Ubuntu's TPM encryption switches to snap kernel that blocks deb kernel packages
a day ago
- Selecting 'Use hardware-backed disk encryption' in Ubuntu 24.04/26.04 installer silently installs a snap-based kernel and bootloader (like Ubuntu Core) instead of a standard deb-based system.
- This snap-based setup can break hardware such as webcams (e.g., on Dell Latitude 7450) because OEM hardware enablement packages depend on deb kernel and are incompatible with snap.
- Reinstalling with plain LUKS passphrase (no TPM) results in a normal deb-based system where all hardware, including the camera, works out of the box.
- TPM-FDE requires Secure Boot, which blocks loading unsigned kernel modules, making it difficult to fix broken hardware without losing TPM decryption.
- A workaround to get TPM auto-unlock on a deb system is to use 'clevis' and 'clevis-luks', though it lacks the same security level as the snap-based TPM-FDE.
- The issue was foreshadowed by community warnings three years ago; Canonical's installer does not clearly inform users of the architectural difference behind the TPM encryption checkbox.