Attachment 636264 Details for Bug 869642 – disable hibernate in sb environment v2

disable hibernate in sb environment v2

0001-hibernate-Disable-in-a-Secure-Boot-environment.patch (text/plain), 2.80 KB, created by Josh Boyer on 2012-10-31 17:35:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Josh Boyer

Created: 2012-10-31 17:35:30 UTC

Size: 2.80 KB

patch

obsolete

>From 924e09f1b267c407ca037171bc6f8f90b09265d6 Mon Sep 17 00:00:00 2001
>From: Josh Boyer <jwboyer@redhat.com>
>Date: Fri, 26 Oct 2012 14:02:09 -0400
>Subject: [PATCH] hibernate: Disable in a Secure Boot environment
>
>There is currently no way to verify the resume image when returning
>from hibernate.  This might compromise the secure boot trust model,
>so until we can work with signed hibernate images we disable it in
>a Secure Boot environment.
>
>Signed-off-by: Josh Boyer <jwboyer@redhat.com>
>---
> v2: Updated to include swsup after feedback from Jiri Kosina <jkosina@suse.cz>
>
> kernel/power/hibernate.c | 14 +++++++++++++-
> kernel/power/main.c      |  4 +++-
> kernel/power/user.c      |  3 +++
> 3 files changed, 19 insertions(+), 2 deletions(-)
>
>diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
>index b26f5f1..f04343b 100644
>--- a/kernel/power/hibernate.c
>+++ b/kernel/power/hibernate.c
>@@ -632,6 +632,10 @@ int hibernate(void)
> {
> 	int error;
> 
>+	if (!capable(CAP_COMPROMISE_KERNEL)) {
>+		return -EPERM;
>+	}
>+
> 	lock_system_sleep();
> 	/* The snapshot device should not be opened while we're running */
> 	if (!atomic_add_unless(&snapshot_device_available, -1, 0)) {
>@@ -723,7 +727,7 @@ static int software_resume(void)
> 	/*
> 	 * If the user said "noresume".. bail out early.
> 	 */
>-	if (noresume)
>+	if (noresume || !capable(CAP_COMPROMISE_KERNEL))
> 		return 0;
> 
> 	/*
>@@ -889,6 +893,11 @@ static ssize_t disk_show(struct kobject *kobj, struct kobj_attribute *attr,
> 	int i;
> 	char *start = buf;
> 
>+	if (!capable(CAP_COMPROMISE_KERNEL)) {
>+		buf += sprintf(buf, "[%s]\n", "disabled");
>+		return buf-start;
>+	}
>+
> 	for (i = HIBERNATION_FIRST; i <= HIBERNATION_MAX; i++) {
> 		if (!hibernation_modes[i])
> 			continue;
>@@ -923,6 +932,9 @@ static ssize_t disk_store(struct kobject *kobj, struct kobj_attribute *attr,
> 	char *p;
> 	int mode = HIBERNATION_INVALID;
> 
>+	if (!capable(CAP_COMPROMISE_KERNEL))
>+		return -EPERM;
>+
> 	p = memchr(buf, '\n', n);
> 	len = p ? p - buf : n;
> 
>diff --git a/kernel/power/main.c b/kernel/power/main.c
>index f458238..72580c1 100644
>--- a/kernel/power/main.c
>+++ b/kernel/power/main.c
>@@ -301,7 +301,9 @@ static ssize_t state_show(struct kobject *kobj, struct kobj_attribute *attr,
> 	}
> #endif
> #ifdef CONFIG_HIBERNATION
>-	s += sprintf(s, "%s\n", "disk");
>+	if (capable(CAP_COMPROMISE_KERNEL)) {
>+		s += sprintf(s, "%s\n", "disk");
>+	}
> #else
> 	if (s != buf)
> 		/* convert the last space to a newline */
>diff --git a/kernel/power/user.c b/kernel/power/user.c
>index 4ed81e7..b11a0f4 100644
>--- a/kernel/power/user.c
>+++ b/kernel/power/user.c
>@@ -48,6 +48,9 @@ static int snapshot_open(struct inode *inode, struct file *filp)
> 	struct snapshot_data *data;
> 	int error;
> 
>+	if (!capable(CAP_COMPROMISE_KERNEL))
>+		return -EPERM;
>+
> 	lock_system_sleep();
> 
> 	if (!atomic_add_unless(&snapshot_device_available, -1, 0)) {
>-- 
>1.7.12.1
>

Actions: View

Attachments on bug 869642: 634010 | 636264