Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TPM-backed Full Disk Encryption is coming to Ubuntu

ubuntu.com

Post reply on HN
Print view View original

11–20 of 71 posts

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#11

Post by botanical »

FirmwareBurner wrote: post #4

That's groovy baby, but can anyone give me the technicals on why we can't have Hibernate(not sleep) out of the box on Ubuntu like we can on Windows? That was one of the deal-breakers for me making the switch. If I understood it correctly, it's because of Z-RAM and if I'm also correct, full disk encryption is another roadblock in the path of the hibernate feature.

I have hibernate after following this:

https://ubuntuhandbook.org/index.php/2021/08/enable-hibernat...

But I don't have full disk encryption so I don't know how it works with it.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#12

Post by nine_k »

michaelt wrote: post #5

> the bootloader (shim and GRUB) and kernel assets will be delivered as snap packages (via gadget and kernel snaps), as opposed to being delivered as Debian packages. And there it is. I suppose having your kernel command line signed by Canonical and unmodifiable by the system owner without a pain-in-the-ass manual 'machine owner key enrolment' process is very much on-brand for Snap.

Looks perfectly aligned with corporate and especially government IT practices. There the user is by far not the owner.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#13

Post by FirmwareBurner »

criddell wrote: post #10
FirmwareBurner wrote: post #9

Earlier quoted context omitted.

>Windows these days prefers what they call modern standby and you probably don't want it. Who cares what Windows prefers, when I'm the user and I prefer Hibernate which works out of the box and I use it precisely because it avoids the issues you mentioned. Why don't you use Hibernate? SSDs are fast enough that a wake from hibernate is not much slower than a wake from sleep. On Ubuntu I don't even have this option bec…

Windows can wake itself from hibernate. Killing all of the wake timers and editing specific keys in the registry will usually fix this, but it's messy and not something typical users are comfortable doing.

What do you mean? Hibernate works out of the box. There nothing to "fix" in the registry for that to work.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#14

Post by distract8901 »

michaelt wrote: post #5

> the bootloader (shim and GRUB) and kernel assets will be delivered as snap packages (via gadget and kernel snaps), as opposed to being delivered as Debian packages. And there it is. I suppose having your kernel command line signed by Canonical and unmodifiable by the system owner without a pain-in-the-ass manual 'machine owner key enrolment' process is very much on-brand for Snap.

Well shit, we were just joking the other day on mastodon about the kernel being distributed as a snap. I guess this is it, then.

I'm tired of computers being awful :(

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#15

Post by FirmwareBurner »

botanical wrote: post #11
FirmwareBurner wrote: post #4

That's groovy baby, but can anyone give me the technicals on why we can't have Hibernate(not sleep) out of the box on Ubuntu like we can on Windows? That was one of the deal-breakers for me making the switch. If I understood it correctly, it's because of Z-RAM and if I'm also correct, full disk encryption is another roadblock in the path of the hibernate feature.

I have hibernate after following this: https://ubuntuhandbook.org/index.php/2021/08/enable-hibernat... But I don't have full disk encryption so I don't know how it works with it.

I tried that and it didn't work on my work ThinkPad (also those steps are dangerous it could brick your system if you so much as make a single mistake).

But that doesn't answer my question of why something as basic as Hibernate (copy RAM contents to HDD on power-OFF, then reverse on power-ON) isn't something that works out of the box on Linux distros, and instead requires 2h of tutorial reading and dangerous low-lvel tinkering for it to (maybe) work or brick your system if you mess it up.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#16

Post by rjzzleep »

michaelt wrote: post #5

> the bootloader (shim and GRUB) and kernel assets will be delivered as snap packages (via gadget and kernel snaps), as opposed to being delivered as Debian packages. And there it is. I suppose having your kernel command line signed by Canonical and unmodifiable by the system owner without a pain-in-the-ass manual 'machine owner key enrolment' process is very much on-brand for Snap.

Meanwhile my mom just asked me to switch her Dell to her favorite linux mint flavour and the key enrollment was literally 3 key presses plus the password away.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#17

Post by julian-klode »

FirmwareBurner wrote: post #4

That's groovy baby, but can anyone give me the technicals on why we can't have Hibernate(not sleep) out of the box on Ubuntu like we can on Windows? That was one of the deal-breakers for me making the switch. If I understood it correctly, it's because of Z-RAM and if I'm also correct, full disk encryption is another roadblock in the path of the hibernate feature.

So hibernate is somewhat unreliable and prone to data loss, image you hibernate after having installed a new kernel, so the decision was made to disable it due to that IIRC, independent of secure boot.

With secure boot and lockdown, hibernate is no longer possible on an alternative reason: We need to ensure that the kernel memory has not been tampered with. If you hibernate, you could then go and modify the memory in the swap and bypass the lock down security guarantees.

To address that you'd need to authenticate the swap using the TPM somehow, but I don't know enough about TPMs to know if that's feasible. Usually people would seal some crypto key against the TPM but here it's somewhat the opposite way around.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#18

Post by distract8901 »

FirmwareBurner wrote: post #9
criddell wrote: post #8

Earlier quoted context omitted.

Windows these days prefers what they call modern standby and you probably don't want it. I have a ThinkPad and this is what it's like: Close the lid and stuff laptop into my backpack. I travel to work and when I pull my machine out of my bag, it has 12% battery left, is super hot, and the fan is screaming like the machine is trying to fly away. All because Microsoft thinks PCs should be more like iPhones.

>Windows these days prefers what they call modern standby and you probably don't want it. Who cares what Windows prefers, when I'm the user and I prefer Hibernate which works out of the box and I use it precisely because it avoids the issues you mentioned. Why don't you use Hibernate? SSDs are fast enough that a wake from hibernate is not much slower than a wake from sleep. On Ubuntu I don't even have this option bec…

That very much depends on your definition of "works".

Does the machine go through the steps to save memory to disk and enter a low power state? Yes.

But then windows can and does decide to wake itself up at any time, resulting in physical damage to the machine if it's stored in a closed bag. Discharging the battery and heating up the entire machine dramatically reduces your battery's lifetime. You cannot disable this behavior without going into the registry.

So yes, it 'works', with the caveat that the machine may wake itself at any time, burn through the entire battery and possibly do irreprable damage to your machine.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#19

Post by FirmwareBurner »

julian-klode wrote: post #17
FirmwareBurner wrote: post #4

That's groovy baby, but can anyone give me the technicals on why we can't have Hibernate(not sleep) out of the box on Ubuntu like we can on Windows? That was one of the deal-breakers for me making the switch. If I understood it correctly, it's because of Z-RAM and if I'm also correct, full disk encryption is another roadblock in the path of the hibernate feature.

So hibernate is somewhat unreliable and prone to data loss, image you hibernate after having installed a new kernel, so the decision was made to disable it due to that IIRC, independent of secure boot. With secure boot and lockdown, hibernate is no longer possible on an alternative reason: We need to ensure that the kernel memory has not been tampered with. If you hibernate, you could then go and modify the memory in…

Thanks for the explanation. That kind of sucks though. I was spoiled by how good hibernate works on Windows and assumed any modern desktop OS should come with this feature if it wishes to "cut the king". I guess it's another nail in the "switching to Linux" coffin.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#20

Post by darkclouds »

criddell wrote: post #10
FirmwareBurner wrote: post #9

Earlier quoted context omitted.

>Windows these days prefers what they call modern standby and you probably don't want it. Who cares what Windows prefers, when I'm the user and I prefer Hibernate which works out of the box and I use it precisely because it avoids the issues you mentioned. Why don't you use Hibernate? SSDs are fast enough that a wake from hibernate is not much slower than a wake from sleep. On Ubuntu I don't even have this option bec…

Windows can wake itself from hibernate. Killing all of the wake timers and editing specific keys in the registry will usually fix this, but it's messy and not something typical users are comfortable doing.

> Windows can wake itself from hibernate.

The USB bus and sound system is still the weak spot on a windows computer in my experience, this website, reddit, youtube, or dailymail generally takes them out.

Surprised that people used sleep and hibernate, considering TSR's were invented in the dos days and the browser can do lots of fancy stuff.

Theres even a reg setting to clear the page file on shutdown.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\ ClearPageFileAtShutdown Dword32 1

Post reply on HN