Re: [PATCH V34 10/29] hibernate: Disable when the kernel is locked down

Hi,

On Mon, Jun 24, 2019 at 03:21:23PM +0200, Jiri Kosina wrote:

On Sat, 22 Jun 2019, Pavel Machek wrote:

quoted

quoted

There is currently no way to verify the resume image when returning
from hibernate.  This might compromise the signed modules trust model,
so until we can work with signed hibernate images we disable it when the
kernel is locked down.

I keep getting these...

IIRC suse has patches to verify the images.

Yeah, Joey Lee is taking care of those. CCing.

The last time that I sent for hibernation encryption and authentication is
here:
    https://lkml.org/lkml/2019/1/3/281 

It needs some big changes after review:
 - Simplify the design: remove keyring dependency and trampoline. 
 - Encrypted whole snapshot image instead of only data pages.
 - Using TPM:
	- Direct use TPM API in hibernation instead of keyring
	- Localities (suggested by James Bottomley)

I am still finding enough time to implement those changes, especial TPM
parts.

Thanks
Joey Lee