Hi folks, new poster here, I’m pretty familiar with linux in general for the last 25 yrs and I fell in love with manjaro a few years back. Hands down my favorite distribution right now. Anyhow I have an interesting question…
I’ve locked down my networks with fresh dd-wrt firewalls, new firmware, clean installations of manjaro from verified dvds, updated pgp keys, encrypted my drives with luks, updates, vpn wireguard, etc. etc. etc. I’m trying to create the best network security I can.
Basically my question is: I seem to have a mystery partition on my persistent drives that pops up at the end of them or sometimes the beginning of the partition and it only shows up in KDE partition manager. Usually it starts out at 1mb, and sometimes it grows which is odd to me. I’m trying not to be paranoid here but I’m wondering if it might be some kind of payload from a rootkit.
I manually setup the partitions for this installation:
512mb fat32 /efi/boot flags: /boot
1024mb ext4 /boot encrypted luks
Then I used the rest of the drive space for / root, encrypted with luks
~ sudo fdisk -l 3 ✘
Disk /dev/nvme0n1: 465.76 GiB, 500107862016 bytes, 976773168 sectors
Disk model: WDC WDBA3V5000ANC-WRSN
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 4B0D0077-67E1-4C3B-AF0C-E4927C43B351
Device Start End Sectors Size Type
/dev/nvme0n1p1 2048 1050623 1048576 512M EFI System
/dev/nvme0n1p2 3147776 976768031 973620256 464.3G Linux filesystem
/dev/nvme0n1p3 1050624 3147775 2097152 1G Linux filesystem
Partition table entries are not in disk order.
Disk /dev/mapper/luks-dea8e4a6-f73e-462b-9b5c-bfdf170d2c41: 464.26 GiB, 498491473920 bytes, 973616160 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk /dev/mapper/luks-4c74b132-a513-4fdd-9f11-76688c14573b: 1022 MiB, 1071644672 bytes, 2093056 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Is this mystery 2.49 mb partition that shows up in kde partition manager part of luks and is that normal?
The strangest part is it doesn’t show up in fdisk as shown above. The real curious part is when it its larger on different computers sometimes the mystery partitions show up at the beginning of the drive & the end of the drive and varies in sizes. I’m guessing if its a normal partition for luks it might depend on drive size.
Anyway if that’s a normal thing then great, maybe I’m just overthinking things. If not then what did I do wrong when I setup my partition tables, or am I dealing with something more serious here?
Appreciate any input, thanks!