Ecrypted swap with hibernate, resume not working

hyperhead · 05-13-2017, 03:38 PM

Hi

I'm running Slackware-current and had hibernate working fine with a standard swap file.

I decided to encrypted my swap partition and try that with hibernate. It doesn't seem to work (or it does seem to hibernate, but ignores resume when powered on)

I have followed the guide here: http://slackware.osuosl.org/slackwar...ADME_CRYPT.TXT and looking at crypsetup and swap everything is fine for hibernate, but when I power on the resume in elilo and mkinitrd seem to be ignored. (butare present in elilo.con / dmesg for Kernel command line in dmesg)

Has anybody got an encrypted swap partition that they hibernate resume from regularly, I can't see what I'm doing wrong here

Shown are the pertinent configurations and statuses that show it looking ok, I don't see any errors that might indicate that it has not saved to swap and I get prompted for my password or /dev/mapper/swap on boot to unencrypt the partition.

There isn't much written about resume only to add it to the lilo.conf and re-run mkinitrd with -h option pointing at swap partiton. ( I use elilo, and have added the resume entry)

/Thanks

Code:

Cryptsetup status: 
================== 
/dev/mapper/swap is active and is in use.
  type:    LUKS1
  cipher:  aes-xts-plain64
  keysize: 256 bits
  device:  /dev/sda3
  offset:  4096 sectors
  size:    15560704 sectors
  mode:    read/write

Swap status: 
================== 
Filename                                Type            Size    Used    Priority
/dev/dm-0                               partition       7780348 0       -1

Crypttab status: 
================== 
#swap /dev/sda3 /dev/random swap,cipher=aes-xts-essiv:sha256
swap /dev/sda3 none swap

Fstab status
================== 
/dev/mapper/swap swap swap defaults 0 0

Elilo status
================== 
chooser=simple
delay=1
timeout=1
#
image=vmlinuz
        label=vmlinuz
        initrd=initrd.gz
        read-only
        append="root=/dev/sda5 vga=normal resume=/dev/mapper/swap ro"

Mkinitrd confirmation in dmesg
==============================
[    0.000000] Command line: BOOT_IMAGE=dev000:\EFI\Slackware\vmlinuz  root=/dev/sda5 vga=normal resume=/dev/mapper/swap ro ro
[    0.000000] Kernel command line: BOOT_IMAGE=dev000:\EFI\Slackware\vmlinuz  root=/dev/sda5 vga=normal resume=/dev/mapper/swap ro ro
[   19.603374] Adding 7780348k swap on /dev/mapper/swap.  Priority:-1 extents:1 across:7780348k SS

Upower for hibernate shown in /var/log/messages
===============================================
May 14 22:15:45 darkstar dbus[1065]: [system] Activating service name='org.freedesktop.UPower' (using servicehelper)
May 14 22:15:45 darkstar dbus[1065]: [system] Successfully activated service 'org.freedesktop.UPower'

rknichols · 05-13-2017, 07:54 PM

It can't work with a random key. The only record of that key is in the kernel memory saved in that encrypted space. See the problem?

There are various alternatives to using that random key. A search for "hibernate+encrypted+swap" will yield several good links.

v3g4n · 05-13-2017, 10:20 PM

I am not use elilo, lilo instead, but can only say that hibernation is working fine for me once I added "resume=/dev/cryptvg/swap" to /etc/lilo.conf and -h when I ran mkinitrd.sh.
Not sure if it will help, but here is where I added the -h for mkinird.sh

Code:

mkinitrd -c -h -k 4.4.38 -f ext4 -r /dev/cryptvg/root -m jbd2:mbcache:ext4 -C /dev/sda2 -L -u -o /boot/initrd.gz

Hope it helps.

hyperhead · 05-14-2017, 03:51 AM

Quote:

Originally Posted by rknichols

It can't work with a random key. The only record of that key is in the kernel memory saved in that encrypted space. See the problem?

There are various alternatives to using that random key. A search for "hibernate+encrypted+swap" will yield several good links.

Hi, I removed the random key and used a password and it decrypts fine on first boot.

However I will regoogle with your search terms as I never yielded much results.

hyperhead · 05-14-2017, 03:52 AM

Quote:

Originally Posted by v3g4n

I am not use elilo, lilo instead, but can only say that hibernation is working fine for me once I added "resume=/dev/cryptvg/swap" to /etc/lilo.conf and -h when I ran mkinitrd.sh.
Not sure if it will help, but here is where I added the -h for mkinird.sh

Code:

mkinitrd -c -h -k 4.4.38 -f ext4 -r /dev/cryptvg/root -m jbd2:mbcache:ext4 -C /dev/sda2 -L -u -o /boot/initrd.gz

Hope it helps.

Hi I can try re-run mkinitrd.sh as mine was a bit different to that. I am only using encrypted swap no LVM volumes or anything, so I didnt follow the full guide for that.

Thanks

Alien Bob · 05-14-2017, 04:03 AM

Quote:

Originally Posted by hyperhead

Hi

I'm running Slackware-current and had hibernate working fine with a standard swap file.

I decided to encrypted my swap partition and try that with hibernate. It doesn't seem to work (or it does seem to hibernate, but ignores resume when powered on)

I have followed the guide here: http://slackware.osuosl.org/slackwar...ADME_CRYPT.TXT and looking at crypsetup and swap everything is fine for hibernate, but when I power on the resume in elilo and mkinitrd seem to be ignored.

I guess you did not read that README in full, or did not realize the importance of some parts of the text.

In the section about encrypting your swap, there's two notes:

Code:

NOTE: the swap partition is encrypted with a new randomly generated key every
      time your computer boots.
      There is no need to ever enter a passphrase!

NOTE: having an encrypted swap like this causes a re-format of the swap
      partition on avery boot-up and shutdown.  This is perfectly OK as long
      as you do not change the order of your hard disks.  If you add a disk,
      or move this disk to another computer, the device name may change (for
      instance from sda to sdb) and if you forget to modify '/etc/crypttab'
      your system may end up formatting the wrong partition!
      For this reason alone, it is recommended that you implement disk
      encryption including swap using the "Combining LUKS and LVM" method
      described in the chapter with the same name!

hyperhead · 05-14-2017, 04:24 AM

Quote:

Originally Posted by Alien Bob

I guess you did not read that README in full, or did not realize the importance of some parts of the text.

In the section about encrypting your swap, there's two notes:

Code:

NOTE: the swap partition is encrypted with a new randomly generated key every
      time your computer boots.
      There is no need to ever enter a passphrase!

NOTE: having an encrypted swap like this causes a re-format of the swap
      partition on avery boot-up and shutdown.  This is perfectly OK as long
      as you do not change the order of your hard disks.  If you add a disk,
      or move this disk to another computer, the device name may change (for
      instance from sda to sdb) and if you forget to modify '/etc/crypttab'
      your system may end up formatting the wrong partition!
      For this reason alone, it is recommended that you implement disk
      encryption including swap using the "Combining LUKS and LVM" method
      described in the chapter with the same name!

Hi, I am not using a randomly generated key for the swap partition, but used the method for encrypting the home partition

Code:

cryptsetup -s 256 -y luksFormat /dev/sdx2

I also tried with the random key in an earlier attempt and got the same results. I deviated as the previous method of the random key as that did not work either, so I didn't see an issue with using a passphrase for decrypting the partition used for resume

I did take note of the fact if I got the partition wrong in crypttab I could end up hosing my OS, this was a risk I was willing to take and it was only for that reason that LVM was recommended.

I am not installing up my Slackware from scratch and just had the whim to encrypt my swap space that I use for hibernate.

I will re-read and implement again and maybe not be so cavalier with my alteration of the documented method!

Thanks for the input.

brobr · 05-17-2017, 02:03 PM

Did you try to include the encrypted swap-partition for the -h flag to point at in your mkinitrd? Such as:

Code:

mkinitrd -c -k <kernel> -m ext4 -f ext4 -r /dev/sdXx -h /dev/cryptvg/swap -C /dev/sda5 -L -l gb -o initrd-<kernel>.gz

hyperhead · 05-18-2017, 01:41 PM

Quote:

Originally Posted by brobr

Did you try to include the encrypted swap-partition for the -h flag to point at in your mkinitrd? Such as:

Code:

mkinitrd -c -k <kernel> -m ext4 -f ext4 -r /dev/sdXx -h /dev/cryptvg/swap -C /dev/sda5 -L -l gb -o initrd-<kernel>.gz

Yes I did. It didnt work for me. I will revisit this task another day....

Thanks for input

brobr · 05-29-2017, 08:35 AM

Hi, are you still looking for a solution?

During a kernel-upgrade I noticed that in my elilo.conf I have this line for each image:

Quote:

append="root=proc vga=normal ro resume=/dev/cryptvg/swap"

Does the append line in your (e)lilo.conf contains something like " resume=/dev/cryptvg/swap", to help to resume your encrypted swap?

HTH

Rob