Re: [PATCH 07/24] hibernate: Disable when the kernel is locked down

2018-05-23 Thread joeyli
Hi experts, Sorry for I missed this discussion... On Thu, Apr 26, 2018 at 10:20:29AM +0200, Jiri Kosina wrote: > On Thu, 26 Apr 2018, Pavel Machek wrote: > > > That's not how the crypto needs to work. Talk to Jiri Kosina, ok? > > Yeah, Joey Lee (adding to CC) implemented it here: > > ht

Re: [PATCH 07/24] hibernate: Disable when the kernel is locked down

2018-04-26 Thread Jiri Kosina
On Thu, 26 Apr 2018, Pavel Machek wrote: > That's not how the crypto needs to work. Talk to Jiri Kosina, ok? Yeah, Joey Lee (adding to CC) implemented it here: https://lkml.org/lkml/2015/8/11/47 I think there have been more respins, Joey definitely knows more details and status quo. T

Re: [PATCH 07/24] hibernate: Disable when the kernel is locked down

2018-04-26 Thread Rafael J. Wysocki
On Thursday, April 26, 2018 9:26:46 AM CEST Pavel Machek wrote: > On Thu 2018-04-19 15:38:53, David Howells wrote: > > Pavel Machek wrote: > > > > > > There is currently no way to verify the resume image when returning > > > > from hibernate. This might compromise the signed modules trust model,

Re: [PATCH 07/24] hibernate: Disable when the kernel is locked down

2018-04-26 Thread Pavel Machek
On Thu 2018-04-19 15:38:53, David Howells wrote: > Pavel Machek wrote: > > > > There is currently no way to verify the resume image when returning > > > from hibernate. This might compromise the signed modules trust model, > > > so until we can work with signed hibernate images we disable it whe

Re: [PATCH 07/24] hibernate: Disable when the kernel is locked down

2018-04-22 Thread Andy Lutomirski
On Thu, Apr 19, 2018 at 7:38 AM, David Howells wrote: > Pavel Machek wrote: > >> > There is currently no way to verify the resume image when returning >> > from hibernate. This might compromise the signed modules trust model, >> > so until we can work with signed hibernate images we disable it w

Re: [PATCH 07/24] hibernate: Disable when the kernel is locked down

2018-04-19 Thread David Howells
Pavel Machek wrote: > > There is currently no way to verify the resume image when returning > > from hibernate. This might compromise the signed modules trust model, > > so until we can work with signed hibernate images we disable it when the > > kernel is locked down. > > I'd rather see hibern

Re: [PATCH 07/24] hibernate: Disable when the kernel is locked down

2018-04-13 Thread Pavel Machek
On Wed 2018-04-11 17:25:25, David Howells wrote: > From: Josh Boyer > > There is currently no way to verify the resume image when returning > from hibernate. This might compromise the signed modules trust model, > so until we can work with signed hibernate images we disable it when the > kernel