From: Pavel Machek <pavel@ucw.cz> To: Matthew Garrett <matthewgarrett@google.com> Cc: jmorris@namei.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dhowells@redhat.com Subject: Re: [PATCH 09/27] hibernate: Disable when the kernel is locked down Date: Tue, 19 Mar 2019 23:15:01 +0100 Message-ID: <20190319221501.GA31551@amd> (raw) In-Reply-To: <20190228231203.212359-9-matthewgarrett@google.com> [-- Attachment #1: Type: text/plain, Size: 1274 bytes --] On Thu 2019-02-28 15:11:45, Matthew Garrett wrote: > From: Josh Boyer <jwboyer@fedoraproject.org> > > There is currently no way to verify the resume image when returning > from hibernate. This might compromise the signed modules trust model, > so until we can work with signed hibernate images we disable it when the > kernel is locked down. > > Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> > Signed-off-by: David Howells <dhowells@redhat.com> > Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> > cc: linux-pm@vger.kernel.org It would be good to cc hibernation maintainers here. > --- > kernel/power/hibernate.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c > index abef759de7c8..802795becb88 100644 > --- a/kernel/power/hibernate.c > +++ b/kernel/power/hibernate.c > @@ -70,7 +70,7 @@ static const struct platform_hibernation_ops *hibernation_ops; > > bool hibernation_available(void) > { > - return (nohibernate == 0); > + return nohibernate == 0 && !kernel_is_locked_down("Hibernation"); > } > > /** -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html [-- Attachment #2: Digital signature --] [-- Type: application/pgp-signature, Size: 181 bytes --]
next prev parent reply index Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-02-28 21:28 [PULL REQUEST] Lock down patches Matthew Garrett 2019-02-28 22:20 ` Mimi Zohar 2019-02-28 23:13 ` Matthew Garrett 2019-03-01 0:05 ` Mimi Zohar 2019-03-01 1:01 ` Matthew Garrett 2019-03-01 1:44 ` Mimi Zohar 2019-03-01 3:33 ` Matthew Garrett 2019-03-01 4:16 ` Mimi Zohar 2019-02-28 22:44 ` [PATCH 01/27] Add the ability to lock down access to the running kernel image Matthew Garrett 2019-02-28 22:44 ` [PATCH 02/27] Add a SysRq option to lift kernel lockdown Matthew Garrett 2019-02-28 23:10 ` [PATCH 01/27] Add the ability to lock down access to the running kernel image Matthew Garrett 2019-02-28 23:10 ` [PATCH 02/27] Add a SysRq option to lift kernel lockdown Matthew Garrett 2019-02-28 23:11 ` [PATCH 01/27] Add the ability to lock down access to the running kernel image Matthew Garrett 2019-02-28 23:11 ` [PATCH 02/27] Add a SysRq option to lift kernel lockdown Matthew Garrett 2019-02-28 23:11 ` [PATCH 01/27] Add the ability to lock down access to the running kernel image Matthew Garrett 2019-02-28 23:11 ` [PATCH 02/27] Add a SysRq option to lift kernel lockdown Matthew Garrett 2019-02-28 23:11 ` [PATCH 03/27] Enforce module signatures if the kernel is locked down Matthew Garrett 2019-02-28 23:11 ` [PATCH 04/27] Restrict /dev/{mem,kmem,port} when " Matthew Garrett 2019-02-28 23:11 ` [PATCH 05/27] kexec_load: Disable at runtime if " Matthew Garrett 2019-02-28 23:11 ` [PATCH 06/27] Copy secure_boot flag in boot params across kexec reboot Matthew Garrett 2019-02-28 23:11 ` [PATCH 07/27] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE Matthew Garrett 2019-02-28 23:11 ` [PATCH 08/27] kexec_file: Restrict at runtime if the kernel is locked down Matthew Garrett 2019-03-01 2:05 ` Mimi Zohar 2019-02-28 23:11 ` [PATCH 09/27] hibernate: Disable when " Matthew Garrett 2019-03-19 22:15 ` Pavel Machek [this message] 2019-02-28 23:11 ` [PATCH 10/27] uswsusp: " Matthew Garrett 2019-02-28 23:11 ` [PATCH 11/27] PCI: Lock down BAR access " Matthew Garrett 2019-02-28 23:11 ` [PATCH 12/27] x86: Lock down IO port " Matthew Garrett 2019-02-28 23:11 ` [PATCH 13/27] x86/msr: Restrict MSR " Matthew Garrett 2019-02-28 23:11 ` [PATCH 14/27] ACPI: Limit access to custom_method " Matthew Garrett 2019-02-28 23:11 ` [PATCH 15/27] acpi: Ignore acpi_rsdp kernel param when the kernel has been " Matthew Garrett 2019-02-28 23:11 ` [PATCH 16/27] acpi: Disable ACPI table override if the kernel is " Matthew Garrett 2019-02-28 23:11 ` [PATCH 17/27] acpi: Disable APEI error injection " Matthew Garrett 2019-02-28 23:11 ` [PATCH 18/27] Prohibit PCMCIA CIS storage when " Matthew Garrett 2019-02-28 23:11 ` [PATCH 19/27] Lock down TIOCSSERIAL Matthew Garrett 2019-02-28 23:11 ` [PATCH 20/27] Lock down module params that specify hardware parameters (eg. ioport) Matthew Garrett 2019-02-28 23:11 ` [PATCH 21/27] x86/mmiotrace: Lock down the testmmiotrace module Matthew Garrett 2019-02-28 23:11 ` [PATCH 22/27] Lock down /proc/kcore Matthew Garrett 2019-02-28 23:11 ` [PATCH 23/27] Lock down kprobes Matthew Garrett 2019-02-28 23:12 ` [PATCH 24/27] bpf: Restrict kernel image access functions when the kernel is locked down Matthew Garrett 2019-02-28 23:12 ` [PATCH 25/27] Lock down perf Matthew Garrett 2019-02-28 23:12 ` [PATCH 26/27] debugfs: Restrict debugfs when the kernel is locked down Matthew Garrett 2019-02-28 23:12 ` [PATCH 27/27] lockdown: Print current->comm in restriction messages Matthew Garrett 2019-02-28 23:24 ` [PULL REQUEST] Lock down patches Randy Dunlap 2019-03-04 22:10 ` Matthew Garrett 2019-03-06 23:58 [PULL REQUEST] Kernel lockdown patches for 5.2 Matthew Garrett 2019-03-06 23:58 ` [PATCH 09/27] hibernate: Disable when the kernel is locked down Matthew Garrett 2019-03-07 14:55 ` Alan Cox 2019-03-07 17:32 ` Matthew Garrett 2019-03-18 18:55 ` Alan Cox
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190319221501.GA31551@amd \ --to=pavel@ucw.cz \ --cc=dhowells@redhat.com \ --cc=jmorris@namei.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=matthewgarrett@google.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
LKML Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \ linux-kernel@vger.kernel.org public-inbox-index lkml Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel AGPL code for this site: git clone https://public-inbox.org/public-inbox.git