There is currently no way to verify the resume image when returning from hibernate. This might compromise the signed modules trust model, so until we can work with signed hibernate images we disable it when the kernel is locked down.
Showing the changes to include/linux (1 of 3 files). Show all
Unified · Split
| @@ -106,6 +106,7 @@ enum lockdown_reason { · 105 unmodified lines | |||
| 106 | LOCKDOWN_MODULE_SIGNATURE, | 106 | LOCKDOWN_MODULE_SIGNATURE, |
| 107 | LOCKDOWN_DEV_MEM, | 107 | LOCKDOWN_DEV_MEM, |
| 108 | LOCKDOWN_KEXEC, | 108 | LOCKDOWN_KEXEC, |
| 109 | LOCKDOWN_HIBERNATION, | ||
| 109 | LOCKDOWN_INTEGRITY_MAX, | 110 | LOCKDOWN_INTEGRITY_MAX, |
| 110 | LOCKDOWN_CONFIDENTIALITY_MAX, | 111 | LOCKDOWN_CONFIDENTIALITY_MAX, |
| 111 | }; | 112 | }; |