Re: [PATCH 17/17] PM: hibernate: Allow hibernation under lockdown with signed images

[Jarkko Sakkinen <jarkko@kernel.org>]

On Thu, Oct 08, 2026 at 06:20:33AM -0700, Matthew Garrett wrote:
> Hibernation is unavailable when the kernel is locked down, as an image
> could be modified to alter the running kernel when it is restored. With
> CONFIG_HIBERNATION_TPM_SIGNATURE, only images signed with a key that the
> kernel created are restored, so this no longer applies.
> 
> Allow hibernation under lockdown when images are signed. Images are not
> encrypted, though, and contain all of kernel memory, which would then be
> readable from the swap device or through /dev/snapshot. Add a
> LOCKDOWN_HIBERNATION_IMAGE reason at the confidentiality level, so that
> hibernation remains unavailable when the kernel is locked down for
> confidentiality.
> 
> Signed-off-by: Matthew Garrett <matthewg@nvidia.com>

I skimmed the rest of the patches but gave up for now given time and
bandwidth, and also having quite loose grip to the changes until I
run them (it's just complex patch set enough).

What kind of test environment you have in high-level, or could you
give some rough guidelines for a test environment?

I'm thinking of setting up something with Buildroot, QEMU and swtpm
perhaps.

> ---
>  include/linux/security.h |  1 +
>  kernel/power/Kconfig     |  5 +++++
>  kernel/power/hibernate.c | 18 +++++++++++++-----
>  security/security.c      |  1 +
>  4 files changed, 20 insertions(+), 5 deletions(-)
> 
> diff --git a/include/linux/security.h b/include/linux/security.h
> index 153e9043058f..6b4dfe80501b 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -155,6 +155,7 @@ enum lockdown_reason {
>  	LOCKDOWN_TRACEFS,
>  	LOCKDOWN_XMON_RW,
>  	LOCKDOWN_XFRM_SECRET,
> +	LOCKDOWN_HIBERNATION_IMAGE,
>  	LOCKDOWN_CONFIDENTIALITY_MAX,
>  };
>  
> diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
> index 2eb6af9226f7..639dc124c17d 100644
> --- a/kernel/power/Kconfig
> +++ b/kernel/power/Kconfig
> @@ -132,6 +132,11 @@ config HIBERNATION_TPM_SIGNATURE
>  	  ExitBootServices() is called. If these requirements are not met,
>  	  hibernation is unavailable.
>  
> +	  As only signed images are restored, hibernation remains available
> +	  when the kernel is locked down for integrity. Images are not
> +	  encrypted, so it is unavailable when the kernel is locked down for
> +	  confidentiality.
> +
>  	  If unsure, say N.
>  
>  config TPM_HIBERNATE_INSECURE
> diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
> index 256790aeca86..7bbef9c3ae1c 100644
> --- a/kernel/power/hibernate.c
> +++ b/kernel/power/hibernate.c
> @@ -108,11 +108,19 @@ bool hibernation_in_progress(void)
>  
>  bool hibernation_available(void)
>  {
> -	return nohibernate == 0 &&
> -		!security_locked_down(LOCKDOWN_HIBERNATION) &&
> -		!secretmem_active() && !cxl_mem_active() &&
> -		(!IS_ENABLED(CONFIG_HIBERNATION_TPM_SIGNATURE) ||
> -		 hibernate_tpm_available());
> +	if (nohibernate || secretmem_active() || cxl_mem_active())
> +		return false;
> +
> +	/*
> +	 * Only images signed by the kernel are restored, so hibernation does
> +	 * not undermine the integrity of a locked down kernel.  Images are
> +	 * not encrypted, though, so they would expose kernel memory.
> +	 */
> +	if (IS_ENABLED(CONFIG_HIBERNATION_TPM_SIGNATURE))
> +		return hibernate_tpm_available() &&
> +		       !security_locked_down(LOCKDOWN_HIBERNATION_IMAGE);
> +
> +	return !security_locked_down(LOCKDOWN_HIBERNATION);
>  }
>  
>  /**
> diff --git a/security/security.c b/security/security.c
> index 2ee276ab15c5..5d91ca69bbf1 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -71,6 +71,7 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = {
>  	[LOCKDOWN_TRACEFS] = "use of tracefs",
>  	[LOCKDOWN_XMON_RW] = "xmon read and write access",
>  	[LOCKDOWN_XFRM_SECRET] = "xfrm SA secret",
> +	[LOCKDOWN_HIBERNATION_IMAGE] = "hibernation with signed images",
>  	[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
>  };
>  
> -- 
> 2.43.0
> 
> 

Br, Jarkko