Post #1644673

2026-04-24 14:50 UTC

This is definitely worth mentioning. You apparently can get it working with a dedicated encrypted swap partition (which I admittedly haven't tried) but I just turned off secureboot. The risk/convenience tradeoff is worth is for me.

Replies (1)

@Kazumara@discuss.tchncs.de 2026-04-24 19:21

That’s not what I ready unfortunately. When booted in secureboot, the kernel enters lockdown mode which disables all hibernation, regardless of the swap being encrypted or plain text. It seems there are two kernel patches available to enable hibernation in lockdown mode, but not in mainline. This one is more of an admin override, where you take the risk of root replacing the swap contents gist.github.com/…/917d456cb572325aae8e3bd94a9c135… And this one is complicated but uses the TPM to ensure only the kernel, not root, can write the hibernation image, so there is no reduction in assurance compared to clean booting a signed kernel with secureboot: mjg59.dreamwidth.org/55845.html But that’s all too much for me, I intend to turn it off again.

Open ##1644672