Hacker News Reader

Comment by deckard1 | Hacker News Reader

It's going to depend on your hardware and probably your distro.

I have a ThinkPad running Archlinux. I have suspend-then-hibernate mode enabled, which means when I close my laptop lid it suspends for 2 hours (configurable) and then puts itself into hibernate. If I decide to open the laptop within 2 hours, it's available instantly. Otherwise, it takes maybe 20 seconds to reanimate from hibernation. People often say, why not just shutdown and reboot? The obvious answer is that I don't want to close out a dozen Chrome tabs, close all my terminals, all my files, and open everything up every time I need to walk away from the computer.

I have secure boot turned on. Hibernation is done to a swap file (I can simply delete the file if I need the space). I have LUKS encryption enabled. I'm dual booting with Windows. And yes, it all does work perfectly fine.

You can have your cake and eat it too. It just takes a bit of research and a bit of time to setup.

View on HN

Because you mentioned secure boot and encryption: Matthew Garrett wrote an interesting blog post a while ago on making hibernation work with lockdown mode, i.e. verifying that the hibernation image wasn't tampered with. Otherwise it might be possible to get around the whole secure boot chain by writing a compromised kernel to a hibernation image. It's quite interesting to think about, even if it isn't necessarily something you as a user should need to think about (distros should probably handle it): https://mjg59.dreamwidth.org/55845.html

I read up a bit on this when I was setting it up.

> What ensures that the hibernation image was actually written out by the kernel? Absolutely nothing, which means a motivated attacker with root access could turn off swap, write a hibernation image to the swap partition themselves, and then reboot

Maybe I'm just really thick, but I can't think of a reason to care that root could bypass secure boot. The attacker already has access to the entire system and I would usually assume the valuable part of that access is the data and not the hardware or the kernel. This is an attack at a level beyond the typical "evil maid" with physical level access.

Besides that, I'm not sure what would stop anyone from just tampering with pacman, mkinitcpio, or other things and just wait until the next kernel is being built and redeployed to have their fun. You're going to have to upgrade your kernel at some point, and you'll need some kind of tools to do so.

There's probably a very thin line between the threat that secure boot protects against and someone beating me to death for my password.

No, this isn't beyond evil maid - it doesn't require physical access, it only requires root access.

Increasingly, root and kernel access aren't the same thing any more (if you enable lockdown mode). That stops root from doing a whole bunch of things. It's true that often, user-level access is enough (if you only care about the user's data). But if you want to modify syscalls or do some other thing that root may not do in lockdown mode, you'll need to get kernel access. And many other ways of getting there have been blocked in an attempt to strengthen the barrier between root and kernel (some dispute the utility of that separation, but I think it's because they fundamentally reject its goals). This is about closing another hole in the barrier.

How useful that barrier is against attacks of the https://xkcd.com/538/ kind is, of course, a different matter. In my view, the point is that it raises the cost.

> You can have your cake and eat it too.

Can you get gpu accelerated video playback in Firefox/Chrome? For me these days, "having your cake and eating it too" means running linux on a virtual machine.

ah, well yeah I didn't mean all Linux issues are solved.

I have hardware accel running in Chromium. It's really glitchy and would not recommend it. I'd probably just use mpv or vnc if you need hardware accel video.

Really, my biggest gripe with Chromium is that it does not yet support kinetic scrolling with a touchpad. Firefox supports it, however it's still not as comfortable as my Macbook.

Works fine with me with amdgpu. It's included in Firefox by default and it works great after enabling it.

My current papercut is that 4k@60hz does not work with an Lenovo Gen 2 USB-C dock, while it works fine in Windows:

https://gitlab.freedesktop.org/drm/amd/-/issues/1317

(I didn't report this, but am running into the same issue.)

> Can you get gpu accelerated video playback in Firefox[...]?

Yes. (not with nvidia drivers.)

I haven't been diligent about secure boot. I could imlrove. With regard to hibernation, I avoided hibernation for years under the assumption that it was untrustworthy. Sleep felt "sufficient", safe.

But at some point I noticed that laptops I'd left for a long time without power would wake up & resume. I'd expected they had run out of juice while asleep & I'd have to boot fresh.

Turns out systemd (in my Debian OSes at least) was set up to hibernate at a very low critical % of power remaining. The laptop would rouse from sleep & hibernate, at the last minute (and change). And it was working fine.

After seeing it happen a bunch of times I decided to try to embrace hibernation, & remapped my power button from sleep to hibernate. Everything worked great! Now my computers drain no battery when not active. I love it. Been this way for half a decade now. Works great.

Bonus, one of my laptops would, when it woke up from sleep, "lose" it's wifi card. With hibernate, that laptop's wifi card shows up again, even if it had lost the card to sleep before. Hibernate, contrary to my expectations, was even safer than sleep.

And it's really easy to setup hibernate on archlinux.

Just echo "disk" or "mem" or "freeze" to /sys/power/state with sudo to make it sleep / suspend / hibernate.

If you want to lock the screen as well, run `i3lock -d -c 000000` or `xlock` before updating the power state.

Out of curiosity, do you know the functional difference between a swap file and a swap partition? A swap file seems like quite a bit more added complexity with very few benefits.

The kernel cheats: on start up it figures out which sectors the swap file uses (best if it is contiguous on the drive) and doesn't actually use the file system to read/write swap. This allows it to achieve the same performance for a file as a partition.

The advantage is that files are much easier to change (extend) than a disk partition.

Ref:

https://askubuntu.com/questions/904372/swap-partition-vs-swa...

https://askubuntu.com/questions/927854/how-do-i-increase-the...

How does that work with log-structured filesystems (or any filesystem that does online defragmentation)?

AFAIK it doesn't, it expects a continuous file without fragmentation.

On btrfs systems, for example, I have to set a bit to disable COW for the file to be used as a swapfile, otherwise it will not work.

ZFS zvol works as swap even though CoW can't be disabled, how does it work?

Edit: I found that zvol is virtual volume so anyway it should be handled by zfs.

I also found mention about the bypass mechanism. http://lkml.iu.edu/hypermail/linux/kernel/0507.0/1690.html

Reply on news.ycombinator.com