5

In my systemd jounal (journalctl) I often see this message:

hibernation is restricted; see man kernel_lockdown.7

This seems to stem from the kernel lockdown feature that (only?) is active when you boot in UEFI mode with secure boot enabled.
As far as I understand that this feature is supposed to prevent a program running at user-space from modifying the kernel.

While I do understand that so far, I just don't get one thing: Why does the kernel lockdown disable that feature? Why does it disable hibernation altogether?

What is exactly is “insecure” about hibernation that this is disabled?

It seems a locked down kernel does not want me to hibernate my device.

Linux kernel v5.6.15
Fedora 32 Silverblue


Cross-posted at Fedora Ask.

6

As mentioned in the manpage,

Unencrypted hibernation/suspend to swap are disallowed as the kernel image is saved to a medium that can then be accessed.

Unencrypted hibernation stores the contents of the hibernated system’s memory as-is on disk. This allows an attacker to modify those contents while the system is hibernated, resulting in changes to the running system when it is resumed, thus defeating the lockdown.

The manpage gives false hope that encrypted hibernation would be supported in lockdown, but that’s currently not the case, and the real requirement appears to be signed hibernation images rather than (or presumably in addition to, depending on the lockdown mode) encrypted images.

See this Twitter thread for an explanation of what’s involved in fixing this; in particular:

Instead we can generate an asymmetric keypair and store it in a boot services variable, generate a symmetric key, encrypt the image with it, encrypt the symmetric key with the asymmetric key, save that, on reboot read the asymmetric pair and discard half after trying to resume?

6
  • 2
    Okay, though I have to say my system is a LUKS-encrypted LVM installation, so – theoretically – the kernel could have some space to save it's kernel in the encrypted parts. Thus, the message still does not make sense, it does not to disable that feature if it can store the system encrypted…
    – rugk
    Jun 7 '20 at 21:31
  • Indeed, the manpage is misleading. Jun 7 '20 at 22:03
  • Hmm, if so so what is the "correct" way/reason? Does it still always disable hibernate or what?
    – rugk
    Jun 8 '20 at 8:28
  • 2
    The correct reason is that the kernel doesn’t support signed hibernation images. It always disables hibernation when locked down, and that won’t change until signed hibernation images are supported. Jun 8 '20 at 8:46
  • Thanks for this answer. My Intel NUC goes into suspend but doesn't wake up anymore. I had to disable Secure Boot to get suspend to work again.
    – vasquez
    Dec 15 '20 at 9:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.