Background info: I need my McBook to satisfy a newly-rolled-out policy of having "full disk encryption". The relevant software checks this by seeing if all user-mountable volumes/partitions on internal drives are encrypted, or in the process of becoming such. Checking its debug logs, this includes the VM volume, which is created by the macOS installer.
EDIT: Upon closer inspection, the APFS container actually has (had) two VM volumes - one visible, mounted under /Volumes/VM and another one, not visible to the user, mounted under /System/Volumes/VM - this one seems to be ignored by the policy software, as I initially expected.
I have a few questions regarding this:
- Is it even normal/expected that the VM volume is mountable by the human user? macOS does this thing where "system-essential" partitions/volumes are, among other things, hidden in the GUI disk utility, and not mounted by default - the Recovery, Preboot volumes, the EFI partition, etc. My macOS installation did not start *with a blank disk, and in fact the APFS container used by the Big Sur system is inherited from a Mojave installation. If this volume visibility is not normal, I'd like to know how to revert it back - the software in question does skip over Recovery and Preboot, so it's not completely stupid.
- Is it safe to encrypt this volume? Finder doesn't seem to mind and offers this option just as it does on any other, user-created APFS volume.
diskutil apfs listsays Encypted: No, it also says FileValut: Yes on the sealed volume so that probably counts.