Messages in this thread | | | Subject | Re: [PATCH 5/5] PM / hibernate: An option to request that snapshot image must be authenticated | From | Randy Dunlap <> | Date | Wed, 12 Sep 2018 09:24:38 -0700 |
| |
Hi,
On 9/12/18 7:23 AM, Lee, Chun-Yi wrote: > diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig > index 7c5c30149dbc..3c998fd6dc4c 100644 > --- a/kernel/power/Kconfig > +++ b/kernel/power/Kconfig > @@ -90,6 +90,17 @@ config HIBERNATION_ENC_AUTH > master key of hibernation. The TPM trusted key depends on TPM. The > security of user defined key relies on user space. > > +config HIBERNATION_ENC_AUTH_FORCE > + bool "Require hibernate snapshot image to be validly signed" > + depends on HIBERNATION_ENC_AUTH > + help > + This option will prevent that a snapshot image without (valid) > + signature be restored. Without this option, a unauthenticated
an
> + snapshot image can be restored but the restored kernel will be > + tainted. Which also means that the hibernation can be triggered
s/Which/This/
or like this: tainted, which also
> + without snapshot key but kernel will be tainted without this > + option. > +
-- ~Randy
| |