Place the root filesystem on encrypted LVM.
Ensure the bootloader can reach the kernel and initramfs before the complex root environment is available.
Which design is generally useful?
A separate /boot in a bootloader-readable area keeps the kernel and initramfs outside the encrypted or complex root volume when required by the platform.
Detailed explanation
rpm -ql /bin/bashIncorrect. A separate /var helps variable data capacity but does not directly make boot files reachable.
rpm -qf /bin/bashCorrect. A readable /boot can hold initial boot files outside the encrypted root.
rpm -qR /bin/bashIncorrect. A separate /home isolates user data rather than boot files.
rpm -K /bin/bashIncorrect. Swap cannot substitute for an ESP or /boot.
Try it yourself
An example you can run in a temporary verification environment.
rpm -qf /usr/bin/rpmExpected result
rpm-版-リリース等、ファイルを所有する導入済みパッケージKey points
- /boot contains kernel and initramfs
- Early boot needs readable files
- Whether separation is needed depends on the platform
Notes
- Environment: RPM 4.x / ローカルRPM DB
- Use a read-only query or trusted disposable RPM when testing.
- RPM options and signature behavior should be confirmed on the target distribution.
Foundation review
Place the operation
Local ownership lookup differs from repository provider search, which can include uninstalled packages.
Check the side effect
Query a known system file and compare the result with a repository provider query.