Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm on Ubuntu 13.04 using full disk encryption (LVM on top of LUKS).

I would like to incorporate luksSuspend into the suspend procedure (and later use luksResume) so that I can suspend to RAM without leaving key material on memory and the root unlocked.

I've been trying for the last 7 hours to port a script for Arch Linux, so far without success: I honestly have no idea of what I'm doing...

Can anyone help me port this (or create something like this from scratch)? Or, at least, can anyone point me to documentation about how to hook stuff into the suspend procedures and how to keep the necessary binaries and scripts (such as cryptsetup) available even after all IO to root has been blocked (by luksSuspend)?

Concerning how to keep the necessary binaries and scripts available for resume, this other blog post (also for Arch) copied them to /boot; I would like however to use something more in the lines what Vianney used in the script I mentioned before, because that approach appears to be a bit more elegant in this aspect.

share|improve this question
I spend a few more hours on this... – jonasmalacofilho Sep 23 '13 at 7:38
I edited the scripts that make up pm-suspend and it appeared that I was almost there. However, I found out that I can't just suspend the system (echo -n "mem" > /sys/power/state) after freezing the root fs (cryptsetup luksSuspend ...), for that requires some i/o still... – jonasmalacofilho Sep 23 '13 at 7:51
I read a few discussions on Debian lists (and some other lists that linked or were linked to these ones) and, so far, it appears that on solution would require something like a "deinitramfs": the kernel would handle control over to the deinitramfs just before actually suspending the system, so that this tmpfs could perform the final cleanup actions (such as wiping the encryption key for the rootfs). – jonasmalacofilho Sep 23 '13 at 7:52
I'd really like to see this question answered too. – BenAlabaster Oct 10 '13 at 20:12

I don't have experience with this setup, but many people claim success in this. Here are a couple of them.

dm-crypt with LUKS - Encrypting the Swap partition
Howto: Completly encrypted harddisk including the suspend to disk partition with Ubuntu 6.10 Edgy Eft

However none of them uses luksSuspend (which might be why they work).

share|improve this answer
Thanks for the links... I'm using a setup similar to the last link (auto generated by the 13.04 installer). – jonasmalacofilho Nov 16 '13 at 3:33
No luksSuspend so far, must power off to clear the keys from memory... Nevertheless, thanks for the links! Maybe by understanding how to configure this manually I can gain some insight on how to use luksSuspend for suspeding to ram. – jonasmalacofilho Nov 16 '13 at 3:39
luksSuspend seems extremely difficult to use. As it freezes all I/O, one needs a very acrobatic suspend script. I could find only one success-story in German which can be (badly) translated into English. Try using it as a template. – harrymc Nov 16 '13 at 8:31
You might also need to use a ram-disk and a statically-linked cryptsetup. – harrymc Nov 16 '13 at 8:55

I spent some time getting this fully functional on Ubuntu 15.10. If you are trying to make this work on ext2, ext3, or ext4 you will need to update /etc/fstab to mount the volume with the 'nobarrier' option. Otherwise, I suggest using BTRFS.

Once your filesystem is prepped, use the script here:

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .