[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAK2bC5p94wfyzixC_bg5PMAJjM5J0vyBVt1ChN6vz53+_HRRwQ@mail.gmail.com>
Date: Tue, 21 Nov 2023 22:52:32 -0800
From: Kelvie Wong <kelvie@...vie.ca>
To: Paul Moore <paul@...l-moore.com>
Cc: Randy Dunlap <rdunlap@...radead.org>, linux-doc@...r.kernel.org,
linux-kernel@...r.kernel.org, linux-pm@...r.kernel.org,
linux-security-module <linux-security-module@...r.kernel.org>,
David Howells <dhowells@...hat.com>
Subject: Re: [PATCH RFC] Add a lockdown_hibernate parameter
On Tue, 21 Nov 2023 at 20:53, Paul Moore <paul@...l-moore.com> wrote:
> On Mon, Nov 20, 2023 at 10:07 PM Kelvie Wong <kelvie@...vie.ca> wrote:
> > On Mon, 20 Nov 2023 at 13:12, Paul Moore <paul@...l-moore.com> wrote:
> > > On Mon, Nov 13, 2023 at 11:01 PM Randy Dunlap <rdunlap@...radead.org> wrote:
> > > >
> > > > [add security & dhowells]
> > > >
> > > > On 11/13/23 18:23, Kelvie Wong wrote:
> > > > > This allows the user to tell the kernel that they know better (namely,
> > > > > they secured their swap properly), and that it can enable hibernation.
> > > > >
> > > > > I've been using this for about a year now, as it doesn't seem like
> > > > > proper secure hibernation was going to be implemented back then, and
> > > > > it's now been a year since I've been building my own kernels with this
> > > > > patch, so getting this upstreamed would save some CO2 from me building
> > > > > my own kernels every upgrade.
> > > > >
> > > > > Some other not-me users have also tested the patch:
> > > > >
> > > > > https://community.frame.work/t/guide-fedora-36-hibernation-with-enabled-secure-boot-and-full-disk-encryption-fde-decrypting-over-tpm2/25474/17
> > > > >
> > > > > Signed-off-by: Kelvie Wong <kelvie@...vie.ca>
> > >
> > > I would feel a lot better about this if there was a way to verify that
> > > the swap was protected as opposed to leaving that as a note in a doc
> > > that the majority of users will never see, read, or understand.
> >
> I've got to warn you that I have an allergic reaction to arguments
> that start with "the right solution is really hard, so let's pick the
> easier, worse solution." ;)
>
> I guess I'm still not sold on this idea, I'm sorry.
Not a problem, thanks for looking.
I do hope that hibernate on lockdown is one day properly supported though. I'd
imagine that lockdown will eventually be the default for most distros, and it'd
be a real shame to have to sacrifice hibernate for it (which is, in my opinion,
indispensable for laptop use).
Cheers,
--
Kelvie
Powered by blists - more mailing lists