Arch Linux

AbsoluteZero

Member

Registered: 2014-03-08

Posts: 8

Website

luksSuspend and luksResume with Gnome Screen Lock

Hello,

I was surprised I couldn't find an answer to this question on the wiki or the wider web, which probably means I have a misunderstanding of the problem.

I have a LUKS/dm-crypt home directory and I'm using the Gnome3/GDM DE. When I lock my screen or close my laptop lid, the Gnome lock screen program seems to keep my device unlocked (the keys are still in memory).

Is there any way to get the Gnome lock screen program to call luksSuspend when the screen is locked and then prompt for a password and call luksResume when the screen is unlocked?

I imagine this could be problematic if the Gnome lock screen does I/O in ~/... since luksSuspend will make all these I/O calls hang. But I can't imagine the Gnome lock screen should need to access anything in my home folder.

If not, I understand there is a "lock screen" dbus message -- could I intercept this message and provide this functionality myself?

Edit: I should mention that I did find this https://github.com/vianney/arch-luks-suspend and the associated AUR package, but this doesn't seem like what I want to do -- since I only want to lock my home directory and I'm fairly certain that shouldn't require any kernel hooks...

Last edited by AbsoluteZero (2018-04-18 14:28:25)

frostschutz

Member

Registered: 2013-11-15

Posts: 1,658

Re: luksSuspend and luksResume with Gnome Screen Lock

You would halt any program that does I/O while the screen is locked. A running download? Fetch mails? Play music? Encode a movie in the background? A chat client no longer able to write its logfiles? None of that will work anymore while the screen is locked.

Usually that is not what you want. Screen locks are temporary and stuff is meant to keep working the background. Also there is no way of telling how various software will react to I/O requests being frozen indefinitely. You will see strange errors and side effects.

It's meant for suspend to disk, when you actually shut down / hibernate the PC entirely and have it ask the passphrase on resume. I.e. a situation where all programs are suspended too (not just their I/O).

For the implementation, for it to be reliable, you either need unencrypted root or an initramfs that provides a working cryptsetup binary to issue the luksResume with. That plus any dependencies needed to display a dialog or whatever.

It's complicated enough that a lot of people simply - don't use it at all.

Last edited by frostschutz (2018-04-18 17:17:23)