I’ve been trying to set up hibernation on my laptop while also maintaining an encrypted root partition and swap using secure boot and my laptop’s TPM. I’ve documented the steps I’ve followed below, but I still am unable to enable hibernation.
I was under the impression that the only reason you can’t normally have both an encrypted harddrive and hibernation was because swap had to be encrypted as well, but if both the root partition and the swap are encrypted, I’m using UEFI secure boot, and they are automatically decrypted at boot using the TPM, shouldn’t that relieve those security concerns?
After completing the below, entering systemctl hibernate errors saying hibernation is not set up for the system. Am I missing something or is it just not possible? I can confirm not needing to enter passwords for my swap or root FS due to the TPM unlock.
My personal documentation below:
Drop into root shell
sudo su -
Setup LUKS encryption with automatic unlock with TPM
Install necessary components, regenerate initramfs and reboot
dnf install -y clevis clevis-luks clevis-dracut clevis-udisks2 clevis-systemd
dracut -fv --regenerate-all && systemctl reboot
Identify swap and root partition devices, names, and luks UUIDs…
lsblk -f
cryptsetup luksUUID <UUID>
In my case, my home partition is on /dev/nvme0n1p4 and my swap is /dev/nvme0n1p3
# the encrypted home partition
clevis luks bind -d /dev/nvme0n1p4 tpm2 '{"pcr_ids":"1,4,5,7"}'
# the encrypted swap
clevis luks bind -d /dev/nvme0n1p3 tpm2 '{"pcr_ids":"1,4,5,7"}'
Set a timeout before the system asks for a password, to allow time for the TPM to load and enter the password for you
systemctl edit systemd-ask-password-plymouth.service
Add the below then ctrl+o ctrl+x to save and exit
[Service]
ExecStartPre=/bin/sleep 10
Create a dracut configuration file to install the systemd-ask-password-plymouth service: vi /etc/dracut.conf.d/systemd-ask-password-plymouth.conf
Add the below, ensure there are spaces inside the quotation marks on either side of the filename
install_items+=" /etc/systemd/system/systemd-ask-password-plymouth.service.d/override.conf "
Regenerate initramfs and reboot
dracut -fv ‐‐regenerate-all && systemctl reboot
Edit crypttab file (/etc/crypttab)to specify decryption of swap file at boot, duplicate the already present line for your root FS crypttab entry and change the UUIDs to reflect the swap file, use cryptsetup luksUUID /dev/nvme0n1p3 and cryptsetup luksUUID /dev/nvme0n1p4 to get the luks UUIDs for your root and swap partitions.
<swap LUKS UUID> UUID=<swap UUID> none x-initrd.attach
<root FS LUKS UUID> UUID=<root FS UUID> none x-initrd.attach
Regenerate initramfs and reboot: dracut -fv --regenerate-all && systemct reboot
Edit fstab to include swap, append the following to /etc/fstab:
UUID=<swap UUID> none swap defaults,x-systemd.device-timeout=0 1 1
Rebind your home and swap partitions. You will have to do this every time you update the kernel.
# encrypted home partition
clevis luks regen -d /dev/nvme0n1... -s 1
# encrypted swap
clevis luks regen -d /dev/nvme0n1... -s 1
I actually just did this recently with a BTRFS subvolume using a swap file and LUKS encryption.
The old Fedora magazine article has the overall steps required and someone also made a guide for secure boot on I think the
spiceworksframework forum.The catch is that secure boot will only allow signed images to be loaded which includes the hibernation swap image, meaning you have to use a customized kernel that allows unsigned hibernation images to load.
I’ll share both links when I get a chance.
EDIT:
Fedora Magazine guide: https://fedoramagazine.org/hibernation-in-fedora-36-workstation/
This is slightly outdated as Fedora now uses a proper zram.swap definition with systemd, so you can also do a systemctl edit to disable and enable zram0 with post/pre start on the hibernate service directly instead of using swapon/swapoff. I’ll make a second edit with my example I’ll have to dig out of some poorly documented notes lol.
This is the full forum post guide for FDE + TPM + secure boot. I’m not entirely sure of the kernel patch specific but it seems that the hibernate swap image is technicallly signed because if the bootloader process, but the kernel lockdown mode rejects it regardless by default because there’s no guarantee that the swap image was configured with FDE and not tampered with, which would be a vulnerability.
Quick glance at the kernel patch makes it seem like it’s just a flag check to allow hibernate in lockdown mode, so I assume the secure boot signature check is still completed.
lockdown_hibernate [HIBERNATION] Enable hibernation even if lockdown is enabled. Enable this only if your swap is encrypted and secured properly, as an attacker can modify the kernel offline during hibernation.
Oh awesome I had seen the Fedora Magazine article but not the framework guide. I’ll give that a shot, thank you!
Did you do this ?
Get the UUID of swap partion then add it to boot parameter(resume=UUID=xxxx)
System needs that in grub line so it knows where to put the hibernation stuff, and obviously swap has to be equal or larger than RAM amount.
I asked the same as
resume=should still work in general, but strictly speaking it’s not neccesarry anymore. Modern UEFI systems work without it by saving the information where to locate the saved state in anHibernateLocationEFI variable.No, I’m using UEFI so from what I read on the ArchWiki that’s only needed for older non-UEFI systems
You may me need it for encrypted swap if systems isn’t picking it up via systems automatically.
What does cat /sys/power/resume Show
I don’t have/use TPM, but I do have encrypted swap and hibernation on a fully encrypted drive.
The trick is to put the kernels in the root partition, which is encrypted by LUKS. Then, you can also put a swapfile in that same partition.
The only unencrypted part of my system is
/boot/etfi, which is the EFI partition that holds nothing but the grub binary. Grub configs and kernels are in /boot, which is on the root partition, and encrypted in LUKS.Grub automatically scans hard drives, before prompting with a password to decrypt the root and everything on it. Because grub is doing the decryption, rather than the kernels, the kernels and swapfile are decrypted all at once.
OP seems to use the systemd hooks anyway. And with them all disks get decrypted with the first given password (or at least try and only ask for additional passwords if that fails). So it’s not neccessary anymore to have everything on the root partition. Several encrypted with the same password will do. (For example I unlock a classic swap partition and 3 differently sized disks creating one btrfs raid1 for root with one password.)
Wild guess as I’m not using dracut and have only setup encrypted hibernation on an old bios laptop…
But did you edit the systemd-sleep.conf (usually
/etc/systemd/sleep.conf, although there are some other possible locations)? The other old-school and universal way of telling your system that hibernate is enabled without systemd would be aresume=kernel parameterI did not, looking at my new laptop that file doesn’t even exist, is that something I can just create and add in to folder? On my current computer it exists, so I have a template at the very least.
As of the manpages systemd-sleep looks for:
The main configuration file is loaded from one of the listed directories in order of priority, only the first file found is used:
/etc/systemd/,/run/systemd/,/usr/local/lib/systemd/,/usr/lib/systemd/.Also
The default configuration is set during compilation, so configuration is only needed when it is necessary to deviate from those defaults.
So yes, you can use any existing file from another computer as your template (root:root 644 would be the default owner/permissions for it).
PS: I tried on my PC and setting
AllowHibernation=noin the config file produced a different “hibernate is disabled by config” error. Only if I remove theresume=<swap location>kernel parameter do I get the “not set up” error you mentioned but I’m not at home and only have my old (encrypted and able to hibernate) bios laptop with me. So I can’t check this for modern UEFI where systemd-sleep should automatically pick a suitable swap space and save the location in an EFI variable without any additional configuration.You can however set the
resume=UUID=<your swap's UUID>kernel parameter anyway. Even the automatic systemd/uefi setup accepts this as a way to manually select a location. So maybe you try that. If your problem is decryption of the swap at startup you should not get an error when initiating the hibernation as you do now but instead get problems when you try to restart from swap.
Why binding specifically to PCRs 1,4,5 and 7? Are they immutable even with updates that modify db and dbx (I think I saw one recently drop on Ubuntu)?
You know I’m not 100% sure, I was following another tutorial that I can’t find anymore, but if I remember right 1 was for the UEFI state, 4 was to make sure the bootloader wasn’t changed, 5 was for secure boot, and 7 was for the OS being booted (To make sure someone isn’t booting Kali in a live disk or something), but I could be wrong.
