Re: [PATCH 11/24] uswsusp: Disable when the kernel is locked down
On Sat, Apr 08, 2017 at 05:28:15AM +0200, poma wrote: > On 06.04.2017 22:25, Jiri Kosina wrote: > > On Thu, 6 Apr 2017, Rafael J. Wysocki wrote: > > > > Your swap partition may be located on an NVDIMM or be encrypted. > > An NVDIMM should be considered the same as any other persistent storage. > > It may be encrypted, but where's the key stored, how easy is it to > retrieve > and does the swapout code know this? > > > Isn't this a bit overly drastic? > > Perhaps, but if it's on disk and it's not encrypted, then maybe not. > >>> > >>> Right. > >>> > >>> Swap encryption is not mandatory and I'm not sure how the hibernate > >>> code can verify whether or not it is in use. > >> > >> BTW, SUSE has patches adding secure boot support to the hibernate code > >> and Jiri promised me to post them last year even. :-) > > > > Oh, thanks for a friendly ping :) Adding Joey Lee to CC. > > > > Rafael J., are you talking about HIBERNATE_VERIFICATION ? > > Ref. > https://github.com/joeyli/linux-s4sign/commits/s4sign-hmac-v2-v4.2-rc8 > https://lkml.org/lkml/2015/8/11/47 > https://bugzilla.redhat.com/show_bug.cgi?id=1330335 > I am working on switch to HMAC-SHA512. On the other hand, some mechanisms keep signing/encryption key in memory. e.g. dm-crypt or hibernation verification. Kees Cook suggested that we should add kernel memory reads as a thread model of securelevel to prevent leaking those keys by /dev/kmem, bpf, kdump or hibernation... We still need time to implement it. Thanks a lot! Joey Lee
Re: [PATCH 11/24] uswsusp: Disable when the kernel is locked down
On 06.04.2017 22:25, Jiri Kosina wrote: > On Thu, 6 Apr 2017, Rafael J. Wysocki wrote: > > Your swap partition may be located on an NVDIMM or be encrypted. An NVDIMM should be considered the same as any other persistent storage. It may be encrypted, but where's the key stored, how easy is it to retrieve and does the swapout code know this? > Isn't this a bit overly drastic? Perhaps, but if it's on disk and it's not encrypted, then maybe not. >>> >>> Right. >>> >>> Swap encryption is not mandatory and I'm not sure how the hibernate >>> code can verify whether or not it is in use. >> >> BTW, SUSE has patches adding secure boot support to the hibernate code >> and Jiri promised me to post them last year even. :-) > > Oh, thanks for a friendly ping :) Adding Joey Lee to CC. > Rafael J., are you talking about HIBERNATE_VERIFICATION ? Ref. https://github.com/joeyli/linux-s4sign/commits/s4sign-hmac-v2-v4.2-rc8 https://lkml.org/lkml/2015/8/11/47 https://bugzilla.redhat.com/show_bug.cgi?id=1330335
Re: [PATCH 11/24] uswsusp: Disable when the kernel is locked down
On Thu, 6 Apr 2017, Rafael J. Wysocki wrote: > >>> Your swap partition may be located on an NVDIMM or be encrypted. > >> > >> An NVDIMM should be considered the same as any other persistent storage. > >> > >> It may be encrypted, but where's the key stored, how easy is it to retrieve > >> and does the swapout code know this? > >> > >>> Isn't this a bit overly drastic? > >> > >> Perhaps, but if it's on disk and it's not encrypted, then maybe not. > > > > Right. > > > > Swap encryption is not mandatory and I'm not sure how the hibernate > > code can verify whether or not it is in use. > > BTW, SUSE has patches adding secure boot support to the hibernate code > and Jiri promised me to post them last year even. :-) Oh, thanks for a friendly ping :) Adding Joey Lee to CC. -- Jiri Kosina SUSE Labs
Re: [PATCH 11/24] uswsusp: Disable when the kernel is locked down
On Thu, Apr 6, 2017 at 10:09 PM, Rafael J. Wysocki wrote: > On Thu, Apr 6, 2017 at 10:41 AM, David Howells wrote: >> Oliver Neukum wrote: >> >>> Your swap partition may be located on an NVDIMM or be encrypted. >> >> An NVDIMM should be considered the same as any other persistent storage. >> >> It may be encrypted, but where's the key stored, how easy is it to retrieve >> and does the swapout code know this? >> >>> Isn't this a bit overly drastic? >> >> Perhaps, but if it's on disk and it's not encrypted, then maybe not. > > Right. > > Swap encryption is not mandatory and I'm not sure how the hibernate > code can verify whether or not it is in use. BTW, SUSE has patches adding secure boot support to the hibernate code and Jiri promised me to post them last year even. :-) Thanks, Rafael
Re: [PATCH 11/24] uswsusp: Disable when the kernel is locked down
On Thu, Apr 6, 2017 at 10:41 AM, David Howells wrote: > Oliver Neukum wrote: > >> Your swap partition may be located on an NVDIMM or be encrypted. > > An NVDIMM should be considered the same as any other persistent storage. > > It may be encrypted, but where's the key stored, how easy is it to retrieve > and does the swapout code know this? > >> Isn't this a bit overly drastic? > > Perhaps, but if it's on disk and it's not encrypted, then maybe not. Right. Swap encryption is not mandatory and I'm not sure how the hibernate code can verify whether or not it is in use. Thanks, Rafael
Re: [PATCH 11/24] uswsusp: Disable when the kernel is locked down
On Thu, Apr 6, 2017 at 8:55 AM, David Howells wrote: > Rafael J. Wysocki wrote: > >> You probably want to disable hibernation altogether in this case. > > See patch 10. Does that mean patch 11 is superfluous? Yes, it does. You can't open /dev/snapshot if hibernation_available() returns false. Thanks, Rafael
Re: [PATCH 11/24] uswsusp: Disable when the kernel is locked down
Oliver Neukum wrote: > Your swap partition may be located on an NVDIMM or be encrypted. An NVDIMM should be considered the same as any other persistent storage. It may be encrypted, but where's the key stored, how easy is it to retrieve and does the swapout code know this? > Isn't this a bit overly drastic? Perhaps, but if it's on disk and it's not encrypted, then maybe not. David
Re: [PATCH 11/24] uswsusp: Disable when the kernel is locked down
Rafael J. Wysocki wrote: > You probably want to disable hibernation altogether in this case. See patch 10. Does that mean patch 11 is superfluous? David
Re: [PATCH 11/24] uswsusp: Disable when the kernel is locked down
Am Donnerstag, den 06.04.2017, 01:38 +0200 schrieb Rafael J. Wysocki: > On Wed, Apr 5, 2017 at 10:16 PM, David Howells wrote: > > > > From: Matthew Garrett > > > > uswsusp allows a user process to dump and then restore kernel state, which > > makes it possible to modify the running kernel. Disable this if the kernel > > is locked down. > > > > Signed-off-by: Matthew Garrett > > Signed-off-by: David Howells > > cc: linux...@vger.kernel.org > > You probably want to disable hibernation altogether in this case. Your swap partition may be located on an NVDIMM or be encrypted. Isn't this a bit overly drastic? Regards Oliver
Re: [PATCH 11/24] uswsusp: Disable when the kernel is locked down
On Wed, Apr 5, 2017 at 10:16 PM, David Howells wrote: > From: Matthew Garrett > > uswsusp allows a user process to dump and then restore kernel state, which > makes it possible to modify the running kernel. Disable this if the kernel > is locked down. > > Signed-off-by: Matthew Garrett > Signed-off-by: David Howells > cc: linux...@vger.kernel.org You probably want to disable hibernation altogether in this case. Thanks, Rafael
