Skip to content

Instantly share code, notes, and snippets.

@dawaltconley
Last active November 16, 2023 19:52
Show Gist options
  • Star 7 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save dawaltconley/8cb4c3cfac7da394a58fab363628bf63 to your computer and use it in GitHub Desktop.
Save dawaltconley/8cb4c3cfac7da394a58fab363628bf63 to your computer and use it in GitHub Desktop.
Enabling hibernation with full disk encryption on Pop!_OS 21.04.

Enabling hibernation with full disk encryption on Pop!_OS 21.04.

I am recording the steps I took here to enable hibernation on a default Pop!_OS installation with full-disk encryption. I have written my commands as a single executable script in order to better understand how they all relate, but they probably should not be executed this way. Use this guide with caution and only if you understand what each command does.

I did all of this on Pop!_OS version 21.04, but swapfile hibernation is still working for me as of 22.04. I expect that the following steps will work for that as well, but I haven't tested it.

Using a swapfile

This is the simplest method if you used the default Pop installation, since it does not involve resizing any encrypted partitions.

# Comment out the current swap from fstab
sudo sed -i 's!^/dev/mapper/cryptswap!# &!' /etc/fstab
# Optionally, comment out the current swap from crypttab
sudo sed -i 's!^cryptswap!# &!' /etc/crypttab

# Create a swapfile the same size as your RAM. You may want more space than that, however, and should probably assign $MEMSIZE manually
MEMSIZE="$(grep MemTotal /proc/meminfo | awk '{print $2}')KiB"
sudo fallocate -l $MEMSIZE /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile

SWAP_UUID=$(findmnt -no UUID -T /swapfile)
SWAP_OFFSET=$(sudo filefrag -v /swapfile | awk '{ if($1=="0:"){print $4} }')
KERNEL_OPTS="resume=UUID=$SWAP_UUID resume_offset=${SWAP_OFFSET/../}"

# Add the new swap to your fstab
echo '/swapfile none swap defaults 0 0' | sudo tee -a /etc/fstab

# Update the kernel options
sudo kernelstub -a "$KERNEL_OPTS"
echo "$KERNEL_OPTS" | sudo tee -a /etc/initramfs-tools/conf.d/resume

Check that everything has been configured properly before running sudo update-initramfs -u -k all. Then reboot.

Using a swap partition

This method is a little more involved, but equally feasible. The only difficulty is allocating the appropriate space to the swap partition, as the swap partition created by a default Pop installation is probably too small to handle this. You may need to resize your existing swap, which is tricky if you added encryption during installation.

# Get device information
SWAP_DEVICE=$(sudo cryptsetup status cryptswap | grep 'device:' | awk '{print $2}')
CRYPT_DEVICE=/dev/mapper/cryptswap # default for new Pop install
SWAP_KEY=/root/.swap-key

# Close default cryptswap
sudo swapoff $CRYPT_DEVICE
sudo cryptsetup luksClose $CRYPT_DEVICE
sudo sed -i 's!^cryptswap!# &!' /etc/crypttab

# Create new cryptswap using a keyfile
sudo dd if=/dev/urandom of=$SWAP_KEY bs=1024 count=4
sudo chmod 400 $SWAP_KEY
sudo cryptsetup luksFormat -d $SWAP_KEY $SWAP_DEVICE
sudo cryptsetup open -d $SWAP_KEY $SWAP_DEVICE cryptswap
sudo mkswap $CRYPT_DEVICE

# Get UUIDs
SWAP_UUID=$(sudo blkid -s UUID -o value $SWAP_DEVICE)
CRYPT_UUID=$(sudo blkid -s UUID -o value $CRYPT_DEVICE)
ROOT_UUID=$(findmnt -no UUID -T $SWAP_KEY)

# Update configuration
echo "UUID=$CRYPT_UUID none swap defaults 0 0" | sudo tee -a /etc/fstab
echo "cryptswap UUID=$SWAP_UUID /dev/disk/by-uuid/$ROOT_UUID:$SWAP_KEY luks,discard,keyscript=/lib/cryptsetup/scripts/passdev,noauto" | sudo tee -a /etc/crypttab
echo "resume=UUID=$CRYPT_UUID" | sudo tee -a /etc/initramfs-tools/conf.d/resume
sudo kernelstub -a "resume=UUID=$CRYPT_UUID"

Check that everything has been configured properly before running sudo update-initramfs -u -k all. Then reboot.

Reference

Guides I used to figure this out.

  1. Enable Hibernate With Encrypted Swap
  2. POP OS! Hibernate enable step by step Complete tutorial and references.
  3. Enable Hibernate on Pop OS
  4. Hibernate support on Ubuntu 20.04 with encrypted swap and encrypted root filesystem
  5. HOWTO: Automatically Unlock LUKS Encrypted Drives With A Keyfile
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment