5

If I installed Ubuntu on an encrypted ext4 partition, I normally have a /swapfile. Now I would expect that the swapped memory is also encrypted by default. However, the man-page of swapon says:

The swap file implementation in the kernel expects to be able to write to the file directly, without the assistance of the filesystem.

Now it remains ambiguous what "directly" means and, in particular, whether the encryption layer above the ext4 is considered a "filesystem" in that sense. A priori, I cannot exclude the possibility that the kernel first simply obtains the location of the swapfile on the disk and then directly writes to the disk, without using the encryption layer, such that memory data ends up being on the disk unencrypted.

Is my suspicion true (for which Linux versions)? If not, please provide a source, which directly addresses this question; not just one of many instructions on the Internet how to setup a swap file on an encrypted partition. Thank you!

5
  • How exactly is it encrypted? The way I've always read that is that swap files bypass the filesystem (by asking the filesystem for the block locations of the swap file), but not other underlying layers. (Like LVM, or mdadm RAID, or network block devices, encryption, or whatever. It'd need support from those layers to be able to bypass them anyway.) Though if you want to be sure, you may need to test it.
    – ilkkachu
    May 8, 2022 at 19:00
  • How to find out what is used for encryption? Probably luks? But I am not an expert on that. lsblk -f only says crypto 2.
    – Kolodez
    May 8, 2022 at 19:24
  • I don't see any good that would ever come from bypassing the block device driver. usually the block device driver is responsible for understanding how to talk to a physical device [sata hd/nvme hd/usb stick/floppy disk]. There's no way the code for swapping memory reimplemented this. Then knowing that virtual block devices exist [zram,lvm,luks], there would still be no reason to try to bypass them especially where there may be no physical device backing it [zram].
    – Philip Couling
    May 8, 2022 at 19:25
  • So the way I read that quote, the Kernel bypasses the filesystem. Using a swapfile instead of a swap partition cannot offer any features of the filesytem.
    – Philip Couling
    May 8, 2022 at 19:28
  • Right, if it's ext4 on a LUKS device, then I seriously doubt the swap driver could bypass the encryption. And well, file-level encryption might well be incompatible with swap files, but I can't be sure. (There's stuff like eCryptfs and fscrypt, of which I know very little.) Also I can't actually_prove_ having LUKS there would encrypt the swapped-out data.
    – ilkkachu
    May 8, 2022 at 19:31

1 Answer 1

Reset to default
5

Is swapped memory encrypted on encrypted partitions?

If the partitions are encrypted through a block device (LUKS, dm-crypt etc.), then yes.

A priori, I cannot exclude the possibility that the kernel first simply obtains the location of the swapfile on the disk and then directly writes to the disk

That is nearly what the kernel does; the kernel doesn’t write directly to the disk, it writes to the block device. In effect, a swap file should be considered as reserving blocks on the device hosting the file system; other file system features can’t be relied upon.

When a swap file is added, the kernel maps all the blocks it uses on the underlying block device. Once that’s done, reads from and writes to the swap file are done by directly addressing the underlying block device; the kernel’s VFS layer isn’t involved.

Practical consequences of this include that any file system-based encryption isn’t usable. However, the underlying block device doesn’t have to be a physical device, so a swap file in a file system hosted in a volume which is encrypted as a whole will work fine (and be encrypted). So Ext4 encryption won’t work, but LUKS will.

See also How do I set up an encrypted swap file in Linux? (but note that the information there isn’t all applicable to current kernels).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .