Messages in this thread | | | From | Matthew Garrett <> | Date | Thu, 7 Mar 2019 09:32:24 -0800 | Subject | Re: [PATCH 09/27] hibernate: Disable when the kernel is locked down |
| |
On Thu, Mar 7, 2019 at 6:55 AM Alan Cox <gnomes@lxorguk.ukuu.org.uk> wrote: > > On Wed, 6 Mar 2019 15:58:55 -0800 > Matthew Garrett <matthewgarrett@google.com> wrote: > > > From: Josh Boyer <jwboyer@fedoraproject.org> > > > > There is currently no way to verify the resume image when returning > > from hibernate. This might compromise the signed modules trust model, > > so until we can work with signed hibernate images we disable it when the > > kernel is locked down. > > That one is a bit worrying since whilst the other stuff may be useful in > some business environments, mandatory hibernate not suspend to RAM is a > common corporate IT policy because of concerns about theft and recovery > of memory contents.
Suse have a solution for this that I'd like to see pushed again, but from a practical perspective enterprise distributions have been shipping this for some time without significant obvious customer complaint.
| |