I actually just did this recently with a BTRFS subvolume using a swap file and LUKS encryption.

The old Fedora magazine article has the overall steps required and someone also made a guide for secure boot on I think the spiceworks framework forum.

The catch is that secure boot will only allow signed images to be loaded which includes the hibernation swap image, meaning you have to use a customized kernel that allows unsigned hibernation images to load.

I’ll share both links when I get a chance.

EDIT:

Fedora Magazine guide: https://fedoramagazine.org/hibernation-in-fedora-36-workstation/

This is slightly outdated as Fedora now uses a proper zram.swap definition with systemd, so you can also do a systemctl edit to disable and enable zram0 with post/pre start on the hibernate service directly instead of using swapon/swapoff. I’ll make a second edit with my example I’ll have to dig out of some poorly documented notes lol.

https://community.frame.work/t/guide-fedora-36-hibernation-with-enabled-secure-boot-and-full-disk-encryption-fde-decrypting-over-tpm2/25474

This is the full forum post guide for FDE + TPM + secure boot. I’m not entirely sure of the kernel patch specific but it seems that the hibernate swap image is technicallly signed because if the bootloader process, but the kernel lockdown mode rejects it regardless by default because there’s no guarantee that the swap image was configured with FDE and not tampered with, which would be a vulnerability.

Quick glance at the kernel patch makes it seem like it’s just a flag check to allow hibernate in lockdown mode, so I assume the secure boot signature check is still completed.

lockdown_hibernate [HIBERNATION] Enable hibernation even if lockdown is enabled. Enable this only if your swap is encrypted and secured properly, as an attacker can modify the kernel offline during hibernation.

Did you do this ?

Get the UUID of swap partion then add it to boot parameter(resume=UUID=xxxx)

System needs that in grub line so it knows where to put the hibernation stuff, and obviously swap has to be equal or larger than RAM amount.

I don’t have/use TPM, but I do have encrypted swap and hibernation on a fully encrypted drive.

The trick is to put the kernels in the root partition, which is encrypted by LUKS. Then, you can also put a swapfile in that same partition.

The only unencrypted part of my system is /boot/etfi, which is the EFI partition that holds nothing but the grub binary. Grub configs and kernels are in /boot, which is on the root partition, and encrypted in LUKS.

Grub automatically scans hard drives, before prompting with a password to decrypt the root and everything on it. Because grub is doing the decryption, rather than the kernels, the kernels and swapfile are decrypted all at once.

Wild guess as I’m not using dracut and have only setup encrypted hibernation on an old bios laptop…

But did you edit the systemd-sleep.conf (usually /etc/systemd/sleep.conf, although there are some other possible locations)? The other old-school and universal way of telling your system that hibernate is enabled without systemd would be a resume= kernel parameter

Why binding specifically to PCRs 1,4,5 and 7? Are they immutable even with updates that modify db and dbx (I think I saw one recently drop on Ubuntu)?

I’ve got multiple machines that do this, but all on nixos.

After completing the below, entering systemctl hibernate errors saying hibernation is not set up for the system.

This is weird, so I’d start here. Can you get the exact error and/or whatever it logs to journald?

I’d ignore all the TPM stuff until you can hibernate it and resume with a password. Maybe the swap is just too small? Maybe something in /etc/systemd/sleep.conf?

In case it helps, my device setup looks like this:

NAME               FSTYPE      FSVER    LABEL                             UUID                                   FSAVAIL FSUSE% MOUNTPOINTS
nvme0n1            crypto_LUKS 2                                          xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
└─encrypted        LVM2_member LVM2 001                                   xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  ├─encrypted-swap swap        1        swap                              xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx                  [SWAP]
  └─encrypted-root btrfs                root                              xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx      xxxx    xxx /mnt/root
                                                                                                                                /nix/store
                                                                                                                                /
nvme1n1
├─nvme1n1p1        vfat        FAT32                                      xxxxxxxxx                                xxxxx    xxx /boot
[...]

so luks -> lvm -> { swap, btrfs }

Edit:

https://wiki.archlinux.org/title/Power_management/Suspend_and_hibernate#Hibernation

When the system is running on UEFI, systemd-sleep(8) will automatically pick a suitable swap space to hibernate into, and the information of the used swap space is stored in HibernateLocation EFI variable.

So far I haven’t figured out from the systemd docs what “automatically pick a suitable swap space” actually means, or if that’s accurate.