From: "Rafael J. Wysocki" <rjw@rjwysocki.net>
To: Pavel Machek <pavel@ucw.cz>
Cc: David Howells <dhowells@redhat.com>,
jikos@suse.cz, torvalds@linux-foundation.org,
linux-man@vger.kernel.org, linux-api@vger.kernel.org,
jmorris@namei.org, linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org
Subject: Re: [PATCH 07/24] hibernate: Disable when the kernel is locked down
Date: Thu, 26 Apr 2018 09:34:28 +0200 [thread overview]
Message-ID: <4403604.jesDZjvsch@aspire.rjw.lan> (raw)
In-Reply-To: <20180426072646.GA31822@amd>
On Thursday, April 26, 2018 9:26:46 AM CEST Pavel Machek wrote:
> On Thu 2018-04-19 15:38:53, David Howells wrote:
> > Pavel Machek <pavel@ucw.cz> wrote:
> >
> > > > There is currently no way to verify the resume image when returning
> > > > from hibernate. This might compromise the signed modules trust model,
> > > > so until we can work with signed hibernate images we disable it when the
> > > > kernel is locked down.
> > >
> > > I'd rather see hibernation fixed than disabled like this.
> >
> > The problem is that you have to store the hibernated kernel image encrypted,
> > but you can't store the decryption key on disk unencrypted or you've just
> > wasted the effort.
>
> That's not how the crypto needs to work. Talk to Jiri Kosina, ok?
>
> Firmware gives you a key, you keep it secret, use it to sign the
> hibernation image on suspend, and verify the signature on resume. Or
> something like that.
A simplified approach might be to encrypt the image during hibernation
using a user-provided passphrase and then ask for that passphrase during
resume to decrypt the image.
The attacker would then need to know the passphrase to substitute their
own image for the original one successfully.
WARNING: multiple messages have this Message-ID (diff)
From: rjw@rjwysocki.net (Rafael J. Wysocki)
To: linux-security-module@vger.kernel.org
Subject: [PATCH 07/24] hibernate: Disable when the kernel is locked down
Date: Thu, 26 Apr 2018 09:34:28 +0200 [thread overview]
Message-ID: <4403604.jesDZjvsch@aspire.rjw.lan> (raw)
In-Reply-To: <20180426072646.GA31822@amd>
On Thursday, April 26, 2018 9:26:46 AM CEST Pavel Machek wrote:
> On Thu 2018-04-19 15:38:53, David Howells wrote:
> > Pavel Machek <pavel@ucw.cz> wrote:
> >
> > > > There is currently no way to verify the resume image when returning
> > > > from hibernate. This might compromise the signed modules trust model,
> > > > so until we can work with signed hibernate images we disable it when the
> > > > kernel is locked down.
> > >
> > > I'd rather see hibernation fixed than disabled like this.
> >
> > The problem is that you have to store the hibernated kernel image encrypted,
> > but you can't store the decryption key on disk unencrypted or you've just
> > wasted the effort.
>
> That's not how the crypto needs to work. Talk to Jiri Kosina, ok?
>
> Firmware gives you a key, you keep it secret, use it to sign the
> hibernation image on suspend, and verify the signature on resume. Or
> something like that.
A simplified approach might be to encrypt the image during hibernation
using a user-provided passphrase and then ask for that passphrase during
resume to decrypt the image.
The attacker would then need to know the passphrase to substitute their
own image for the original one successfully.
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2018-04-26 7:34 UTC|newest]
Thread overview: 123+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-11 16:24 [PATCH 00/24] security: Add kernel lockdown David Howells
2018-04-11 16:24 ` David Howells
2018-04-11 16:24 ` [PATCH 01/24] Add the ability to lock down access to the running kernel image David Howells
2018-04-11 16:24 ` David Howells
2018-04-11 16:44 ` Jann Horn
2018-04-11 16:44 ` Jann Horn
2018-04-11 17:37 ` Randy Dunlap
2018-04-11 17:37 ` Randy Dunlap
2018-04-11 18:50 ` Miguel Ojeda
2018-04-11 18:50 ` Miguel Ojeda
2018-04-11 19:56 ` Greg KH
2018-04-11 19:56 ` Greg KH
2018-04-11 17:49 ` David Howells
2018-04-11 17:49 ` David Howells
2018-04-11 18:09 ` Linus Torvalds
2018-04-11 18:09 ` Linus Torvalds
2018-04-11 18:35 ` Justin Forbes
2018-04-11 18:35 ` Justin Forbes
2018-04-11 21:05 ` Jordan Glover
2018-04-11 21:05 ` Jordan Glover
2018-04-11 22:38 ` Linus Torvalds
2018-04-11 22:38 ` Linus Torvalds
2018-04-12 13:09 ` Justin Forbes
2018-04-12 13:09 ` Justin Forbes
2018-04-12 16:52 ` Linus Torvalds
2018-04-12 16:52 ` Linus Torvalds
2018-04-12 2:57 ` Andy Lutomirski
2018-04-12 2:57 ` Andy Lutomirski
2018-04-11 16:24 ` [PATCH 02/24] Add a SysRq option to lift kernel lockdown David Howells
2018-04-11 16:24 ` David Howells
2018-04-11 17:05 ` Jann Horn
2018-04-11 17:05 ` Jann Horn
2018-04-13 20:22 ` Pavel Machek
2018-04-11 16:24 ` [PATCH 03/24] ima: require secure_boot rules in lockdown mode David Howells
2018-04-11 16:24 ` David Howells
2018-04-11 16:25 ` [PATCH 04/24] Enforce module signatures if the kernel is locked down David Howells
2018-04-11 16:25 ` David Howells
2018-04-11 16:25 ` [PATCH 05/24] Restrict /dev/{mem, kmem, port} when " David Howells
2018-04-11 16:25 ` David Howells
2018-04-11 16:25 ` [PATCH 06/24] kexec_load: Disable at runtime if " David Howells
2018-04-11 16:25 ` David Howells
2018-04-11 19:00 ` Eric W. Biederman
2018-04-11 19:00 ` Eric W. Biederman
2018-04-11 20:09 ` Mimi Zohar
2018-04-11 20:09 ` Mimi Zohar
2018-04-12 11:38 ` Mimi Zohar
2018-04-12 11:38 ` Mimi Zohar
2018-04-11 20:05 ` David Howells
2018-04-11 20:05 ` David Howells
2018-04-11 20:05 ` David Howells
2018-04-11 16:25 ` [PATCH 07/24] hibernate: Disable when " David Howells
2018-04-11 16:25 ` David Howells
2018-04-13 20:22 ` Pavel Machek
2018-04-19 14:38 ` David Howells
2018-04-19 14:38 ` David Howells
2018-04-22 14:34 ` Andy Lutomirski
2018-04-22 14:34 ` Andy Lutomirski
2018-04-26 7:26 ` Pavel Machek
2018-04-26 7:34 ` Rafael J. Wysocki [this message]
2018-04-26 7:34 ` Rafael J. Wysocki
2018-04-26 8:20 ` Jiri Kosina
2018-04-26 8:20 ` Jiri Kosina
2018-05-23 8:46 ` joeyli
2018-05-23 8:46 ` joeyli
2018-04-11 16:25 ` [PATCH 08/24] uswsusp: " David Howells
2018-04-11 16:25 ` David Howells
2018-04-11 16:25 ` [PATCH 09/24] PCI: Lock down BAR access " David Howells
2018-04-11 16:25 ` David Howells
2018-04-11 16:25 ` [PATCH 10/24] x86: Lock down IO port " David Howells
2018-04-11 16:25 ` David Howells
2018-04-11 16:25 ` [PATCH 11/24] x86/msr: Restrict MSR " David Howells
2018-04-11 16:25 ` David Howells
2018-04-11 16:25 ` [PATCH 12/24] ACPI: Limit access to custom_method " David Howells
2018-04-11 16:25 ` David Howells
2018-04-11 16:26 ` [PATCH 13/24] acpi: Ignore acpi_rsdp kernel param when the kernel has been " David Howells
2018-04-11 16:26 ` David Howells
2018-04-11 16:26 ` [PATCH 14/24] acpi: Disable ACPI table override if the kernel is " David Howells
2018-04-11 16:26 ` David Howells
2018-04-11 16:26 ` [PATCH 15/24] acpi: Disable APEI error injection " David Howells
2018-04-11 16:26 ` David Howells
2018-04-11 16:26 ` [PATCH 16/24] Prohibit PCMCIA CIS storage when " David Howells
2018-04-11 16:26 ` David Howells
2018-04-11 16:26 ` [PATCH 17/24] Lock down TIOCSSERIAL David Howells
2018-04-11 16:26 ` David Howells
2018-04-11 16:26 ` [PATCH 18/24] Lock down module params that specify hardware parameters (eg. ioport) David Howells
2018-04-11 16:26 ` David Howells
2018-04-11 17:22 ` Randy Dunlap
2018-04-11 17:22 ` Randy Dunlap
2018-04-11 16:26 ` [PATCH 19/24] x86/mmiotrace: Lock down the testmmiotrace module David Howells
2018-04-11 16:26 ` David Howells
2018-04-11 16:26 ` [PATCH 20/24] Lock down /proc/kcore David Howells
2018-04-11 16:26 ` David Howells
2018-04-11 16:26 ` [PATCH 21/24] Lock down kprobes David Howells
2018-04-11 16:26 ` David Howells
2018-04-11 16:27 ` [PATCH 22/24] bpf: Restrict kernel image access functions when the kernel is locked down David Howells
2018-04-11 16:27 ` David Howells
2018-04-11 16:27 ` [PATCH 23/24] Lock down perf David Howells
2018-04-11 16:27 ` David Howells
2018-04-11 16:27 ` [PATCH 24/24] debugfs: Restrict debugfs when the kernel is locked down David Howells
2018-04-11 16:27 ` David Howells
2018-04-11 17:26 ` Randy Dunlap
2018-04-11 17:26 ` Randy Dunlap
2018-04-11 18:50 ` Eric W. Biederman
2018-04-11 18:50 ` Eric W. Biederman
2018-04-11 19:54 ` Greg KH
2018-04-11 19:54 ` Greg KH
2018-04-11 20:08 ` David Howells
2018-04-11 20:08 ` David Howells
2018-04-11 20:08 ` David Howells
2018-04-11 20:09 ` David Howells
2018-04-11 20:09 ` David Howells
2018-04-11 20:33 ` Greg KH
2018-04-11 20:33 ` Greg KH
2018-04-12 2:54 ` Andy Lutomirski
2018-04-12 2:54 ` Andy Lutomirski
2018-04-12 8:23 ` Greg KH
2018-04-12 8:23 ` Greg KH
2018-04-12 14:19 ` Andy Lutomirski
2018-04-12 14:19 ` Andy Lutomirski
2018-04-13 20:22 ` Pavel Machek
2018-04-19 14:35 ` David Howells
2018-04-19 14:35 ` David Howells
2018-05-10 11:01 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4403604.jesDZjvsch@aspire.rjw.lan \
--to=rjw@rjwysocki.net \
--cc=dhowells@redhat.com \
--cc=jikos@suse.cz \
--cc=jmorris@namei.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-man@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=pavel@ucw.cz \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.