A complete guide to enable hibernation on Fedora 43 (Workstation) with UEFI and btrfs filesystem, including fixes for Secure Boot and SELinux issues.
Run these commands in sequence to enable hibernation:
# Calculate swap size (RAM-based formula)
SWAPSIZE=$(free | awk '/Mem/ {x=$2/1024/1024; printf "%.0fG", (x<2 ? 2*x : x<8 ? 1.5*x : x) }')
SWAPFILE=/var/swap/swapfile
# Create btrfs subvolume and swap file
sudo btrfs subvolume create /var/swap
sudo btrfs filesystem mkswapfile --size $SWAPSIZE --uuid clear $SWAPFILE
# Enable swap file
echo $SWAPFILE none swap defaults 0 0 | sudo tee --append /etc/fstab
sudo swapon --all --verbose
# Configure dracut for resume
echo 'add_dracutmodules+=" resume "' | sudo tee /etc/dracut.conf.d/resume.conf
sudo dracut --force --verbose
# Fix SELinux permissions (critical!)
sudo semanage fcontext --add --type swapfile_t $SWAPFILE
sudo restorecon -RF /var/swap
# Test hibernation
sudo systemctl hibernateVerify your system uses UEFI:
bootctlIf this prints "Not booted with EFI", this method won't work.
Important: Hibernation requires Secure Boot to be disabled in BIOS/UEFI settings.
With Secure Boot enabled, you'll get:
Call to Hibernate failed: Sleep verb 'hibernate' is not configured or configuration is not supported by kernel
To disable: Reboot → BIOS/UEFI settings (F2/F10/F12/Del) → Security/Boot menu → Disable Secure Boot → Save and exit.
Why? Kernel lockdown (enabled with Secure Boot) prevents hibernation to unencrypted swap for security reasons.
The command btrfs filesystem mkswapfile automatically:
- Disables copy-on-write (COW) for the swap file
- Creates the file with proper attributes
- Avoids the "swapfile must not be copy-on-write" error
Using standard mkswap will fail on btrfs without additional COW disabling steps.
The swap file is added to /etc/fstab for persistence across reboots and activated immediately. Verify with swapon --show - you should see both your swap file and the existing zram device.
The --verbose flag is important - without it, dracut appears to hang with no output for 2-5 minutes. It shows progress and confirms the command is working.
Critical step often missed! Without proper SELinux labeling, you'll get "Access denied" errors even when running as root. These commands tag the swap file with the swapfile_t type that SELinux expects.
# Verify swap is active
swapon --show
# Check security configuration
fwupdmgr security
# Verify SELinux context
ls -Z /var/swap/swapfileExpected fwupdmgr security output:
✔ UEFI secure boot: Disabled
✘ Linux kernel lockdown: Disabled (expected for hibernation)
✘ Linux swap: Invalid (unencrypted swap present)
Cause: Secure Boot is still enabled
Solution: Disable Secure Boot in BIOS/UEFI settings
Cause: SELinux policy not configured
Solution: Run the SELinux commands from the reference above and verify with ls -Z /var/swap/swapfile (should show swapfile_t)
Cause: No progress output by default (takes 2-5 minutes)
Solution: Use --verbose flag as shown in the command reference
Cause: Using standard mkswap instead of btrfs-specific command
Solution: Use btrfs filesystem mkswapfile as shown in the command reference
-
zram remains active: The existing zram swap device continues to work alongside the swap file. zram has higher priority for normal swap operations; the disk-based swap file is used primarily for hibernation.
-
Swap file location: The swap file is in
/var/swap/as a separate btrfs subvolume, isolating it from snapshots. -
Suspend vs Hibernate:
- Suspend: RAM stays powered, fast resume, drains battery slowly
- Hibernate: RAM saved to disk, complete power off, slower resume, no battery drain
- Suspend-then-hibernate:
systemctl suspend-then-hibernate(suspends first, hibernates after timeout)
On UEFI systems, hibernation uses a streamlined process:
- systemd stores swap file location in a UEFI variable
- System writes memory contents to swap file
- Machine powers off completely
- On boot, bootloader reads the UEFI variable
- Kernel resumes from swap file location
- Memory is restored and execution continues
This is simpler than legacy BIOS systems that required manual boot parameter configuration.
Based on: Fedora Magazine - Update on hibernation in Fedora Workstation
Additional references:
- Arch Wiki - Dracut Hibernation
- btrfs Wiki - Swap File Support
- Forum post by Ben (January 28, 2025) - SELinux configuration fix
Key improvements over original article:
- Uses
btrfs filesystem mkswapfileinstead of standardmkswap(avoids COW issues) - Includes SELinux configuration (prevents "Access denied" errors)
- Documents Secure Boot requirement (must be disabled)
- Uses
--verboseflag for dracut (shows progress) - Complete troubleshooting section
Tested on: Fedora 43 Workstation, UEFI boot, btrfs filesystem
Last updated: February 2026
This guide is provided as-is for the community. Feel free to share, modify, and improve.
@random-integer
mokutil --disable-validationis not required for an encrypted (or unencrypted) swap partition. It is only needed if you want to use hibernation with Secure Boot, swap will work regardless.mokutil --disable-validationdisables Secure Boot validation. When Secure Boot is enabled, your system verifies that the Linux kernel is legitimate and hasn't been tampered with while the machine was powered off. When you hibernate, your RAM is copied to the swap partition. Ideally, Linux should verify on the next boot that the swap contents are exactly what it saved. However, Linux does not currently support this. (There is reportedly a modified kernel that does support it.)