While maybe not the most performant my favorite
is LVM2 on top of a single large LUKS-encrypted partition (+no boot partition and a single (custom platform key) signed EFI bootable kernel blob containing the initram fs in the EFI partition).
This:
- Allows a encrypted swap partition (on in lvm2 on top of luks, sure not perfect but I don't really use swap)
- Allows hibernation (which I don't really use tbh.)
- Fully encrypted disc
- Fast boot (compared to e.g. encrypted grub, at least last time I checked)
- Easy resizing of partitions on demand
- Which in turn makes it easier to use more partitions (for /, /home, etc.), which is necessary for taking advantage of certain mount flags like noexec for security.
Anyway I think the reason Ubuntu uses a swap file is because it means you don't need to resize a partition when "upgrading" your RAM or similar (for hibernation to work). Through tbh. they should make the choice in the installer dependent of the hardware.
This:
- Allows a encrypted swap partition (on in lvm2 on top of luks, sure not perfect but I don't really use swap)
- Allows hibernation (which I don't really use tbh.)
- Fully encrypted disc
- Fast boot (compared to e.g. encrypted grub, at least last time I checked)
- Easy resizing of partitions on demand
- Which in turn makes it easier to use more partitions (for /, /home, etc.), which is necessary for taking advantage of certain mount flags like noexec for security.
Anyway I think the reason Ubuntu uses a swap file is because it means you don't need to resize a partition when "upgrading" your RAM or similar (for hibernation to work). Through tbh. they should make the choice in the installer dependent of the hardware.