Using hibernate with LUKS and Secure Boot enabled

English Install/Boot/Login
1

I have enabled LUKS2 encrypted SWAP. I won’t disable Secure Boot because of dual boot with Windows 11 which also needs secure boot and TPM2.0. I wish to enable Hybrid Sleep but now the suspend to disk is not available. I checked the kernel and it has the feature but restricted it. I checked the manual and found that the restriction only happens when SWAP is NOT encrypted because anyone can modify SWAP to add malicious content which might harm the system on wakeup.

I checked Stack Exchange and found this

However, I really have the required features mentioned there, and fwupdmgr only shows the unavailable feature of Encrypted RAM (I am using a laptop and neither AMD Epyc or Intel Xeon is available), and a TAINED kernel. I am using NVIDIA driver but the kernel is still tained before I install the kernel modules of nvidia, but the tained code is 4096 all the time.

Fine, that really should not matter. The question is, with the encrypted SWAP large enough and secure boot enabled, the hibernate feature is available in Leap as the website says, but not Tumbleweed. Have I missed anything?

My SWAP consists of a half-ram-size ZRAM using zstd compression with higher priority, and a SWAPFILE encrypted. They should be working just fine.

My kernel is just the default provided. I also tried lts kernel and no difference. I wish the Hybrid Sleep should be available as I wish a longer battery usage.

Thanks if anyone has ideas.

2

Which manual? Kernel has no idea whether swap is or is not encrypted. Kernel just sees a block device.

Hybernation is disabled in Tumbleweed kernel when Secure Boot is active. It is as simple as that. Leap (at least, until 15.6) has additional patch that allows generating and storing as UEFI variable a secret key used to encrypt hibernation image; but this patch was rejected upstream and is not present in Tumbleweed.

3

https://man7.org/linux/man-pages/man7/kernel_lockdown.7.html

Unencrypted hibernation/suspend to swap are disallowed as the kernel image is saved to a medium that can then be accessed.

And there are lots of websites and people saying that they successfully enabled hibernate with a encrypted SWAP.

4

In Fedora it is also working.

5

You can bot WIn11 with Secure boot and TW without enabled Secure boot.

Also

6

You can boot Win11…

7

I know and I am asking about the hibernate but not encryption. Thanks anyway.

8

Seems no solution…