[HowTo] Protect kernels with btrfs when /boot is vfat

Difficulty: ★★★☆☆

In some installs /boot is an extra partition, which also is used for UEFI

  1. The size of this partition is too small to hold more than 1 kernel
  2. While Updating, everything is protected through btrfs-snapshots (but not the kernel in /boot)

Move the kernels to btrfs

  • To be able to do full rollbacks including the kernels.
  • without a change on any of the partitions (because of the UUID)
  • To be able to boot the same way as it boots now

This all can be done in the running system, but if something goes wrong, it is handy to have a backup, and a live-USB ready :wink:

To move the kernels into btrfs it is only necessary to change the mountpoint of the BOOT-partition, so it becomes a EFI-partition.

The following must be done as root

sudo su -

We unmount the partition

umount /boot

In /etc/fstab change the mountpoint of the vfat-partition with the editor of your choice (nano, mc, vim, …) from /boot to /boot/EFI

UUID=A2E3-0A6F		/boot	vfat		rw,...

becomes

UUID=A2E3-0A6F		/boot/EFI	vfat		rw,...

then reload fstab

systemctl daemon-reload 

create the new mountpoint

mkdir /boot/EFI

and remount the EFI-Partition

mount /boot/EFI

Now the file grub.cfg would be in the wrong place. It has to be in /boot/grub/grub.cfg but now is in /boot/EFI/grub/grub.cgf. To make grub.cfg show up in the right place we only need a symbolic link

ln -sr /boot/EFI/grub /boot/grub

The kernels are now in /boot/EFI, but have to be in /boot to be bootable
Instead of moving, we install a new kernel. It will be installed to /boot

mhwd-kernel -i linux515

The kernel and the initramdisks have to show up in /boot. If this works, you are able to reboot.

Cleanup

Then after a reboot you can delete the kernel and initrd from /boot/EFI/

rm /boot/EFI/initram*.img
rm /boot/EFI/*.kver
rm /boot/EFI/vmlinuz-*

DONE

Do not forget to now add a second kernel :smiling_face_with_three_hearts:

:footprints:

I have previously been informed by @Aragorn that it is much more preferable to use:

sudo su -

or

su -

…instead.

2 Likes

P.S. This is a follow Up to

Why not simply either of these?:thinking:

  • sudo -i
  • sudo -s