Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm on Ubuntu 13.04 using full disk encryption (LVM on top of LUKS).

I would like to incorporate luksSuspend into the suspend procedure (and later use luksResume) so that I can suspend to RAM without leaving key material on memory and the root unlocked.

I've been trying for the last 7 hours to port a script for Arch Linux, so far without success: I honestly have no idea of what I'm doing...

Can anyone help be port this (or create something like this from scratch)? Or, at least, can anyone point me to documentation about how to hook stuff into the suspend procedures and how to keep the necessary binaries and scripts (such as cryptsetup) available even after all IO to root has been blocked (by luksSuspend)?

Concerning how to keep the necessary binaries and scripts available for resume, this other blog post (also for Arch) copied them to /boot; I would like however to use something more in the lines what Vianney used in the script I mentioned before, because that approach appears to be a bit more elegant in this aspect.

share|improve this question
    
I spent a few more hours on this... I edited the scripts that make up pm-suspend and it appeared that I was almost there. However, I found out that I can't just suspend the system (echo -n "mem" > /sys/power/state) after freezing the root fs (cryptsetup luksSuspend ...), for that requires some i/o still... –  jonasmalacofilho Sep 23 '13 at 7:53
    
I read a few discussions on Debian lists (and some other lists that linked or were linked to these ones) and, so far, it appears that on solution would require something like a "deinitramfs": the kernel would handle control over to the deinitramfs just before actually suspending the system, so that this tmpfs could perform the final cleanup actions (such as wiping the encryption key for the rootfs). –  jonasmalacofilho Sep 23 '13 at 7:53
    
Did you get anywhere with this? I'm looking for the same thing, I've been tinkering with this on and off for days with no useful progress :( –  BenAlabaster Oct 17 '13 at 15:19
    
Nothing concrete yet... What I tested so far is here. I also found this other link since then... –  jonasmalacofilho Oct 17 '13 at 19:12
    
You wouldn't think something so obvious would be so difficult to enable would you? This seems like something so basic it should have been thought about with the base setup. –  BenAlabaster Oct 18 '13 at 18:10
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.