HowTo: Debian GNU/Linux Stretch as Dual Boot on a MacbookPro11,3

Right in time for the WWDC 2017 and the release of Debian 9 Stretch, a quick guide on how you can enrich your Macintosh with a free operating system.

The challenge

Meanwhile older hardware from Cupertino like my Macbook Pro (Late 2013) is well supported by most GNU/Linux distributions. It is not anymore a thrilling adventure to get its components working like it used to be a few years ago. They just work out of the box.

What I still find quite challenging is to choose for and set up a working boot process. My goal is to be able to easily boot GNU/Linux as well as macOS. So this is mainly what this HowTo is all about.

My recipe includes rEFInd as boot manager, without GRUB and relying on the EFI stub loader that is since kernel version 3.3.0 an integral part of it.

Specs

Some details about the used hard- and software.

Model-Identifier: MacBookPro11,3 (Late 2013)
Boot-ROM-Version: MBP112.0138.B25
macOS Version: 10.12.5 “Sierra”
rEFInd Version: 0.10.8
Debian Installer: Debian 9 “Stretch” Release Candidate 4

Prerequisites

Make sure to have the latest macOS and Firmware updates installed.
Make sure to have a recent and complete backup of your files. Seriously.
An Apple Thunderbolt to Gigabit Ethernet Adapter will make things easier as it works out of the box and you do not have to load any additional drivers/firmware during network setup.
Two USB sticks for creating the bootable macOS and Debian installers.
Some experience in installing and working with GNU/Linux in general.

USB Boot/Install Stick Creation

Create a bootable installer for macOS just in case something goes really wrong.
Create a bootable installer for Debian via macOS:
- Download the Debian Stretch RC 4 Mac Netinstaller ISO, e.g. via this URL: debian-mac-stretch-DI-rc4-amd64-netinst.iso
- Create a bootable installer for Debian via Terminal: sudo dd if=debian-mac-stretch-DI-rc4-amd64-netinst.iso of=/dev/diskX bs=1m. DiskX is the assigned disk identifier of your second USB stick that should become the Debian installer. The easiest way to find out is via Disk Utility.
- As soon as the creation process has successfully finished, macOS will probably tell you something about a non-initialized disk and offer you to do so. Ignore it, everything is fine and you should just eject it.

Prepare for Partitioning

I prefer the following partitioning schema on a 512 GB hard disk:

350 GB for macOS
The rest, about 150 GB, for GNU/Linux
- 35 GB as ext4 for /root
- 16 GB for swap
- 8 GB as HFS+ for data exchange between bother OS
- The rest, about 90 GB, as ext4 for /home

To achieve this the following steps are required:

Turn off FileVault disk encryption in case you are using it. Only then you will be able to resize your existing macOS partition to provide some space to GNU/Linux.
Use macOS’s Disk Utility to resize your existing macOS partition. I for myself just added a second one with the envisaged disk space of 150 GB. During the partitioning process of Debian this should then be deleted and replaced by the outlined individual GNU/Linux system partitions.

Installing Debian GNU/Linux 9 “Stretch”

Attach the created Debian installer USB stick and reboot your system while holding down the command key.
The macOS boot manager should come up offering you beside booting macOS an additional option to boot “Windows”. This is actually your Debian installer.
Choose the graphical install method.
Follow the usual installation process with one exception. At the end do not install GRUB. It just won’t be of any use.
For now you will not be able to boot your GNU/Linux. That is as expected. The boot manager rEFInd will take care of that in a minute.

Installing rEFInd Boot Manager

Boot into macOS’s recovery mode. This is required because only then Apple’s SIP can be deactivated to prevent any interference with the rEFInd installation procedure.
Open a terminal and issue the command csrutil disable that will deactivate SIP.
Reboot into macOS. Download the latest binary of rEFInd and unzip it somewhere.
Open a terminal and navigate to the unzipped rEFInd binary.
Execute ./refind-install and carefully check that it completes successfully.
For details please refer to the original documentation: “Installing rEFInd”

Dual Booting

By now you should be able to choose if you want to boot either macOS or even better GNU/Linux. So give it a try and reboot. rEFInd should come up offering you both options. Now let’s continue to finalize things.

Disk Encryption and Reactivation of SIP

Boot into macOS and turn FileVault back on. Ideally wait until background encryption has finished.
Boot back into macOS’s recovery mode and issue the command csrutil enable that will reactivate SIP.
Boot into Debian and activate the transparent encryption for the user’s home folder(s).

Installing missing drivers

Note: You will need to use non-free software to be able to use your Wifi interface or run the official nVidia driver. To do so activate the contrib and non-free packages sources.

Wifi interface (Broadcom BCM4360): Install Broadcom’s binary-only driver via apt-get install broadcom-sta-dkms. (brcm80211 does not work with this specific chip.)
Grahpics card (NVIDIA GeForce GT 750M): In case you are experiencing issues with nouveau or just want to use the official NVIDIA driver you can install it via apt-get install nvidia-driver. Reboot the system afterwards.
To access unencrypted HFS+ volumes like the main macOS partition you could use hfsprogs via apt-get install hfsprogs. As I suggested to turn FileVault back on, the volume is encrypted and naturally not that easily accessible. Still there is an experimental library available that could help you here: libfvde.
Your keyboard back-light is not working? Well, why don’t you just switch it on by using the dedicated function keys?

Open issues

I am still not able to use the keyboard map that corresponds to my built in keyboard. dpkg-reconfigure keyboard-configuration usually helps in choosing the right configuration. service keyboard-setup restart then activates the new configuration.
Proper fan control would be could because it sometimes gets slightly hot.

Trouble shooting

If you think you have messed up somehow the original macOS boot configuration, you could reset your Mac’s NVRAM. Typically macOS becomes bootable again and rEFInd is gone.
A macOS upgrade or re-installation or resetting the NVRAM is said to very likely interfere with your rEFInd boot manager. So the easiest thing is to just re-install it (just rEFInd) as described above. Do not forget to disable SIP during the installation. More details can be found at “Keeping rEFInd Booting”.
In the worst case you still have the bootable macOS installer USB stick and your backup. Don’t you?

History

2017-Jun-07: Initial publication

apfelkraut.org