CRYPTSETUP-SUSPEND(7)

💤 CRYPTSETUP-SUSPEND 💤

okay bestie so this is cryptsetup-suspend, straight out of the cryptsetup manual, and it's literally about putting your LUKS devices to sleep before your whole system goes to sleep. let's get into it 🫶

---

✨ NAME ✨

cryptsetup-suspend — automatically suspend LUKS devices on system suspend

---

🎀 DESCRIPTION 🎀

cryptsetup-suspend is the girl who brings the support for automatically suspending LUKS devices before you enter system suspend mode. Periodt. Then when your system wakes back up (resume time), those devices get unlocked again — and yes, it will ask for passwords if it needs them. 🙈

The way you enable this feature? You just install the cryptsetup-suspend package. That's it. It's automatic. No further configuration is required. iconic behaviour, honestly.

cryptsetup-suspend supports all setups of LUKS devices that are supported by the cryptsetup packages. To pull that off, it depends on scripts from the Debian package cryptsetup-initramfs. If you wanna know the tea on how it actually works, scroll down to the INTERNALS section. 👑

---

🔐 SECURITY ASPECTS 🔐

So what does "suspending a LUKS device" even mean? Basically, it means removing the corresponding encryption keys from system memory. And why do we care? Because that protects you against all sorts of attacks that try to read out the memory from a suspended system — like, for example, cold-boot attacks. 💀

But listen, bestie, be real with yourself for a sec: cryptsetup-suspend protects only the encryption keys of your LUKS devices against being read from memory. Most likely there's more sensitive data hanging out in system memory — other kinds of private keys (e.g. OpenPGP, OpenSSH), or literally any kind of documents with sensitive content. So this is not a full-body security bubble. 🫧

Also the initramfs image is extracted in memory and left unencrypted (check the INTERNALS section for that), so all the key material it might include — for instance key files copied using the hooks' KEYFILE_PATTERN= option — will remain unprotected. just so you know. no surprises. 😭

---

🚧 LIMITATIONS 🚧

The cryptsetup-suspend feature is limited to LUKS devices, and it doesn't work with plain dm-crypt or tcrypt devices. that's the vibe check and it did not pass. 🙅‍♀️

---

🧚 INTERNALS 🧚

cryptsetup-suspend consists of three parts, and yes we're listing all of them:

• cryptsetup-suspend — a C program that takes a list of LUKS devices as arguments, suspends them via luksSuspend, and suspends the system afterwards.
• cryptsetup-suspend-wrapper — a shell wrapper script which works the following way:
  1. Disable swap and extract the initramfs into a tmpfs (the chroot)
  2. Run (systemd) pre-suspend scripts, stop udev, freeze cgroups
  3. run cryptsetup-suspend in chroot
  4. resume initramfs devices inside chroot after resume
  5. resume non-initramfs devices outside chroot
  6. thaw groups, start udev, run (systemd) post-suspend scripts
  7. Unmount the tmpfs and re-enable swap
• A systemd unit drop-in file that overrides the Exec property of systemd-suspend.service so that it invokes the script cryptsetup-suspend-wrapper.

---

👀 SEE ALSO 👀

• cryptsetup(8)
• crypttab(5)

---

💖 AUTHOR 💖

This manual page was written by Jonas Meurer <jonas@freesources.org> in December 2019. thank you king 🫶

---

and that's the whole page, bestie! this one shipped as part of cryptsetup 2:2.8.7-1ubuntu, dated 2026-09-12 — so go forth, suspend responsibly, and keep those encryption keys out of memory. slay 💅✨🌸