http://bugzilla.opensuse.org/show_bug.cgi?id=991117 http://bugzilla.opensuse.org/show_bug.cgi?id=991117#c1 --- Comment #1 from Thomas Leineweber --- Created attachment 685929 --> http://bugzilla.opensuse.org/attachment.cgi?id=685929&action=edit dmesg of vanilla kernel -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=991117 http://bugzilla.opensuse.org/show_bug.cgi?id=991117#c3 Takashi Iwai changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jlee@suse.com, | |tiwai@suse.com Flags| |needinfo?(jlee@suse.com) --- Comment #3 from Takashi Iwai --- Well, this is a side-effect of secure boot. The recent kernel has a more strict check regarding the secure boot. The suspend-to-disk is dangerous from secure boot POV, thus it has to be signed. In kernel/power/hibernate.c: bool hibernation_available(void) { if (nohibernate != 0) return false; if (get_securelevel() <= 0) return true; else { #ifdef CONFIG_HIBERNATE_VERIFICATION sigenforce = 1; return true; #else return false; #endif } } And openSUSE kernels don't set CONFIG_HIBERNATE_VERIFICATION. Joey, do you remember the reason we disabled it? We disabled kexec signature check because it caused a trouble with kdump. But this one (hibernation verification) seems like an overlooking. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=991117 http://bugzilla.opensuse.org/show_bug.cgi?id=991117#c4 --- Comment #4 from Joey Lee --- (In reply to Takashi Iwai from comment #3)

Well, this is a side-effect of secure boot. The recent kernel has a more strict check regarding the secure boot. The suspend-to-disk is dangerous from secure boot POV, thus it has to be signed. In kernel/power/hibernate.c:

bool hibernation_available(void) { if (nohibernate != 0) return false;

if (get_securelevel() <= 0) return true; else { #ifdef CONFIG_HIBERNATE_VERIFICATION sigenforce = 1; return true; #else return false; #endif } }

And openSUSE kernels don't set CONFIG_HIBERNATE_VERIFICATION.

Because hibernate verification patches doesn't accept by upstream. So I never push those patches to openSUSE kernel until now.

Joey, do you remember the reason we disabled it? We disabled kexec signature check because it caused a trouble with kdump. But this one (hibernation verification) seems like an overlooking.

I think either enable CONFIG_HIBERNATE_VERIFICATION or disable CONFIG_EFI_SECURE_BOOT_SECURELEVEL even CONFIG_SECURITY_SECURELEVEL. Because openSUSE community do not accept kernel module signature check function in openSUSE kernel. Honestly I think that only enable kexec signature check and hibernate verification is not enough to protect system because root can load any unsigned kernel modules. So, the policy of openSUSE kernel config is to sync with SLE kernel? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=991117 http://bugzilla.opensuse.org/show_bug.cgi?id=991117#c6 --- Comment #6 from Joey Lee --- (In reply to Takashi Iwai from comment #5)

(In reply to Joey Lee from comment #4)

...

...

Joey, do you remember the reason we disabled it? We disabled kexec signature check because it caused a trouble with kdump. But this one (hibernation verification) seems like an overlooking.

I think either enable CONFIG_HIBERNATE_VERIFICATION or disable CONFIG_EFI_SECURE_BOOT_SECURELEVEL even CONFIG_SECURITY_SECURELEVEL.

Right, that's an option, too.

I want to enable CONFIG_HIBERNATE_VERIFICATION. I will test this option on openSUSE 42.2 kernel then submit config change.

...

Because openSUSE community do not accept kernel module signature check function in openSUSE kernel. Honestly I think that only enable kexec signature check and hibernate verification is not enough to protect system because root can load any unsigned kernel modules.

So, the policy of openSUSE kernel config is to sync with SLE kernel?

No, both SLE12-SP2 and openSUSE-42.2 kernels share the same *code*, but the configs differ between them.

OK! OK! -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=991117 http://bugzilla.opensuse.org/show_bug.cgi?id=991117#c8 --- Comment #8 from Thomas Leineweber --- As Beta3 of Leap 42.2 has arrived, nothing has changed when using kernel-default 4.4.22-1.1 with secure boot enabled: disk is missing from the possible power states. Is the configuration change possible in the timeframe until 42.2 will be released? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=991117 http://bugzilla.opensuse.org/show_bug.cgi?id=991117#c10 --- Comment #10 from Thomas Leineweber --- (In reply to Joey Lee from comment #9)

I just sent merge request to openSUSE 42.2 kernel, waiting merged:

thanks for your work and the information. When there is a test build, please give me a hint. I can test it on my system. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=991117 http://bugzilla.opensuse.org/show_bug.cgi?id=991117#c12 Thomas Leineweber changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #12 from Thomas Leineweber --- resolve fixed, it is old and fixed :) -- You are receiving this mail because: You are on the CC list for the bug.