3

When running under UEFI Secure Boot with a current Linux distribution, "kernel lockdown" will be instated. Multiple kernel messages along the lines of

Lockdown: swapper/0: hibernation is restricted; see man kernel_lockdown.7

may support the interpretation, that hibernation with UEFI Secure Boot is broken - this impression will be supported when reading the majority of Internet sources. This interpretation is wrong, though. That is why the message uses the word "restricted", as opposed to "disabled". It turns out, that patches for signed kernel/memory images to support kernel_lockdown have been developed since approx. 2011.

LUKS encrypting at least the swap space, if not the full HD, can enable hibernation under lockdown, even at a high degree of automation when involving the TPM.

Recommended reading:

Which main stream kernel version enables this? Which of the most professionally maintained distributions have patches in place, that enable hibernation under lockdown, and how can this be activated, then?

The distributions in question could be RHEL and Clones, Debian (and Ubuntu), SLES/OpenSuse, however, it is not my intention to start a discussion what the "most professional" distribution is. If you know a preferably "simple" solution for any large user-base distribution, feel free to answer.

I would like to find out whether something like injecting your own patch as proposed in Patching the kernel to allow hibernation with secure-boot enabled is really necessary on current distributions. I need a distribution-golfing site.

1 Answer 1

4

Meanwhile I can state for OpenSuse 15.3 and 15.4 that this is definitely possible, with a varying degree of comfort, mostly centered around either manual password entry and automatic decryption via cryptographic token.

New Installation (OpenSuse)

Simplest path installation-wise is to select disk encryption and LVM at installation ("Guided Setup"). That will place the root fs and swap on an encrypted LV. The kernel will still spit out the "hibernation is restricted" messages, however the kernel seems to detect that swap is encrypted and will suspend to disk, e.g., with

systemctl hibernate

you have to ensure though, that at least your RAM size fits on swap, although, as long as most of your RAM is used for buffers and caches, the written image will be a lot smaller than your RAM size. On a GUI (KDE tested), you will be offered a "Sleep" and "Hibernate" button.

Modify Existing System

I have also been able to configure a pre-installed system with an encrypted swap without LVM. This should be quite distribution agnostic. However, note, that this does provide limited protection, as long as your root is not encrypted. You most likely will be able to hibernate under secure boot, at least.

  1. create base swap partition (e.g. /dev/sdaX) with gdisk. Partition type dm-crypt (8308)

  2. format base partition

cryptsetup luksFormat -y -v --type luks2 /dev/sdaX

  1. enter encryption password

  2. open an unencrypted device

cryptsetup luksOpen /dev/sdaX cr_swap

  1. My /etc/crypttab was not created by cryptsetup in this case, so I had to enter (get fs uuid from lsblk -d -o uuid /dev/sdaX):

cr_swap UUID=[fs UUID of /dev/sdaX] none x-initrd.attach

  1. format swap

mkswap /dev/mapper/cr_swap

  1. note UUID of cr_swap

lsblk -o name,type,uuid

  1. update /etc/fstab with following line

UUID=[UUID of cr_swap] swap swap defaults 0 0

  1. Test swap

swapon -a swapon -s

  1. in GRUB2 Boot Loader, add the kernel parameter resume=/dev/disk/by-uuid/[UUID of cr_swap]

  2. ensure the initrd is updated (e.g., resume module has to be present!)

dracut -f

  1. Perform reboot and try hibernation.

You may be able to check whether your encrypted swap is detected:

fwupdmgr security --force

which should output somewhere:

✔ Linux kernel lockdown:         Enabled
✔ Linux swap:                    Encrypted
✔ fwupd plugins:                 Untainted

Result

There is room for improvement, though.

  • The Opensuse system with LVM from option one will ask you for the disk password. Twice. (GRUB2+initrd)

  • The second version should have systemd ask you for the swap password at boot time. Once.

  • Using a TPM or FIDO2 device may let you decrypt your disk without a password, however, this is another story.

11
  • In New Installation (OpenSuse), both the physical volume and the swap logical volume are encrypted, right? If the swap logical volume is not encrypted would it still be possible to hibernate?
    – cidra
    Commented Oct 19, 2023 at 10:27
  • 1
    @cidra You have to create an encrypted LV (LVM) and place at least root and swap inside of that. You have to enter a password every time you boot - that includes wake-up from hibernation. You may enroll a decryption key with the TPM to get rid of this restriction.
    – AlexK973
    Commented Oct 29, 2023 at 19:04
  • I have root and swap in an encrypted LV but when I try to "sudo systemctl hibernate" I get 'Sleep verb "hibernate" not supported'. I'm using TumbleWeed. However, despite having system-swap in the encrypted LV, fwupdmgr says that I have unencrypted swap.
    – cidra
    Commented Oct 30, 2023 at 16:42
  • I have tested the described solution for Leap 15.3 and .4 (and partly .5). No Tumbleweed, here. (Limited spare time, sorry.) Did you follow the fresh installation path, or did you modify your existing system? Difficult to diagnose via comment.
    – AlexK973
    Commented Oct 31, 2023 at 10:31
  • No worry, it was just for the record. I got a fresh install with LVM and LUKS1, then i converted to LUKS2. Nothing else. Physical volume is encrypted and contains system-swap, system-root and system-home.
    – cidra
    Commented Nov 2, 2023 at 13:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .