[09/27] hibernate: Disable when the kernel is locked down

Message ID	20190306235913.6631-10-matthewgarrett@google.com (mailing list archive)
State	New, archived
Headers	show Return-Path: <linux-security-module-owner@kernel.org> Date: Wed, 6 Mar 2019 15:58:55 -0800 In-Reply-To: <20190306235913.6631-1-matthewgarrett@google.com> Message-Id: <20190306235913.6631-10-matthewgarrett@google.com> Mime-Version: 1.0 References: <20190306235913.6631-1-matthewgarrett@google.com> Subject: [PATCH 09/27] hibernate: Disable when the kernel is locked down From: Matthew Garrett <matthewgarrett@google.com> To: jmorris@namei.org Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dhowells@redhat.com Content-Type: text/plain; charset="UTF-8" Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk
Series	[PULL,REQUEST] Kernel lockdown patches for 5.2 \| expand [PULL,REQUEST] Kernel lockdown patches for 5.2 [02/27] Add a SysRq option to lift kernel lockdown [03/27] Enforce module signatures if the kernel is locked down [04/27] Restrict /dev/{mem,kmem,port} when the kernel is locked down [05/27] kexec_load: Disable at runtime if the kernel is locked down [06/27] Copy secure_boot flag in boot params across kexec reboot [07/27] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE [08/27] kexec_file: Restrict at runtime if the kernel is locked down [09/27] hibernate: Disable when the kernel is locked down [10/27] uswsusp: Disable when the kernel is locked down [11/27] PCI: Lock down BAR access when the kernel is locked down [12/27] x86: Lock down IO port access when the kernel is locked down [13/27] x86/msr: Restrict MSR access when the kernel is locked down [14/27] ACPI: Limit access to custom_method when the kernel is locked down [15/27] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down [16/27] acpi: Disable ACPI table override if the kernel is locked down [17/27] acpi: Disable APEI error injection if the kernel is locked down [18/27] Prohibit PCMCIA CIS storage when the kernel is locked down [19/27] Lock down TIOCSSERIAL [20/27] Lock down module params that specify hardware parameters (eg. ioport) [21/27] x86/mmiotrace: Lock down the testmmiotrace module [22/27] Lock down /proc/kcore [23/27] Lock down kprobes [24/27] bpf: Restrict kernel image access functions when the kernel is locked down [25/27] Lock down perf [26/27] debugfs: Restrict debugfs when the kernel is locked down [27/27] lockdown: Print current->comm in restriction messages

Message ID

20190306235913.6631-10-matthewgarrett@google.com (mailing list archive)

State

New, archived

Headers

Date: Wed,  6 Mar 2019 15:58:55 -0800
In-Reply-To: <20190306235913.6631-1-matthewgarrett@google.com>
Message-Id: <20190306235913.6631-10-matthewgarrett@google.com>
Mime-Version: 1.0
References: <20190306235913.6631-1-matthewgarrett@google.com>
Subject: [PATCH 09/27] hibernate: Disable when the kernel is locked down
From: Matthew Garrett <matthewgarrett@google.com>
To: jmorris@namei.org
Cc: linux-security-module@vger.kernel.org,
        linux-kernel@vger.kernel.org, dhowells@redhat.com
Content-Type: text/plain; charset="UTF-8"
Sender: owner-linux-security-module@vger.kernel.org
Precedence: bulk

Series

[PULL,REQUEST] Kernel lockdown patches for 5.2 | expand

Commit Message

Matthew Garrett March 6, 2019, 11:58 p.m. UTC

From: Josh Boyer <jwboyer@fedoraproject.org>

There is currently no way to verify the resume image when returning
from hibernate.  This might compromise the signed modules trust model,
so until we can work with signed hibernate images we disable it when the
kernel is locked down.

Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
cc: linux-pm@vger.kernel.org
Signed-off-by: Matthew Garrett <matthewgarrett@google.com>
---
 kernel/power/hibernate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Alan Cox March 7, 2019, 2:55 p.m. UTC | #1

On Wed,  6 Mar 2019 15:58:55 -0800
Matthew Garrett <matthewgarrett@google.com> wrote:

> From: Josh Boyer <jwboyer@fedoraproject.org>
> 
> There is currently no way to verify the resume image when returning
> from hibernate.  This might compromise the signed modules trust model,
> so until we can work with signed hibernate images we disable it when the
> kernel is locked down.

That one is a bit worrying since whilst the other stuff may be useful in
some business environments, mandatory hibernate not suspend to RAM is a
common corporate IT policy because of concerns about theft and recovery
of memory contents.

Alan

Matthew Garrett March 7, 2019, 5:32 p.m. UTC | #2

On Thu, Mar 7, 2019 at 6:55 AM Alan Cox <gnomes@lxorguk.ukuu.org.uk> wrote:
>
> On Wed,  6 Mar 2019 15:58:55 -0800
> Matthew Garrett <matthewgarrett@google.com> wrote:
>
> > From: Josh Boyer <jwboyer@fedoraproject.org>
> >
> > There is currently no way to verify the resume image when returning
> > from hibernate.  This might compromise the signed modules trust model,
> > so until we can work with signed hibernate images we disable it when the
> > kernel is locked down.
>
> That one is a bit worrying since whilst the other stuff may be useful in
> some business environments, mandatory hibernate not suspend to RAM is a
> common corporate IT policy because of concerns about theft and recovery
> of memory contents.

Suse have a solution for this that I'd like to see pushed again, but
from a practical perspective enterprise distributions have been
shipping this for some time without significant obvious customer
complaint.

Alan Cox March 18, 2019, 6:55 p.m. UTC | #3

> Suse have a solution for this that I'd like to see pushed again, but
> from a practical perspective enterprise distributions have been
> shipping this for some time without significant obvious customer
> complaint.

Probably because their IT department hasn't noticed 8)

Alan

diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index abef759de7c8..802795becb88 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -70,7 +70,7 @@  static const struct platform_hibernation_ops *hibernation_ops;
 
 bool hibernation_available(void)
 {
-	return (nohibernate == 0);
+	return nohibernate == 0 && !kernel_is_locked_down("Hibernation");
 }
 
 /**

[09/27] hibernate: Disable when the kernel is locked down

Commit Message

Comments

Patch