11

In my systemd jounal (journalctl) I often see this message:

hibernation is restricted; see man kernel_lockdown.7

This seems to stem from the kernel lockdown feature that (only?) is active when you boot in UEFI mode with secure boot enabled.
As far as I understand that this feature is supposed to prevent a program running at user-space from modifying the kernel.

While I do understand that so far, I just don't get one thing: Why does the kernel lockdown disable that feature? Why does it disable hibernation altogether?

What is exactly is “insecure” about hibernation that this is disabled?

It seems a locked down kernel does not want me to hibernate my device.

Linux kernel v5.6.15
Fedora 32 Silverblue


Cross-posted at Fedora Ask.

2 Answers 2

20

As mentioned in the manpage,

Unencrypted hibernation/suspend to swap are disallowed as the kernel image is saved to a medium that can then be accessed.

Unencrypted hibernation stores the contents of the hibernated system’s memory as-is on disk. This allows an attacker to modify those contents while the system is hibernated, resulting in changes to the running system when it is resumed, thus defeating the lockdown.

The manpage gives false hope that encrypted hibernation would be supported in lockdown, but that’s currently not the case, and the real requirement appears to be signed hibernation images rather than (or presumably in addition to, depending on the lockdown mode) encrypted images.

Matthew Garrett has been working on fixing this; he described his proposal to get hibernation working with lockdown in February 2021, and gave an update with practical solutions to a couple of the remaining issues in December 2021. The general idea is to tie hibernation images to TPM states, such that a locked down system will only resume a hibernation image generated on that system and not modified since; getting there requires both knowing what TPM state is valid for the image, and that the TPM state was arrived at by the kernel on its own.

6
  • 2
    Okay, though I have to say my system is a LUKS-encrypted LVM installation, so – theoretically – the kernel could have some space to save it's kernel in the encrypted parts. Thus, the message still does not make sense, it does not to disable that feature if it can store the system encrypted…
    – rugk
    Commented Jun 7, 2020 at 21:31
  • Hmm, if so so what is the "correct" way/reason? Does it still always disable hibernate or what?
    – rugk
    Commented Jun 8, 2020 at 8:28
  • 2
    The correct reason is that the kernel doesn’t support signed hibernation images. It always disables hibernation when locked down, and that won’t change until signed hibernation images are supported. Commented Jun 8, 2020 at 8:46
  • Thanks for this answer. My Intel NUC goes into suspend but doesn't wake up anymore. I had to disable Secure Boot to get suspend to work again.
    – vasquez
    Commented Dec 15, 2020 at 9:37
  • Oh, thanks man pages, and here I was wondering why it doesn't trigger for my encrypted swap :) Commented Jan 22 at 19:47
2

In hibernation it would be "easy" to modify the unsigned swap space, or to extract secrets from the unencrypted swap space, thus circumventing the lockdown.

However, contrary to lots of information on the internet, one solution is to LUKS-encrypt at least the swap space. From first hand experience this is possible on, e.g., OpenSuSE Leap 15.4, although it is not documented too well. It is likely, that full HD LUKS-encryption will permit hibernation under lockdown, too.

Recommended reading:

Background:

Multiple kernel messages along the lines of

"Lockdown: swapper/0: hibernation is restricted; see man kernel_lockdown.7"

may suggest, that hibernation with UEFI Secure Boot is broken - this impression may be supported when searching the Internet for solutions. This impression is wrong, though. The wording uses "restricted" (not "disabled"). This is a hint, that there are ways to perform a compliant hibernation.

It turns out, that patches for signed kernel/memory images to support kernel_lockdown have been developed by SuSE since approx. 2011. Hibernation under lockdown works since at least Leap 15.4. I am not aware of other distributions state with respect to hibernation under Secure Boot.

I hope this information helps others investigate the state of affairs for their particular distribution further.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .