[PATCH 09/27] hibernate: Disable when the kernel is locked down
gnomes at lxorguk.ukuu.org.uk
Thu Mar 7 14:55:28 UTC 2019
On Wed, 6 Mar 2019 15:58:55 -0800
Matthew Garrett <matthewgarrett at google.com> wrote:
> From: Josh Boyer <jwboyer at fedoraproject.org>
> There is currently no way to verify the resume image when returning
> from hibernate. This might compromise the signed modules trust model,
> so until we can work with signed hibernate images we disable it when the
> kernel is locked down.
That one is a bit worrying since whilst the other stuff may be useful in
some business environments, mandatory hibernate not suspend to RAM is a
common corporate IT policy because of concerns about theft and recovery
of memory contents.
More information about the Linux-security-module-archive