Re: Re: ACPI + loop(AES) + swsusp

Re: Re: ACPI + loop(AES) + swsusp

[Pavel Machek]

Hi!

> > Given your point about security, wouldn't it be nice if there were yet
> > another flag to indicate that encrypted partitions should just be
> > turned off on suspend?
> > 
> > This is more useful than it sounds -- not all partitions are mounted all
> > the time.  It might actually be convenient if you don't want to
> > accidentally leave a partition accessible when you walk away from a
> > machine and forget to losetup -d, or whatever.
> 
> Like Sean Neakums pointed out in earlier post to linux-crypto list, just
> forcing unmount or losetup -d is not really an option. Maybe just checking
> for encrypted loops in userspace _before_ starting suspend is a better
> solution. Something like this:

Agreed. Decision if keys should go to disk is user decision (btw they *do*
go to disk if BIOS is used to suspend-to-disk; some notebooks do s-t-d 
automagially on battery fail), so it has to be userspace.
								Pavel
-- 
Philips Velo 1: 1"x4"x8", 300gram, 60, 12MB, 40bogomips, linux, mutt,
details at http://atrey.karlin.mff.cuni.cz/~pavel/velo/index.html.



-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390

ACPI + loop(AES) + swsusp

[Robert Stark]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I've patched kernel-2.4.18 with acpi-20020726-2.4.18.diff, patch-acpi-acpi20020726-swsusp11,
and use Jari's loopaes. All partitions, also the root partition are encrypted symmetric.

I work on a Sony-PCG-FX501 and ACPI and loopaes do all the things they should do.
Have tested swsusp on the same machine without loopaes( and standard loop device )
successfully, but when i have an loop device losetuped and send an 'echo 4 > /proc/acpi/sleep'
then swsusp says "Strange, loopX not stopped" and abort suspend. After this error all loop devices
are under load and i must reboot the system.

Is there a way get this envoirement to work ?


Robert Stark

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE9TjajmSoJ6yS8v8oRAlb+AKCgCOG1vzmeKTxHv3deVblv/i1CTQCeNqmt
kQZUnV/Qo6bZU9BYYG3LqNc=
=9So0
-----END PGP SIGNATURE-----



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf

Re: ACPI + loop(AES) + swsusp

[Jari Ruusu]

Robert Stark wrote:
> I've patched kernel-2.4.18 with acpi-20020726-2.4.18.diff, patch-acpi-acpi20020726-swsusp11,
> and use Jari's loopaes. All partitions, also the root partition are encrypted symmetric.
> 
> I work on a Sony-PCG-FX501 and ACPI and loopaes do all the things they should do.
> Have tested swsusp on the same machine without loopaes( and standard loop device )
> successfully, but when i have an loop device losetuped and send an 'echo 4 > /proc/acpi/sleep'
> then swsusp says "Strange, loopX not stopped" and abort suspend. After this error all loop devices
> are under load and i must reboot the system.
> 
> Is there a way get this envoirement to work ?

Swsusp requires that loop thread puts itself to 'refrigerator' before
suspend can happen. Current version of loop-AES just does not do that and is
incompatible with swsusp.

And even if loop thread did the 'refrigerator' thing, it would be really bad
security wise because the encryption keys would be written to disk when
kernel RAM is saved to disk. Of course that is not a problem with
unencrypted loops.

Robert, can you send me URLs of the patches that you used? It may be
possible to add such code in '#ifdef CONFIG_SWSUSP / #endif' hunks, so that
it gets activated only if swsusp is enabled in kernel config. I can't
promise that it gets merged, but I will at least take a look at it.

Regards,
Jari Ruusu <jari.ruusu-+kynuGyeZW3HOG6cAo2yLw@public.gmane.org>



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf

Re: ACPI + loop(AES) + swsusp

[John J. Lee]

On Mon, 5 Aug 2002, Jari Ruusu wrote:

> And even if loop thread did the 'refrigerator' thing, it would be really bad
> security wise because the encryption keys would be written to disk when
> kernel RAM is saved to disk. Of course that is not a problem with
> unencrypted loops.
>
> Robert, can you send me URLs of the patches that you used? It may be
> possible to add such code in '#ifdef CONFIG_SWSUSP / #endif' hunks, so that
> it gets activated only if swsusp is enabled in kernel config. I can't
> promise that it gets merged, but I will at least take a look at it.
[...]

Given your point about security, wouldn't it be nice if there were yet
another flag to indicate that encrypted partitions should just be
turned off on suspend?

This is more useful than it sounds -- not all partitions are mounted all
the time.  It might actually be convenient if you don't want to
accidentally leave a partition accessible when you walk away from a
machine and forget to losetup -d, or whatever.


John



-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390

Re: ACPI + loop(AES) + swsusp

[Jari Ruusu]

"John J. Lee" wrote:
> Given your point about security, wouldn't it be nice if there were yet
> another flag to indicate that encrypted partitions should just be
> turned off on suspend?
> 
> This is more useful than it sounds -- not all partitions are mounted all
> the time.  It might actually be convenient if you don't want to
> accidentally leave a partition accessible when you walk away from a
> machine and forget to losetup -d, or whatever.

Like Sean Neakums pointed out in earlier post to linux-crypto list, just
forcing unmount or losetup -d is not really an option. Maybe just checking
for encrypted loops in userspace _before_ starting suspend is a better
solution. Something like this:

#!/bin/bash
if losetup -a | grep -q -s "AES" ; then
    echo "Found active encrypted loops, suspend aborted"
    exit 1
fi
echo "now suspending..."
echo "1 0 0" > /proc/sys/kernel/swsusp

Regards,
Jari Ruusu <jari.ruusu-+kynuGyeZW3HOG6cAo2yLw@public.gmane.org>



-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390