Getting hibernation to work on PureOS 10 with encrypted swap partition

[nikita]

I am trying to get my hibernation working on my Librem 14, PureOS 10 KDE flavor, build as of 2021-12-18. I am running Pureboot. So far I read a lot of the forums here and on the internet on the topic and I got as close as I am now but I’d need some help to move forward.

When installing PureOS, I used manual partitioning to create an encrypted swap partition with size of ~1.5*ram (30gb). I selected to encrypt the partition and provided a password for that partition (sorry for the photo of the screen):

After install I do see a hibernate button and apparently it works, but I cannot wake up from my hibernate state. When I unencrypt drives I first unlock my root partition with my password and then it searches for resume device, but shows an error: “Couldn’t assume device type, choosing default (Plain)”.

I went to check /etc/crypttab, I found this:
luks-3a8e828d-5f7c-44ba-9647-efc80de7eab7 /dev/disk/by-id/nvme-Samsung_SSD_970_PRO_512GB_S5HRNS0R101615A-part2 /dev/urandom swap,cipher=aes-xts-plain64,size=256,noearly

(cannot paste more screenshots due to a new account here)

From what I see the swap partition is using a random password even though I set an encryption password in PureOs installer. I assume, if I can successfully make sure that the password is not random anymore, I should be able to open the partition during startup and resume from hibernation. I have no idea how to do that though, at this point my Linux knowledge is pretty sporadic and I do not have a slightest picture of what exactly happens when the laptop boots and how to do what I need. I am also not sure how to back up my system so that if I mess up I’d still be able to revert changes and not reinstall the system. When I tried to change the entry in /etc/crypttab from /dev/random/ to something else the system failed to load.

If anyone could help me move forward I would really appreciate it. Thanks!

[miso]

The swap partition is encrypted by randomized key at each boot (wiped out) to prevent data leaks. This breaks hibernation.

Does the ROOT partition being unencrypted present any security vulnerability?

Our PureOS OEM install creates a separate unencrypted /boot partition, and an encrypted root partition and swap partition. The root partition is encrypted with a key you end up setting on first boot, while the swap partition is encrypted using a key that’s randomized at each boot–this is why hibernate won’t work on a default PureOS install–the randomized key used for swap means the data there is wiped out at each boot. I’m not sure who would have told you we encrypt /home separately as we have…

More info
https://tracker.pureos.net/T535
https://tracker.pureos.net/T753

There was activity last year to the open task https://tracker.pureos.net/T535

jonas.smedegaard assigned this task to mak.May 27 2021, 05:04
jonas.smedegaard triaged this task as Normal priority.

Maybe you can enable hibernation with swap file (not swap partition), see https://wiki.debian.org/Hibernation/Hibernate_Without_Swap_Partition

[nikita]

Hi Miso,

Thanks for the reply. Yep, I’ve seen these tasks but as you can see there’s not much happening there over a year now. The thing about randomized encryption key is that I assigned a manual encryption key to the swap partition during my OS install but I guess PureOS installer did not respect that setting.

I know I can try using the swap file instead, but I already created a 26GB swap partition just for hibernation purposes, so my goal is to try and make it work with the existing setup. It must be possible to change the encryption password so that it is not randomized anymore. Is that really non-reversible?

[rcu]

You can back up data from an encrypted partition, then create one encrypted partition and create the required logical volumes. There is a lot of information on the Internet about this.

[nikita]

Okay and what that would help with? I don’t understand.

[The_Bazaar]

I personally wasn’t able to set up an encrypted swap partition on my PureOS with hibernate. But I did come across the following gist, a Github “paste bin” alternative, here which may be of use towards those who attempt this endeavor in the future. The thing I found of note is that they set up a derived key for the encrypted swap hibernate partition, meaning only one password is needed.