Secure Boot + Hibernation

Help
1

Hello folks;

I am running a secure boot (with lanzaboote) system

But when I try to make it go into hibernation, it fatals with

[ 6948.852489 ] PM: hibernation: Error -12 creating image

And needs to be hard poweroffed before being usable again

Is there a way to fix it or is it a strict limitation?

2

Because the code that’s failing is architecture specific (swsusp_arch_suspend), could you tell us what processor architecture you are using e.g. x86_64.

3

x86_64

hardware-configuration.nix

# Do not modify this file!  It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations.  Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:

{
  imports =
    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];

  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-amd" ];
  boot.extraModulePackages = [ ];

  fileSystems."/" =
    { device = "/dev/mapper/cryptroot";
      fsType = "ext4";
    };

  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/213ed6b2-470b-4ae1-898b-b816e0a93f48";

  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/F0A2-A1C9";
      fsType = "vfat";
      options = [ "fmask=0077" "dmask=0077" ];
    };

  swapDevices =
    [ { device = "/dev/disk/by-uuid/bc2e19a0-d1ee-4fa5-abb2-3e8f3d8a7792"; }
    ];

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

relevant part of my configuration.nix

  boot = {
    kernelPackages =
      cachyos-kernel.legacyPackages.${pkgs.stdenv.hostPlatform.system}.linuxPackages-cachyos-latest-lto-x86_64-v3; # from github:xddxdd/nix-cachyos-kernel/release
    loader = {
      systemd-boot = {
        enable = lib.mkForce false; # replaced by lanzaboote
        editor = false;
      };
      efi.canTouchEfiVariables = true;
    };
    lanzaboote = {
      enable = true;
      pkiBundle = "/var/lib/sbctl";
      configurationLimit = 8; # maximum by systemd-pcrlock (see https://github.com/nix-community/lanzaboote/blob/b9e331d75d4618c7073ea08ff30fddf9a7d2fb08/nix/modules/lanzaboote.nix#L429-L438)

      autoGenerateKeys.enable = true;
      autoEnrollKeys = {
        enable = true;
        autoReboot = true;
      };

      measuredBoot = {
        enable = true;

        # only stable ones
        pcrs = [
          0
          4
          7
        ];

        autoCryptenroll = {
          enable = true;
          device = "/dev/nvme0n1p2";
          autoReboot = true;
        };
      };

      bootCounting.initialTries = 3;
    };
    tmp.useTmpfs = true;
    kernel.sysctl."vm.swappiness" = 100;
    supportedFilesystems.exfat = true;
  };

  zramSwap.enable = true;

Note that I’m also using nixos-hardware.nixosModules.lenovo-legion-15ach6h-hybrid

With a custom nixos-hardware-override.nix module

# Hardware Overrides for Lenovo Legion 15ACH6H

{
  config,
  lib,

  pkgs,

  l5p-keyboard-rgb,

  ...
}:
{
  hardware.nvidia = {
    prime.amdgpuBusId = "PCI:5:0:0"; # See https://github.com/NixOS/nixos-hardware/issues/1388
    # powerManagement.finegrained = true; # causes deadlock after a timeout
  };

  # Add Lenovo Legion kernel module and userspace utility
  boot.extraModulePackages = [ config.boot.kernelPackages.lenovo-legion-module ];
  environment.systemPackages = with pkgs; [
    lenovo-legion
    l5p-keyboard-rgb.packages.${stdenv.hostPlatform.system}.default
  ];
}
4

After some more research, you need more memory for the image. Have you tried adding more swap memory?

5

Sidenote, your hardware-configuration.nix only contains a boot.initrd.luks entry for the root FS. Is your swap unencrypted? If so, that would both leak things that you probably expect to be encrypted as well as make secure boot virtually ineffective.

6

I have not yet, but there was enough before enabling secure boot, and it seems that the problem comes from secure boot itself

When UEFI secure boot is enabled (which I recently did via lanzaboote), the kernel automatically enforces kernel lockdown mode at the integrity level

7

yes, it is unencrypted for now, i wanted to switch to a dedicated encrypted LUKS swap volume, but I thought that if I needed to fix hibernation on secure boot, it would be easier to test without the added LUKS complexity

8

Not true. That’s a kernel patch that most distros ship, but mainline has rejected it. Since mainline rejects it, NixOS doesn’t ship it. Lockdown is not automatically enabled when secure boot is enabled. You would have to have lsm=lockdown in your kernel params for lockdown to be in effect.

EDIT: Oh you’re using the cachyos kernel. I guess they might ship that patch, but I have no idea.

EDIT2: Actually, no, I’m still quite sure you’re not using lockdown. Lanzaboote does not implement kernel module signing, and lockdown requires that. If you’re able to load kernel modules at all, lockdown is not enabled. And it’s very unlikely that NixOS would be usable or even bootable without kernel modules loading.

1 Like
9

Thanks for the notice, it made me try new workarounds.

I added boot.resumeDevice = "/dev/disk/by-uuid/bc2e19a0-d1ee-4fa5-abb2-3e8f3d8a7792"; to my configuration, then nh os boot it, and it worked again

Something very weird:

I tried to remove it and nh os boot again, and it still worked?

I am confused as to how that would be possible