Hi, On Tue, Jul 11, 2023 at 04:35:21PM -0500, Larry Finger wrote:
On 7/11/23 16:12, Frank Krüger wrote:
Am 11.07.23 um 22:50 schrieb Larry Finger:
On 7/11/23 15:23, Frank Krüger wrote:
JFYI: Kernel 6.4.3-3.g5ab030f-default from Kernel:stable has lockdown enabled (i.e. "cat /sys/kernel/security/lockdown -> integrity"), which was announced some time ago.
Since hibernation is not working in this case with secure boot enabled, is there any solution in sight? Thx.
Is 6.4.3 the first kernel with this problem?
What exactly is the problem? Could you be more specific?
The best way to report such a bug would be to bisect the problem to find the exact commit that causes the failure.
Larry See https://bugzilla.opensuse.org/show_bug.cgi?id=1208766#c3
You will need to wait a while. That series of patches are not in kernel 6.5.0-rc1, thus the earliest they will appear is likely kernel 6.6.
Evan's patch set is developed to v5. Then he got suggestions about the security of PCR23. His idea is following: [PATCH v5 01/11] tpm: Add support for in-kernel resetting of PCRs Evan Green https://lore.kernel.org/lkml/20221111151451.v5.7.Ifff11e11797a1bde0297577ecb... Hibernation dumps kernel space memory to keep in a file. It's a dangerous function from a security point of view. If you have any opinion or concern against kernel usptream's implementation, just raise on kernel upstream please. Before kernel upstream has a official solution, the only way for using hibernation is still disable secure boot. Just like what I done on one of my laptops. Regards Joey Lee