Hi Pavel, On Sun, Aug 05, 2018 at 12:02:00PM +0200, Pavel Machek wrote: > Hi! > > > > User space doesn't need to involve. The EFI root key is generated by > > > EFI boot stub and be transfer to kernel. It's stored in EFI boot service > > > variable that it can only be accessed by trusted EFI binary when > > > secure boot is enabled. > > > > > Okay, this apply to the 'suspend' phase, right? > > I'm still a little confused about the 'resume' phase. > > Taking encryption as example(not signature), > > the purpose of doing hibernation encryption is to prevent other users > > from stealing ram content. Say, user A uses a passphrase to generate the > > No, I don't think that's purpose here. > > Purpose here is to prevent user from reading/modifying kernel memory > content on machine he owns. > Say, A puts his laptop into hibernation and walks away, and B walks by, and opens A's laptop and wakes up the system and he can do what he wants. Although EFI key/TPM trusted key is enabled, currently there's no certification during resume, which sounds unsafe to me. Afterall, the original requirement is to probe user for password during resume, which sounds more natural. > Strange as it may sound, that is what "secure" boot requires (and what > Disney wants). > Ok, I understand this requirement, and I'm also concerning how to distinguish different users from seeing data of each other. Joey, I'm thinking of a possible direction which could take advantage of the password. It leverages either EFI key or TPM trusted key to get it done. Does it make sense? 1. The user space generates a symetric key key_user using the password, and passes the key_user to the kernel as the master key. 2. The kernel uses the EFI key or TPM trusted key to encrypt the key_user thus gets a encrypt_key. 3. Uses the encrypt_key to do snapshot encryption 4. During resume, the same encrypt_key is generated following the same steps(I assume the same EFI key or TPM key could be fetched during resumed, right?) and do the snapshot decryption. And this is what fscrypt is doing: Documentation/filesystems/fscrypt.rst Best, Yu > I guess it may have some non-evil uses, > too... https://www.linux.com/news/matthew-garrett-explains-how-increase-security-boot-time > > > Pavel > -- > (english) http://www.livejournal.com/~pavelmachek > (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
