How can Linux hibernation be enabled under UEFI Secure Boot with kernel lockdown on OpenSuSE?
8
votes
1
answer
7269
views
(The question was originally asking about all distributions, however I have achieved a result for one distribution, only)
When running under UEFI Secure Boot with a current Linux distribution, "kernel lockdown" will be instated. Multiple kernel messages along the lines of
Lockdown: swapper/0: hibernation is restricted; see man kernel_lockdown.7
may support the interpretation, that hibernation with UEFI Secure Boot is broken - this impression will be supported when reading the majority of Internet sources. This interpretation is _wrong_, though. That is why the message uses the word "restricted", as opposed to "disabled". It turns out, that patches for signed kernel/memory images to support kernel_lockdown have been developed since approx. 2011.
LUKS encrypting at least the swap space, if not the full HD, can enable hibernation under lockdown, even at a high degree of automation when involving the TPM.
Recommended reading:
- https://en.opensuse.org/SDB:LUKS2,_TPM2_and_FIDO2
- https://www.tecmint.com/disk-encryption-in-linux/
Which main stream kernel version enables this? Which of the most professionally maintained distributions have patches in place, that enable hibernation under lockdown, and how can this be activated, then?
The distributions in question could be RHEL and Clones, Debian (and Ubuntu), SLES/OpenSuse, however, it is not my intention to start a discussion what the "most professional" distribution is. If you know a preferably "simple" solution for any large user-base distribution, feel free to answer.
I would like to find out whether something like injecting your own patch as proposed in https://unix.stackexchange.com/questions/693000/patching-the-kernel-to-allow-hibernation-with-secure-boot-enabled is really necessary on current distributions. I need a distribution-golfing site.
Asked by AlexK973
(301 rep)
Jun 4, 2023, 09:38 AM
Last activity: Jul 11, 2024, 07:58 AM
Last activity: Jul 11, 2024, 07:58 AM