Announcement

Collapse
No announcement yet.

Google Working On Linux Encrypted Hibernation Support

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Google Working On Linux Encrypted Hibernation Support

    Phoronix: Google Working On Linux Encrypted Hibernation Support

    Google engineers are working on encrypted hibernation support for the Linux kernel as part of offering strong hibernation support for Google Chromebook usage...

    Phoronix, Linux Hardware Reviews, Linux hardware benchmarks, Linux server benchmarks, Linux benchmarking, Desktop Linux, Linux performance, Open Source graphics, Linux How To, Ubuntu benchmarks, Ubuntu hardware, Phoronix Test Suite

  • #2
    good to see.. I think a lot of people are using unencrypted swap partitions for hibernation

    also be nice to see an easier way to setup the unlocking of an encrypted drive via TPM although I guess this is down to how/if distros offer it

    Comment


    • #3
      I use two partitions on my SSD - a non-encrypted ESP, and a LUKS encrypted partition which contains LVM encrypted volumes, including /boot. One of the LVM volumes is swap. So my hibernate is encrypted.

      I'm obviously ignorant of the benefits of Google's approach here: could someone outline the benefits compared to my set-up?

      Comment


      • #4
        Love to see this change. I already do hibernation to encrypted swap based on TPM but it took a while to figure out. An automatic way to set it up and rejection of resuming from unencrypted snapshot would boost ease of use and confidence.

        Originally posted by gfunk View Post
        an easier way to setup the unlocking of an encrypted drive via TPM
        `systemd-cyrptenroll` might be what you're looking for, for generic partitions. Should be offered by most up-to-date distros

        Comment


        • #5
          Originally posted by Old Grouch View Post
          I use two partitions on my SSD - a non-encrypted ESP, and a LUKS encrypted partition which contains LVM encrypted volumes, including /boot. One of the LVM volumes is swap. So my hibernate is encrypted.

          I'm obviously ignorant of the benefits of Google's approach here: could someone outline the benefits compared to my set-up?
          As already stated in the article, Google wants a hibernation implementation that makes it impossible for malicious userspace to tamper with the kernel itself. Concretely, with your approach (which, coincidentally, I happen to use myself as well), userspace may write a malicious hibernation image which can be used to inject unauthorized code into the kernel on resume.
          Now, malicious userspace already has the potential to do pretty much all damage it may want to (including stealing and/or wiping your data), I'm not convinced of the direct benefits for regular desktop use-cases. An indirect benefit may be that hibernation may finally work with integrity lockdown enabled, which includes by default most distributions on Secure Boot systems.

          Comment


          • #6
            Encrypted hibernation isn't something I ever thought about but it is a good idea.

            Comment


            • #7
              Finally, this was much needed.
              ## VGA ##
              AMD: X1950XTX, HD3870, HD5870
              Intel: GMA45, HD3000 (Core i5 2500K)

              Comment


              • #8
                Originally posted by schmidtbag View Post
                Encrypted hibernation isn't something I ever thought about but it is a good idea.
                A necessity. Try running "strings /dev/your/swap".

                Comment


                • #9
                  They might as well fix unencrypted hibernation first. It literally never ever worked for me.

                  Comment


                  • #10
                    Originally posted by anarki2 View Post
                    They might as well fix unencrypted hibernation first. It literally never ever worked for me.
                    Apparently hibernate to multiple smaller swap devices is a no-go for some reason. Could this be your problem too? Try one large swap device and see if it works for you.

                    http://www.dirtcellar.net

                    Comment

                    Working...
                    X