Re: Trying to configure hibernate / resume

From	"Andrew M.A. Cater" <amacater@einval.com>
Newsgroups	linux.debian.user
Subject	Re: Trying to configure hibernate / resume
Date	2024-12-01 00:10 +0100
Message-ID	<JOEL7-cRAv-5@gated-at.bofh.it> (permalink)
References	<JOzV7-cOl0-3@gated-at.bofh.it> <JOBWV-cPM6-9@gated-at.bofh.it> <JOCgh-cPSg-3@gated-at.bofh.it> <JODP3-cQWc-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Sat, Nov 30, 2024 at 05:08:29PM -0500, Stefan Monnier wrote:
> > The answer seems to be to install with LVM and encryption. That ensures
> > that the swap area is encrypted and *cannot* be messed with while the
> > device is hibernated (which is the rationale for Secure Boot not allowing
> > hibernation to a "naked" swap partition).
> 
> How does UEFI know about Debian's swap and how does it know whether
> it's encrypted?
> 

Hi Stefan,

Booting via UEFI is orthogonal to Secure Boot.

If SB is *enabled* then certain functions are restricted when considering
what can be done by kernel modules.
.
https://wiki.debian.org/SecureBoot#Secure_Boot_limitations suggests
that one of those may be hibernation/resume.

if you have partitioned "all in one partition" with encrypted KVM,
the ESP is not encrypted but everything else is. The swap partition
is encrypted so cannot be modified outside the control of the modules.

That's how I read it, anyway

All the very best, as ever,

Andy

> 
>         Stefan
>

Thread

Trying to configure hibernate / resume Richmond <dnomhcir@gmx.com> - 2024-11-30 19:00 +0100
  Re: Trying to configure hibernate / resume Richmond <dnomhcir@gmx.com> - 2024-11-30 21:10 +0100
    Re: Trying to configure hibernate / resume "Andrew M.A. Cater" <amacater@einval.com> - 2024-11-30 21:30 +0100
      Re: Trying to configure hibernate / resume Stefan Monnier <monnier@iro.umontreal.ca> - 2024-11-30 23:10 +0100
        Re: Trying to configure hibernate / resume "Andrew M.A. Cater" <amacater@einval.com> - 2024-12-01 00:10 +0100
          Re: Trying to configure hibernate / resume Stefan Monnier <monnier@iro.umontreal.ca> - 2024-12-03 15:30 +0100
      Re: Trying to configure hibernate / resume Anssi Saari <anssi.saari@debian-user.mail.kapsi.fi> - 2024-12-02 12:50 +0100

csiph-web