How to get gui for disk decryption?

For that to work you need an unencrpyted /boot such as Fedora has. However, separating out /boot will make rebooting into a snapshot much less practical since the kernel and initramfs will no longer be part of your snapshot. This means that if you restore a snapshot with a different kernel version you will also have to chroot in and re-install the kernel version which matches your modules.

In this case, you need to choose between the aesthetics and the functionality of easy snapshot recovery and decide which you want to prioritize more.

There is a slight increase in security by having an encrypted /boot but it isn’t something everyone will care about. Basically your initramfs becomes unencrypted which lets a sophisticated attacker with physical access to your machine gain access to information about your system. They can then use this information to aid in an attack against the encryption.

6 Likes