[PATCH 17/17] PM: hibernate: Allow hibernation under lockdown with signed images

[Matthew Garrett <matthewg@nvidia.com>]

Hibernation is unavailable when the kernel is locked down, as an image
could be modified to alter the running kernel when it is restored. With
CONFIG_HIBERNATION_TPM_SIGNATURE, only images signed with a key that the
kernel created are restored, so this no longer applies.

Allow hibernation under lockdown when images are signed. Images are not
encrypted, though, and contain all of kernel memory, which would then be
readable from the swap device or through /dev/snapshot. Add a
LOCKDOWN_HIBERNATION_IMAGE reason at the confidentiality level, so that
hibernation remains unavailable when the kernel is locked down for
confidentiality.

Signed-off-by: Matthew Garrett <matthewg@nvidia.com>
---
 include/linux/security.h |  1 +
 kernel/power/Kconfig     |  5 +++++
 kernel/power/hibernate.c | 18 +++++++++++++-----
 security/security.c      |  1 +
 4 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/include/linux/security.h b/include/linux/security.h
index 153e9043058f..6b4dfe80501b 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -155,6 +155,7 @@ enum lockdown_reason {
 	LOCKDOWN_TRACEFS,
 	LOCKDOWN_XMON_RW,
 	LOCKDOWN_XFRM_SECRET,
+	LOCKDOWN_HIBERNATION_IMAGE,
 	LOCKDOWN_CONFIDENTIALITY_MAX,
 };
 
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index 2eb6af9226f7..639dc124c17d 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -132,6 +132,11 @@ config HIBERNATION_TPM_SIGNATURE
 	  ExitBootServices() is called. If these requirements are not met,
 	  hibernation is unavailable.
 
+	  As only signed images are restored, hibernation remains available
+	  when the kernel is locked down for integrity. Images are not
+	  encrypted, so it is unavailable when the kernel is locked down for
+	  confidentiality.
+
 	  If unsure, say N.
 
 config TPM_HIBERNATE_INSECURE
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index 256790aeca86..7bbef9c3ae1c 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -108,11 +108,19 @@ bool hibernation_in_progress(void)
 
 bool hibernation_available(void)
 {
-	return nohibernate == 0 &&
-		!security_locked_down(LOCKDOWN_HIBERNATION) &&
-		!secretmem_active() && !cxl_mem_active() &&
-		(!IS_ENABLED(CONFIG_HIBERNATION_TPM_SIGNATURE) ||
-		 hibernate_tpm_available());
+	if (nohibernate || secretmem_active() || cxl_mem_active())
+		return false;
+
+	/*
+	 * Only images signed by the kernel are restored, so hibernation does
+	 * not undermine the integrity of a locked down kernel.  Images are
+	 * not encrypted, though, so they would expose kernel memory.
+	 */
+	if (IS_ENABLED(CONFIG_HIBERNATION_TPM_SIGNATURE))
+		return hibernate_tpm_available() &&
+		       !security_locked_down(LOCKDOWN_HIBERNATION_IMAGE);
+
+	return !security_locked_down(LOCKDOWN_HIBERNATION);
 }
 
 /**
diff --git a/security/security.c b/security/security.c
index 2ee276ab15c5..5d91ca69bbf1 100644
--- a/security/security.c
+++ b/security/security.c
@@ -71,6 +71,7 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = {
 	[LOCKDOWN_TRACEFS] = "use of tracefs",
 	[LOCKDOWN_XMON_RW] = "xmon read and write access",
 	[LOCKDOWN_XFRM_SECRET] = "xfrm SA secret",
+	[LOCKDOWN_HIBERNATION_IMAGE] = "hibernation with signed images",
 	[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
 };
 
-- 
2.43.0