Place the root filesystem on encrypted LVM.
Ensure the bootloader can reach the kernel and initramfs before the complex root environment is available.
Which design is generally useful?
A separate /boot in a bootloader-readable area keeps the kernel and initramfs outside the encrypted or complex root volume when required by the platform.
Detailed explanation
rpm -ql /bin/bashIncorrect. A separate /var helps variable data capacity but does not directly make boot files reachable.
Incorrect. A separate /var helps variable data capacity but does not directly make boot files reachable.
rpm -qf /bin/bashCorrect. A readable /boot can hold initial boot files outside the encrypted root.
Correct. A readable /boot can hold initial boot files outside the encrypted root.
rpm -qR /bin/bashIncorrect. A separate /home isolates user data rather than boot files.
Incorrect. A separate /home isolates user data rather than boot files.
rpm -K /bin/bashIncorrect. Swap cannot substitute for an ESP or /boot.
Incorrect. Swap cannot substitute for an ESP or /boot.
Try it yourself
An example you can run in a temporary verification environment.
rpm -qf /usr/bin/rpmExpected result
rpm-版-リリース等、ファイルを所有する導入済みパッケージKey points
- /boot contains kernel and initramfs
- Early boot needs readable files
- Whether separation is needed depends on the platform
Notes
- Environment: RPM 4.x / ローカルRPM DB
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.