Re: [PATCH 7/9] pm: hibernate: Optionally use TPM-backed keys to protect image integrity

2021-02-21 Thread Matthew Garrett
On Fri, Feb 19, 2021 at 06:20:13PM -0800, Randy Dunlap wrote: > For all of the Kconfig* configuration files throughout the source tree, > the indentation is somewhat different. Lines under a ``config`` definition > are indented with one tab, while help text is indented an additional two >

Re: [PATCH 7/9] pm: hibernate: Optionally use TPM-backed keys to protect image integrity

2021-02-19 Thread Randy Dunlap
Hi-- On 2/19/21 5:32 PM, Matthew Garrett wrote: > diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig > index a7320f07689d..0279cc10f319 100644 > --- a/kernel/power/Kconfig > +++ b/kernel/power/Kconfig > @@ -92,6 +92,21 @@ config HIBERNATION_SNAPSHOT_DEV > > If in doubt, say Y. >

[PATCH 7/9] pm: hibernate: Optionally use TPM-backed keys to protect image integrity

2021-02-19 Thread Matthew Garrett
A plain hash protects the hibernation image against accidental modification, but in the face of an active attack the hash can simply be updated to match the new image. Generate a random AES key and seal this with the TPM, and use it to encrypt the hash. On resume, the key can be unsealed and used