linux-kernel - [RFC] swap image signature check upon resume

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20071206211335.GA4923@gollum.tnic>
Date:	Thu, 6 Dec 2007 22:13:35 +0100
From:	Borislav Petkov <bbpetkov@...oo.de>
To:	Pavel Machek <pavel@...e.cz>, "Rafael J. Wysocki" <rjw@...k.pl>
Cc:	linux-kernel@...r.kernel.org
Subject: [RFC] swap image signature check upon resume

Hi Pavel,
hi Rafael,

after a quick search i couldn't find anything dealing with the topic in the
subject line so here we go:

One sometimes can mix up (and by one i mean me) the
kernel images one boots after having suspended the machine previously. There can
be at least two reasons for that:

1. too many kernels in grub and having forgotten with which i suspended.
2. compile and install a new kernel and forget about it, suspend in the evening
and then boot with the new kernel;

in both cases you end up staring at fsck since they filesystems haven't been unmounted,
of course. Or at least see the warning message of some journal recovery whisk away.

In order to alleviate that, one could probably go, imho, and write in the swsusp_header
the kernel version which suspended the machine (UTS_RELEASE) alongside
SWSUSP_SIG and check that against the kernel version of the image just booting.
If they match then all is well, if not, one could

a) issue a BIG FAT WARNING and reboot telling the user to select the proper
image
b) ask the user what to do:
	- proceed as if "noresume" has been entered on the kernel command line
	- reboot after issuing the kernel version which suspended the machine
	-
c)...

In case you guys think something like that might be of use i can come up with a
patch in the next coupla days...

-- 
Regards/Gruß,
    Boris.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/