From: joeyli Subject: Re: [PATCH 15/18] Hibernate: adapt to UEFI secure boot with signature check Date: Tue, 27 Aug 2013 18:14:37 +0800 Message-ID: <1377598477.20140.5.camel__1559.16475127942$1377598595$gmane$org@linux-s257.site> References: <1377169317-5959-1-git-send-email-jlee@suse.com> <1377169317-5959-16-git-send-email-jlee@suse.com> <20130825164219.GK5171@amd.pavel.ucw.cz> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-efi@vger.kernel.org, linux-pm@vger.kernel.org, linux-crypto@vger.kernel.org, opensuse-kernel@opensuse.org, David Howells , "Rafael J. Wysocki" , Matthew Garrett , Len Brown , Josh Boyer , Vojtech Pavlik , Matt Fleming , James Bottomley , Greg KH , JKosina@suse.com, Rusty Russell , Herbert Xu , "David S. Miller" , "H. Peter Anvin" , Michal Marek , Gary Lin , Vivek Goyal To: Pavel Machek Return-path: In-Reply-To: <20130825164219.GK5171@amd.pavel.ucw.cz> Sender: linux-security-module-owner@vger.kernel.org List-Id: linux-crypto.vger.kernel.org =E6=96=BC =E6=97=A5=EF=BC=8C2013-08-25 =E6=96=BC 18:42 +0200=EF=BC=8CPa= vel Machek =E6=8F=90=E5=88=B0=EF=BC=9A > On Thu 2013-08-22 19:01:54, Lee, Chun-Yi wrote: > > In current solution, the snapshot signature check used the RSA key-= pair > > that are generated by bootloader(e.g. shim) and pass the key-pair t= o > > kernel through EFI variables. I choice to binding the snapshot > > signature check mechanism with UEFI secure boot for provide stronge= r > > protection of hibernate. Current behavior is following: > >=20 > > + UEFI Secure Boot ON, Kernel found key-pair from shim: > > Will do the S4 signature check. > >=20 > > + UEFI Secure Boot ON, Kernel didn't find key-pair from shim: > > Will lock down S4 function. > >=20 > > + UEFI Secure Boot OFF > > Will NOT do the S4 signature check. > > Ignore any keys from bootloader. > >=20 > > v2: > > Replace sign_key_data_loaded() by skey_data_available() to check si= gn key data > > is available for hibernate. > >=20 > > Reviewed-by: Jiri Kosina > > Signed-off-by: Lee, Chun-Yi > > --- > > kernel/power/hibernate.c | 36 +++++++++++++++++- > > kernel/power/main.c | 11 +++++- > > kernel/power/snapshot.c | 95 ++++++++++++++++++++++++++--------= ------------ > > kernel/power/swap.c | 4 +- > > kernel/power/user.c | 11 +++++ > > 5 files changed, 112 insertions(+), 45 deletions(-) > >=20 > > diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c > > index c545b15..0f19f3d 100644 > > --- a/kernel/power/hibernate.c > > +++ b/kernel/power/hibernate.c > > @@ -29,6 +29,7 @@ > > #include > > #include > > #include > > +#include > > =20 > > #include "power.h" > > =20 > > @@ -632,7 +633,14 @@ static void power_down(void) > > int hibernate(void) > > { > > int error; > > - int skey_error; > > + > > +#ifdef CONFIG_SNAPSHOT_VERIFICATION > > + if (!capable(CAP_COMPROMISE_KERNEL) && !skey_data_available()) { > > +#else > > + if (!capable(CAP_COMPROMISE_KERNEL)) { > > +#endif > > + return -EPERM; > > + } > > =20 > > lock_system_sleep(); > > /* The snapshot device should not be opened while we're running *= / > > @@ -799,6 +807,15 @@ static int software_resume(void) > > if (error) > > goto Unlock; > > =20 > > +#ifdef CONFIG_SNAPSHOT_VERIFICATION > > + if (!capable(CAP_COMPROMISE_KERNEL) && !wkey_data_available()) { > > +#else > > + if (!capable(CAP_COMPROMISE_KERNEL)) { > > +#endif > > + mutex_unlock(&pm_mutex); > > + return -EPERM; > > + } > > + > > /* The snapshot device should not be opened while we're running *= / > > if (!atomic_add_unless(&snapshot_device_available, -1, 0)) { > > error =3D -EBUSY; > > @@ -892,6 +909,15 @@ static ssize_t disk_show(struct kobject *kobj,= struct kobj_attribute *attr, > > int i; > > char *start =3D buf; > > =20 > > +#ifdef CONFIG_SNAPSHOT_VERIFICATION > > + if (efi_enabled(EFI_SECURE_BOOT) && !skey_data_available()) { > > +#else > > + if (efi_enabled(EFI_SECURE_BOOT)) { > > +#endif > > + buf +=3D sprintf(buf, "[%s]\n", "disabled"); > > + return buf-start; > > + } > > + > > for (i =3D HIBERNATION_FIRST; i <=3D HIBERNATION_MAX; i++) { > > if (!hibernation_modes[i]) > > continue; > > @@ -926,6 +952,14 @@ static ssize_t disk_store(struct kobject *kobj= , struct kobj_attribute *attr, > > char *p; > > int mode =3D HIBERNATION_INVALID; > > =20 > > +#ifdef CONFIG_SNAPSHOT_VERIFICATION > > + if (!capable(CAP_COMPROMISE_KERNEL) && !skey_data_available()) { > > +#else > > + if (!capable(CAP_COMPROMISE_KERNEL)) { > > +#endif > > + return -EPERM; > > + } > > + > > p =3D memchr(buf, '\n', n); > > len =3D p ? p - buf : n; > > =20 >=20 > You clearly need some helper function. > Pavel >=20 I will use a help function to replace those ifdef block. Thanks for your suggestion! Joey Lee -- To unsubscribe from this list: send the line "unsubscribe linux-securit= y-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html