I have a Linux setup with an encrypted
/home/<username> (LUKS) and without an initramfs. I currently have an unencrypted swap partition, intended for hibernation. For security reasons, I would like to encrypt my swap. Is this possible without having an initramfs? (All tutorials I Googled on this topic assumed an initramfs.)
Apart from ‘no’, I see three possible options. The first is ideal, the second less so, and the third one is the least attractive:
- Both regular swap and hibernation images are encrypted, a password is requested when resuming after hibernating.
- Both regular swap and hibernation images are encrypted, a password is requested on every boot.
- Only regular swap is encrypted, but not hibernation images, so no password is even requested.
Because my root partition is not encrypted, I have the feeling that conceptually it should be possible to not need an initramfs, as the necessary userspace tools can be made available. This does not mean that it is feasible using the existing kernel and userspace tools, or if it is, that it is practically feasible.
While I am interested in the no-initramfs case, in case that is not (practically) feasible, I am also interested in the minimal-initramfs case. It may be useful to know that I can configure and compile my kernel almost entirely to my own liking. Also, I can create a separate kernel (command line) just for resuming-from-hibernation purposes and select it as appropriate from my boot loader.