How to set a different encrypted boot volume without unlocking

apfsdual-bootencryption

I have two MacOS installs as part of a dual-boot configuration on my MBP. Both happen to be Mojave 10.14. They are installed on two encrypted APFS volumes in the same APFS container.

I want to be able to set the next boot volume without supplying a decrypt password or holding down the option key during reboot. Related, I want the current 'other volume' to be the default volume. The current default is the second MacOS install that I performed.

The troubles I see:

1) Under System Preferences -> Startup Disk is that the decryption password is needed: "It must be unlocked to determine if it is a valid startup disk."
– this can't technically be true. When I hold down the Option key during boot the decryption passwords aren't known at that time yet two volume options are presented.
Startup Disk window screenshot

2) The examples of command-line bless command are based on a volume mounted under /Volumes which of course means the decryption password is made available.

Best Answer

I was able to change the default boot volume which is just a partial resolution of my question. This is done by using an alternate form of the bless command based on an un-mounted storage device. From the intended default volume OS booted:

$ sudo bless --device /dev/disk1s1 --setBoot

(where disk1s1 is the current and intended volume which can be observed from Disk Utility -> Info ) Now the OS that I want to be default boot boots by default.


Unfortunately,

I can't set the next OS to boot from the command line with running from the other partition.

$ sudo bless --device /dev/disk1s5 --setBoot --nextonly
Could not set boot device property: 0xe00002e2

Google search of the error shows similar challenges related to System Integrity Protection (SIP) but to me no clear resolution.