And what about when a notebook is encrypted? [LWN.net]

And what about when a notebook is encrypted?

Posted Sep 18, 2018 18:40 UTC (Tue) by derobert (subscriber, #89569)
In reply to: And what about when a notebook is encrypted? by mageta
Parent article: Fedora reawakens the hibernation debate

You don't even need an unencrypted /boot; just Grub. Grub gets updated a lot less frequently than the kernel, so if you need to do something special (e.g., sign it so you can use secure boot with your own keys), much less work.

So you can have:

/dev/sda1 EFI system partition / BIOS boot area (depending on if using EFI boot)
/dev/sda2 LUKS → LVM → /boot, /, swap, etc.

and Grub knows how to ask for the LUKS passphrase, decrypt it, find the LV for / or /boot and load the kernel and initramfs from that. It then boots the initramfs, which can have a keyscript or file on it (since, remember, the initramfs is encrypted) which lets the initramfs open the LUKS volume, set up LVM and (at least on Debian) resume from hibernate to that encrypted swap. This setup does require a little bit of config file editing; Debian-Installer will not set it up for you (mainly, it doesn't know the set the flag in the Grub config to enable LUKS) — other than that, it leaves you with an enter-passphrase-twice setup, then you set up a keyscript or file to fix that.

My experience with hibernation is it just works, though that's on Debian. Which, as noted, uses a different initramfs system.

to post comments

And what about when a notebook is encrypted?

Posted Sep 23, 2018 22:27 UTC (Sun) by rra (subscriber, #99804) [Link] (3 responses)

> My experience with hibernation is it just works, though that's on Debian. Which, as noted, uses a different initramfs system.

Yeah, same here. I was very surprised by the assertion in the article that hibernate is largely unsupported and unreliable, since it just works for me and has for years on various different laptops. But this is with Debian.

That said, it's good to know that the kernel upstream is focusing primarily on suspend, since I was only using hibernate on a mild general principle of not using up power that I didn't need to use up. Maybe I'll experiment with using suspend instead for a while.

And what about when a notebook is encrypted?

Posted Sep 24, 2018 16:45 UTC (Mon) by cavok (subscriber, #33216) [Link]

I am a very happy user of s2both, provided by swsusp if I'm not wrong. It writes the state to ram and disk. It even warns if you pickup the wrong kernel after a power interruption while suspended-hibernates. It resists to corruption/loss even in case of "different machine" (my Debian 9 lives/suspends/hibernates on an external usb3 ssd).

And what about when a notebook is encrypted?

Posted Sep 24, 2018 22:42 UTC (Mon) by mstone_ (subscriber, #66309) [Link] (1 responses)

it's basically luck of the hardware. it's been years since I successfully hibernated a debian system.

And what about when a notebook is encrypted?

Posted Nov 22, 2018 12:36 UTC (Thu) by m_a_s (guest, #128777) [Link]

Same here. I eventually migrated to Fedora because of this.