Yeah i don’t understand why hibernation isn’t allowed with luks2 encryption. I can totally understand that without encryption it’s a massive security hole but with luks2 nothing will go from the disk to ram before unlocking disk on resuming
Because the kernel has no way to authenticate what's on the swap partition when resuming from hibernation.
Lockdown mode is enabled by default when using secure boot because it's an additional security needed to protect the kernel from loading malicious code. With secure boot even root can't load arbitrary kernel modules at boot because they are not signed by the distribution and secure boot will refuse to load the kernel if it's tainted with such modules. But with hibernation, anything running as root on your system can write what it wants to the swap partition and trigger a resume which can in turn load anything into ring 0, because resuming is not a boot and thus bypasses secure boot. Lockdown mode prevents that attack vector.
What's needed to make hibernation/resume works in lockdown mode is a way for the kernel to authenticate that the content of the swap partition has only been written by the kernel to be sure it has not been tampered with, even by root.
Here's a blog post by Matthew Garrett which has worked on Linux UEFI and Secure Boot implementation explaining its origin in more detail: https://mjg59.dreamwidth.org/55845.html
15
u/Moist_Professional64 1d ago
No hibernation with kernel lockdown ðŸ˜