Messages in this thread | | | Date | Wed, 28 Aug 2013 18:58:12 -0400 (EDT) | From | Lenny Szubowicz <> | Subject | Re: [PATCH 0/10] Add additional security checks when module loading is restricted |
| |
----- Original Message ----- > From: "Matthew Garrett" <matthew.garrett@nebula.com> > To: "Lenny Szubowicz" <lszubowi@redhat.com> > Cc: linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, jwboyer@redhat.com, keescook@chromium.org > Sent: Wednesday, August 28, 2013 6:41:55 PM > Subject: Re: [PATCH 0/10] Add additional security checks when module loading is restricted > > On Wed, 2013-08-28 at 18:37 -0400, Lenny Szubowicz wrote: > > > Did you purposely exclude similar checks for hibernate that were covered > > by earlier versions of your patch set? > > Yes, I think it's worth tying it in with the encrypted hibernation > support. The local attack is significantly harder in the hibernation > case - in the face of unknown hardware it basically involves a > pre-generated memory image corresponding to your system or the ability > to force a reboot into an untrusted environment. I think it's probably > more workable to just add a configuration option for forcing encrypted > hibernation when secure boot is in use. > > -- > Matthew Garrett <matthew.garrett@nebula.com>
I'm root. So I can write anything I want to the swap file that looks like a valid hibernate image but is code of my choosing. I can read anything I need from /dev/mem or /dev/kmem to help me do that. I can then immediately initiate a reboot.
-Lenny.
| |