[08/27] hibernate: Disable when the kernel is locked down

Message ID	20190325220954.29054-9-matthewgarrett@google.com (mailing list archive)
State	New, archived
Headers	show Return-Path: <linux-security-module-owner@kernel.org> Date: Mon, 25 Mar 2019 15:09:35 -0700 In-Reply-To: <20190325220954.29054-1-matthewgarrett@google.com> Message-Id: <20190325220954.29054-9-matthewgarrett@google.com> Mime-Version: 1.0 References: <20190325220954.29054-1-matthewgarrett@google.com> Subject: [PATCH 08/27] hibernate: Disable when the kernel is locked down From: Matthew Garrett <matthewgarrett@google.com> To: jmorris@namei.org Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dhowells@redhat.com, Josh Boyer <jwboyer@fedoraproject.org>, rjw@rjwysocki.net, pavel@ucw.cz, linux-pm@vger.kernel.org, Matthew Garrett <matthewgarrett@google.com> Content-Type: text/plain; charset="UTF-8" Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk
Series	[PULL,REQUEST] Lockdown patches for 5.2 \| expand [PULL,REQUEST] Lockdown patches for 5.2 [02/27] Enforce module signatures if the kernel is locked down [03/27] Restrict /dev/{mem,kmem,port} when the kernel is locked down [04/27] kexec_load: Disable at runtime if the kernel is locked down [05/27] Copy secure_boot flag in boot params across kexec reboot [06/27] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE [07/27] kexec_file: Restrict at runtime if the kernel is locked down [08/27] hibernate: Disable when the kernel is locked down [09/27] uswsusp: Disable when the kernel is locked down [10/27] PCI: Lock down BAR access when the kernel is locked down [11/27] x86: Lock down IO port access when the kernel is locked down [12/27] x86/msr: Restrict MSR access when the kernel is locked down [13/27] ACPI: Limit access to custom_method when the kernel is locked down [14/27] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down [15/27] acpi: Disable ACPI table override if the kernel is locked down [16/27] acpi: Disable APEI error injection if the kernel is locked down [17/27] Prohibit PCMCIA CIS storage when the kernel is locked down [18/27] Lock down TIOCSSERIAL [19/27] Lock down module params that specify hardware parameters (eg. ioport) [20/27] x86/mmiotrace: Lock down the testmmiotrace module [21/27] Lock down /proc/kcore [22/27] Lock down kprobes [23/27] bpf: Restrict kernel image access functions when the kernel is locked down [24/27] Lock down perf [25/27] debugfs: Restrict debugfs when the kernel is locked down [26/27] lockdown: Print current->comm in restriction messages [27/27] kexec: Allow kexec_file() with appropriate IMA policy when locked down

Message ID

20190325220954.29054-9-matthewgarrett@google.com (mailing list archive)

State

New, archived

Headers

Date: Mon, 25 Mar 2019 15:09:35 -0700
In-Reply-To: <20190325220954.29054-1-matthewgarrett@google.com>
Message-Id: <20190325220954.29054-9-matthewgarrett@google.com>
Mime-Version: 1.0
References: <20190325220954.29054-1-matthewgarrett@google.com>
Subject: [PATCH 08/27] hibernate: Disable when the kernel is locked down
From: Matthew Garrett <matthewgarrett@google.com>
To: jmorris@namei.org
Cc: linux-security-module@vger.kernel.org,
        linux-kernel@vger.kernel.org, dhowells@redhat.com,
        Josh Boyer <jwboyer@fedoraproject.org>, rjw@rjwysocki.net,
        pavel@ucw.cz, linux-pm@vger.kernel.org,
        Matthew Garrett <matthewgarrett@google.com>
Content-Type: text/plain; charset="UTF-8"
Sender: owner-linux-security-module@vger.kernel.org
Precedence: bulk

Series

[PULL,REQUEST] Lockdown patches for 5.2 | expand

Commit Message

Matthew Garrett March 25, 2019, 10:09 p.m. UTC

From: Josh Boyer <jwboyer@fedoraproject.org>

There is currently no way to verify the resume image when returning
from hibernate.  This might compromise the signed modules trust model,
so until we can work with signed hibernate images we disable it when the
kernel is locked down.

Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Cc: rjw@rjwysocki.net
Cc: pavel@ucw.cz
cc: linux-pm@vger.kernel.org
Signed-off-by: Matthew Garrett <matthewgarrett@google.com>
---
 kernel/power/hibernate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index abef759de7c8..802795becb88 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -70,7 +70,7 @@  static const struct platform_hibernation_ops *hibernation_ops;
 
 bool hibernation_available(void)
 {
-	return (nohibernate == 0);
+	return nohibernate == 0 && !kernel_is_locked_down("Hibernation");
 }
 
 /**

[08/27] hibernate: Disable when the kernel is locked down

Commit Message

Patch