Enabling Ubuntu's TPM encryption switches you to a snap kernel that blocks deb kernel packages · bare.systemsEnabling Ubuntu's TPM encryption switches you to a snap kernel that blocks deb kernel packages<br>date2026-05-14categorylinux · hardware · delllength1,442 words · 7 minTL;DR: Rediscovering that on Ubuntu 24.04 and 26.04, ticking “Use hardware-backed disk encryption” in the installer silently gives you a snap-based system (snap kernel and bootloader, like Ubuntu Core) instead of a normal deb-based one. On a modern laptop, this can breaks hardware enablement, in my case the webcam, with no supported way to fix it or have an equivalent feature set.<br>I got my hands on a Dell Latitude 7450, certified with Ubuntu 22.04 (this Ubuntu blog post on the certification process is worth a read), and decided to try a newer LTS version. Ubuntu 26.04 was out but really new, so I decided to start with 24.04. I downloaded the ISO, ticked the disk encryption checkbox using TPM (I had to disable third-party drivers for that), and found myself with a system where the camera was not working.<br>In the past, I never had a flawless experience using Ubuntu on a laptop, but those were from non-certified machines. The Latitude 7450 had Canonical’s blessing, so what was going on? Surprisingly, reinstalling with the same ISO and ticking a different encryption checkbox (LVM with passphrase) makes the camera work out of the box.<br>Let’s try to figure out what happened.<br>Discovering the issue in vanilla 24.04<br>Initially, on my 24.04 installation, most just worked out-of-the-box. Ubuntu installed a meta package oem-somerville-oddish-meta (“Somerville” is Dell’s OEM program, “Oddish” the codename for this laptop, yes like the Pokémon), adding Dell’s apt archive to my sources, so I was confident about compatibility. After verifications the iGPU, Wi-Fi, audio, fingerprint reader and Thunderbolt all worked. It seemed the work Dell did building their Latitude_7450_Latitude_7650_Ubuntu_2204_A01_Recovery_image.iso 22.04 had since moved upstream, good job!<br>Except…<br>The camera doesn’t work, and nothing can fix it<br>The webcam was the obvious omission, with no /dev/video* at all. The hardware was fine (the laptop was new, and lsusb showed the chip). dkms status listed the IPU6 camera modules as registered but never built. Searching the internet, the recipe for this exact problem was: install the pre-built camera modules from Dell’s archive instead of the DKMS ones, add v4l2-relayd, reboot, done. Surprise surprise, it did not install:<br>$ sudo apt install linux-modules-ipu6-generic ...<br>linux-modules-ipu6-6.8.0-111-generic : Depends: linux-image-6.8.0-111-generic but it is not going to be installed<br>The modules need a kernel image to attach to. Alright, let’s get that kernel image:<br>$ sudo apt install linux-image-6.8.0-111-generic linux-modules-ipu6-generic ...<br>boot-managed-by-snapd : Conflicts: linux-image, grub-efi-amd64, grub-pc,<br>linux-firmware, shim-signed ...<br>Oh no.<br>My kernel is a snap!<br>I was taken aback, what did boot-managed-by-snapd mean? I knew the word boot, and I knew the word snap, but a snap-managed boot? It was conflicting with linux-image, GRUB, shim, linux-firmware, basically everything Debian-based systems use to boot.<br>$ cat /proc/cmdline<br>snapd_recovery_mode=run console=tty1 ...<br>$ snap list | grep pc-kernel<br>pc-kernel 6.8.0-110.110 3374 24/stable canonical✓ kernel<br>$ dpkg -l | grep linux-image<br>(no output)<br>$ ls /boot/efi<br>ls: cannot access '/boot/efi': No such file or directory<br>There was no deb kernel, no /boot/efi. My kernel was a snap, and I didn’t know what to make of it. After some research, I learned about Ubuntu Core, actually a pretty cool immutable distro for embedded devices, but this was not what I thought I was installing for my normal laptop use. Having installed Debian and Ubuntu dozens of times, I couldn’t figure out what I’d done differently.<br>A dead end with the camera on the snap side<br>Could I get the camera working anyway, staying on the snap kernel? The pre-built modules were there, so that left building them with DKMS. They built fine, but would not load:<br>$ sudo modprobe intel_ipu6<br>modprobe: ERROR: could not insert 'intel_ipu6': Key was rejected by service<br>Secure Boot, which TPM-FDE requires, refused unsigned modules. To sign my own I’d need to enroll a key, which changes PCR 7, which is what the TPM is using for decryption. I could recover from that with the recovery key, but the documentation is blunt about the side-effect: “On subsequent boots, you have to continue using your recovery key.” There’s no supported way to reconverge after that. On this kernel, I was hitting a dead end for the camera.<br>I still didn’t know why the camera was missing in the first place, so I decided to reinstall without TPM encryption, giving me a chance to disable Secure Boot and try again.<br>Reinstalling: plot twist<br>I...