Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TPM-backed Full Disk Encryption is coming to Ubuntu

ubuntu.com

Post reply on HN
Print view View original

41–50 of 71 posts

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#41

Post by FirmwareBurner »

vladvasiliu wrote: post #28
FirmwareBurner wrote: post #15

Earlier quoted context omitted.

I tried that and it didn't work on my work ThinkPad (also those steps are dangerous it could brick your system if you so much as make a single mistake). But that doesn't answer my question of why something as basic as Hibernate (copy RAM contents to HDD on power-OFF, then reverse on power-ON) isn't something that works out of the box on Linux distros, and instead requires 2h of tutorial reading and dangerous low-lvel…

It worked out of the box on my Arch install. I'm running a LUKS volume which holds an LVM with the ext4 fs for the system and the swap. I'm also running TPM + PIN / FIDO2 unlocking. Didn't need to fiddle with anything. The most part of this install was going through the manual process of creating filesystems and whatnot. Bonus points compared to Windows for actually staying asleep instead of randomly waking up while…

>It worked out of the box on my Arch install.

Ubuntu isn't Arch I think. Average Joe switching away form Windows isn't gonna start learning Arch.

>Bonus points compared to Windows for actually staying asleep instead of randomly waking up while in my bag.

That doesn't happen under hibernate. You used sleep thinking it was hibernate, that's why you had that issue.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#42

Post by FirmwareBurner »

vladvasiliu wrote: post #21
criddell wrote: post #10

Earlier quoted context omitted.

Windows can wake itself from hibernate. Killing all of the wake timers and editing specific keys in the registry will usually fix this, but it's messy and not something typical users are comfortable doing.

This. During lockdowns, I dusted off an old PC and set it up with windows for gaming. The computer was in front of my bed. One out of two nights, the thing would randomly wake out of hibernation, blasting the freaking blue bitlocker screen at me (password unlock, since that PC didn't have a tpm). This PC was kept reasonably up to date, too (usually installed whatever update at the most a day or two after they came ou…

>One out of two nights, the thing would randomly wake out of hibernation

I'm sure you mistakenly used sleep instead of hibernate without knowing or remembering, to have that issue, or you had the issue where hibernate didn't work and reverted to sleep instead.

I also had that issue and discovered that the Linux dual-boot installation with Grub's changes to the MBR broke Window's capability to hibernate, so me hitting hibernate was actually triggering sleep instead.

Hibernate does not randomly wake up.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#43

Post by sam_lowry_ »

nine_k wrote: post #39
cgb223 wrote: post #30

Earlier quoted context omitted.

So if Ubuntu is pivoting hard into big corporate/govt Who’s the new big community desktop distro?

No idea! Debian proper? Fedora? Nix? Arch?.. (I personally run a relatively niche distro, https://voidlinux.org/ )

Arch

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#44

Post by FirmwareBurner »

tredre3 wrote: post #31
FirmwareBurner wrote: post #24

Earlier quoted context omitted.

>Windows can wake itself from hibernate. You're confusing that with sleep. Windows can't wake itself from hibernate as the machine is fully powered off, not in some sleep state.

No, he's right. Windows can wake the computer from total shut down even (S5). It uses RTC alarms: https://en.wikipedia.org/wiki/Real-time_clock_alarm

"Can be set to wake up" doesn't mean "will wake up".

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#45

Post by FirmwareBurner »

stonogo wrote: post #32
FirmwareBurner wrote: post #9

Earlier quoted context omitted.

>Windows these days prefers what they call modern standby and you probably don't want it. Who cares what Windows prefers, when I'm the user and I prefer Hibernate which works out of the box and I use it precisely because it avoids the issues you mentioned. Why don't you use Hibernate? SSDs are fast enough that a wake from hibernate is not much slower than a wake from sleep. On Ubuntu I don't even have this option bec…

On Ubuntu you do have this option, you just have to set it up yourself. They don't prioritize support for it because "people who want to hibernate a laptop" is a rounding error in their customer population statistics.

>On Ubuntu you do have this option, you just have to set it up yourself.

Which means it's not available. Technically my car can also go diving underwater, you just have to set it up yourself for that.

I expect stuff on my OS to work out of the box, not require hours of dangerous tinkering with the risk of braking, to get something basic to work.

>They don't prioritize support for it because "people who want to hibernate a laptop" is a rounding error in their customer population statistics.

I mean, it's feature that I absolutely use on Windows regularly, which means it matters a lot to me, the userbase of 1, to have it on Linux as well, I don't really care what the opinionated Ubuntu dev team think on the way I'm supped to use my own computer.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#46

Post by FirmwareBurner »

vladvasiliu wrote: post #29
forty wrote: post #26

Earlier quoted context omitted.

The Linux kernel disable hibernation when secure boot is enabled for security reasons (it enables the lockdown mode). I don't think it's especially an Ubuntu/distro problem. When secure boot is disabled, I think hibernation is supposed to work fine.

It works fine with secure boot enabled on my arch install. But I do use a unified image which the UEFI boots directly (EFISTUB, no grub or anything). I don't know if that makes a difference.

>But I do use a unified image which the UEFI boots directly (EFISTUB, no grub or anything).

Do you have any links on this kind of image? Or did you build it yourself?

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#47

Post by briffle »

cgb223 wrote: post #30
nine_k wrote: post #12

Earlier quoted context omitted.

Looks perfectly aligned with corporate and especially government IT practices. There the user is by far not the owner.

So if Ubuntu is pivoting hard into big corporate/govt Who’s the new big community desktop distro?

The transition from Ubuntu to Debian is about as simple as it gets, since Ubuntu derives much of their base from Debian..

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#48

Post by michaelt »

rjzzleep wrote: post #16
michaelt wrote: post #5

> the bootloader (shim and GRUB) and kernel assets will be delivered as snap packages (via gadget and kernel snaps), as opposed to being delivered as Debian packages. And there it is. I suppose having your kernel command line signed by Canonical and unmodifiable by the system owner without a pain-in-the-ass manual 'machine owner key enrolment' process is very much on-brand for Snap.

Meanwhile my mom just asked me to switch her Dell to her favorite linux mint flavour and the key enrollment was literally 3 key presses plus the password away.

Oops, I tried to install the nvidia drivers, but it doesn't seem to have worked.

I got a weird screen during the process, pretty sure it was blue, and the default option was 'continue boot' which I selected, I think maybe it was the 'BIOS' ?

I couldn't google what to do while at that screen, or screenshot it either, for some reason.

I've tried uninstalling then reinstalling the drivers, but that hasn't made the mystery screen to come up again, and hasn't fixed my problem.

I will now go and research a fix, but as a newbie I don't know keywords like 'mok enrolment' or 'mokutil' or 'dkms' or 'secure boot' or 'shim' because WTF do those even mean?

Go ahead and try searching, see how long it takes you to find the command you need to run when you don't know any of those terms, or even that the problem is secure boot related.

Meanwhile, the BIOS with its 'secure boot on/off' switch is available every single boot.

> the key enrollment was literally 3 key presses plus the password away

If you don't count the 8+ character password you have to enter three times, maybe.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#49

Post by criddell »

FirmwareBurner wrote: post #42
vladvasiliu wrote: post #21

Earlier quoted context omitted.

This. During lockdowns, I dusted off an old PC and set it up with windows for gaming. The computer was in front of my bed. One out of two nights, the thing would randomly wake out of hibernation, blasting the freaking blue bitlocker screen at me (password unlock, since that PC didn't have a tpm). This PC was kept reasonably up to date, too (usually installed whatever update at the most a day or two after they came ou…

>One out of two nights, the thing would randomly wake out of hibernation I'm sure you mistakenly used sleep instead of hibernate without knowing or remembering, to have that issue, or you had the issue where hibernate didn't work and reverted to sleep instead. I also had that issue and discovered that the Linux dual-boot installation with Grub's changes to the MBR broke Window's capability to hibernate, so me hitting…

On Windows, hibernate is a sleep state.

https://learn.microsoft.com/en-us/windows-hardware/drivers/k...

Here’s an example of a Windows machine waking from hibernate and how it was fixed:

https://www.bleepingcomputer.com/forums/t/707115/windows-10-...

These kinds of problems are not uncommon and are not always due to users confusing the different sleep states.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#50

Post by vladvasiliu »

FirmwareBurner wrote: post #46
vladvasiliu wrote: post #29

Earlier quoted context omitted.

It works fine with secure boot enabled on my arch install. But I do use a unified image which the UEFI boots directly (EFISTUB, no grub or anything). I don't know if that makes a difference.

>But I do use a unified image which the UEFI boots directly (EFISTUB, no grub or anything). Do you have any links on this kind of image? Or did you build it yourself?

Apparently systemd supports building it now somehow (search for UKI, unified kernel image), but I'm too lazy to switch, since my current setup works great. But sooner or later I may be forced to, since my solution is apparently no longer maintained.

I've followed this: https://wiki.archlinux.org/title/Unified_Extensible_Firmware...

Basically, my distro will install the kernel, initrd and cpu microcode normally to /boot. But at the end of it, there's a hook being triggered, that calls sbupdate with stitches together the kernel, command line, initrd, and cpu microcode, signs it and dumps it in the /EFI partition as a single file. /boot is not a separate partition on my system, it lives inside the encrypted /. I also told my UEFI about this specific image using efibootmgr. This allows me to register the image as a bootable OS and use the UEFI's boot manager to choose between Linux and Windows on startup.

If you browse around that Arch Wiki page, they also tell you how to sign your own boot images. I've installed my own keys in the UEFI, since Arch's kernel isn't signed by anybody.

Post reply on HN