You can, by having LVM on top of a LUKS or a swap file on a LUKS partition.
E.g. for a relative secure setup you can:
- use a custom platform key
- use EFIStub boot and bundle you kernel initramfs, flash screen image, kernel options, etc. into a single efi bootable blob
- sign that blob with your custom platform key (or enroll it's hash if you don't use a custom platform key).
- copy your secure boot signed early boot environment into the efi partition.
- have everything else in encrypted partitions including /boot (which your are not using)
- easiest way to have this is make a EFI partition and a single large encrypted partition and then use LVM (logic volume manager 2) on it to split it into swap, root, /home etc. Added benefit is you can easily resize them.
- now you just need to setup a way to decrypt on boot, e.g. by having a boot password, secure key or similar. You will need to provide it even if you boot from hibernation. (or you use the platforms TPM!)
Naturally you can also just ignore how hibernation breaks secure boot and set it up anyway. Your computer doesn't know you are braking the secure boot spec. But a company (like Ubuntu) might have committed to not brake the spec.
E.g. for a relative secure setup you can:
- use a custom platform key
- use EFIStub boot and bundle you kernel initramfs, flash screen image, kernel options, etc. into a single efi bootable blob
- sign that blob with your custom platform key (or enroll it's hash if you don't use a custom platform key).
- copy your secure boot signed early boot environment into the efi partition.
- have everything else in encrypted partitions including /boot (which your are not using)
- easiest way to have this is make a EFI partition and a single large encrypted partition and then use LVM (logic volume manager 2) on it to split it into swap, root, /home etc. Added benefit is you can easily resize them.
- now you just need to setup a way to decrypt on boot, e.g. by having a boot password, secure key or similar. You will need to provide it even if you boot from hibernation. (or you use the platforms TPM!)
Naturally you can also just ignore how hibernation breaks secure boot and set it up anyway. Your computer doesn't know you are braking the secure boot spec. But a company (like Ubuntu) might have committed to not brake the spec.