Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755861AbdDFUZu (ORCPT ); Thu, 6 Apr 2017 16:25:50 -0400 Received: from mx2.suse.de ([195.135.220.15]:59705 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755595AbdDFUZo (ORCPT ); Thu, 6 Apr 2017 16:25:44 -0400 Date: Thu, 6 Apr 2017 22:25:38 +0200 (CEST) From: Jiri Kosina X-X-Sender: jkosina@pobox.suse.cz To: "Rafael J. Wysocki" cc: David Howells , Oliver Neukum , Linux Kernel Mailing List , Matthew Garrett , linux-efi@vger.kernel.org, gnomes@lxorguk.ukuu.org.uk, Greg Kroah-Hartman , Linux PM , linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, Joey Lee , matthew.garrett@nebula.com Subject: Re: [PATCH 11/24] uswsusp: Disable when the kernel is locked down In-Reply-To: Message-ID: References: <149142326734.5101.4596394505987813763.stgit@warthog.procyon.org.uk> <149142336965.5101.2946578135980499557.stgit@warthog.procyon.org.uk> <1491460792.1645.1.camel@suse.com> <14980.1491468060@warthog.procyon.org.uk> User-Agent: Alpine 2.20 (LSU 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 808 Lines: 26 On Thu, 6 Apr 2017, Rafael J. Wysocki wrote: > >>> Your swap partition may be located on an NVDIMM or be encrypted. > >> > >> An NVDIMM should be considered the same as any other persistent storage. > >> > >> It may be encrypted, but where's the key stored, how easy is it to retrieve > >> and does the swapout code know this? > >> > >>> Isn't this a bit overly drastic? > >> > >> Perhaps, but if it's on disk and it's not encrypted, then maybe not. > > > > Right. > > > > Swap encryption is not mandatory and I'm not sure how the hibernate > > code can verify whether or not it is in use. > > BTW, SUSE has patches adding secure boot support to the hibernate code > and Jiri promised me to post them last year even. :-) Oh, thanks for a friendly ping :) Adding Joey Lee to CC. -- Jiri Kosina SUSE Labs