Hi! > We are exploring enabling hibernation in some new scenarios. However, > our security team has a few requirements, listed below: > 1. The hibernate image must be encrypted with protection derived from > both the platform (eg TPM) and user authentication data (eg > password). > 2. Hibernation must not be a vector by which a malicious userspace can > escalate to the kernel. Why is #2 reasonable requirement? We normally allow userspace with appropriate permissions to update the kernel, for example. Best regards, Pavel -- People of Russia, stop Putin before his war on Ukraine escalates.
Attachment:
signature.asc
Description: PGP signature
