Update on Linux hibernation support when lockdown is enabled
mjg59.dreamwidth.org
Update on Linux hibernation support when lockdown is enabled
1–10 of 37 posts
Re: Update on Linux hibernation support when lockdown is enabled
#2This would make a huge difference in battery life for Linux laptops with secure boot enabled. Lots of modern laptops don’t even properly support S3 sleep properly (looking at you dell) and want to be able to hibernate to save power.
Re: Update on Linux hibernation support when lockdown is enabled
#3This would make a huge difference in battery life for Linux laptops with secure boot enabled. Lots of modern laptops don’t even properly support S3 sleep properly (looking at you dell) and want to be able to hibernate to save power.
> Lots of modern laptops don’t even properly support S3 sleep properly (looking at you dell) and want to be able to hibernate to save power.
"modern standby" is such a scam and shit show.
And completely opposite that, I was a bit shocked how aggressive modern macos (at least on M1 machines) are at hibernating, I have had to get used to `caffeinate` long-running process because on battery if that's not in use as soon as the screen turns off the machine stops doing anything, even with "low power mode" disabled.
I expect there's a pmset somewhere to change that (as there is an option in the UI when on power adapter), but with the battery life of the new devices I've kinda stopped plugging it in (even at my desk).
Re: Update on Linux hibernation support when lockdown is enabled
#4I'm still waiting for someone to explain any legitimate use of kernel lockdown. To me, it just seems like a tool that makes it easier for bad guys to do tivoization.
Re: Update on Linux hibernation support when lockdown is enabled
#5This would make a huge difference in battery life for Linux laptops with secure boot enabled. Lots of modern laptops don’t even properly support S3 sleep properly (looking at you dell) and want to be able to hibernate to save power.
Is this only true of Windows hardware, or does it include hardware designed for Linux?
Re: Update on Linux hibernation support when lockdown is enabled
#6I'm still waiting for someone to explain any legitimate use of kernel lockdown. To me, it just seems like a tool that makes it easier for bad guys to do tivoization.
You have a disk encrypted laptop. That key is protected by a password.
Secure boot means that when you log in you can trust that the disk decryption screen is not a disk encryption key exfiltration screen waiting for you to enter your password so that a disk backup taken earlier can be decrypted.
How?
The disk encryption is based on a key in the TPM which only is decrypted with your password. That TPM gets wiped when you disable secure boot. The result is that when you enter your password either you get a correct decryption key or your disk encryption key has already been wiped. Assuming it's not possible to run untrusted code before the disk encryption key login screen with secure boot enabled.
kernel lockdown is part of the parcel for making sure that untrusted code does not run that can exfiltrate the disk decryption key.
Re: Update on Linux hibernation support when lockdown is enabled
#7I'm still waiting for someone to explain any legitimate use of kernel lockdown. To me, it just seems like a tool that makes it easier for bad guys to do tivoization.
You have a disk encrypted laptop. That key is protected by a password. Secure boot means that when you log in you can trust that the disk decryption screen is not a disk encryption key exfiltration screen waiting for you to enter your password so that a disk backup taken earlier can be decrypted. How? The disk encryption is based on a key in the TPM which only is decrypted with your password. That TPM gets wiped when…
That doesn't actually protect against that attack, though. The evil maid just steals the guts of your computer and replaces them with ones that always say "sorry, wrong password", while exfiltrating the password you tried over Wi-Fi or Bluetooth. Then they use your password to decrypt your unmodified hard drive with your unmodified TPM on your unmodified motherboard.
Also, I don't think this is true:
> That TPM gets wiped when you disable secure boot.
Won't the TPM not be able to decrypt anything while Secure Boot is disabled, since the PCRs will be different, but then it will work again if you later re-enable it? I don't think it actually wipes itself. And even if it did, couldn't you just unplug the TPM, disable Secure Boot, steal the password, re-enable it, and then plug the TPM back in? Then even if it did want to wipe itself, it wouldn't know to.
Re: Update on Linux hibernation support when lockdown is enabled
#8Earlier quoted context omitted.
You have a disk encrypted laptop. That key is protected by a password. Secure boot means that when you log in you can trust that the disk decryption screen is not a disk encryption key exfiltration screen waiting for you to enter your password so that a disk backup taken earlier can be decrypted. How? The disk encryption is based on a key in the TPM which only is decrypted with your password. That TPM gets wiped when…
That doesn't actually protect against that attack, though. The evil maid just steals the guts of your computer and replaces them with ones that always say "sorry, wrong password", while exfiltrating the password you tried over Wi-Fi or Bluetooth. Then they use your password to decrypt your unmodified hard drive with your unmodified TPM on your unmodified motherboard. Also, I don't think this is true: > That TPM gets…
In a high security situation. It would not be a password, but a smartcard which authenticates the device before providing its key, and the device authenticating the smartcard.
Edit: For the purposes of the Networked Evil Maid Attacks. Mutual Authentication (of device and user) is currently the purpose of research. It has not needed to be implemented yet as the regular Evil Maid is still possible due to the fact that Secure Boot is currently the easier target to circumvent. Once Secure Boot becomes harder to circumvent and old "assumed" buggy kernels are revoked from running. Networked Evil Maid counter measures will need to be implemented as standard
Re: Update on Linux hibernation support when lockdown is enabled
#9Earlier quoted context omitted.
That doesn't actually protect against that attack, though. The evil maid just steals the guts of your computer and replaces them with ones that always say "sorry, wrong password", while exfiltrating the password you tried over Wi-Fi or Bluetooth. Then they use your password to decrypt your unmodified hard drive with your unmodified TPM on your unmodified motherboard. Also, I don't think this is true: > That TPM gets…
In a high security situation. It would not be a password, but a smartcard which authenticates the device before providing its key, and the device authenticating the smartcard. Edit: For the purposes of the Networked Evil Maid Attacks. Mutual Authentication (of device and user) is currently the purpose of research. It has not needed to be implemented yet as the regular Evil Maid is still possible due to the fact that…
Does anything actually support this, or is it purely hypothetical? And even if that did exist, wouldn't that mean that password stealing wouldn't be an issue even without Secure Boot?
Re: Update on Linux hibernation support when lockdown is enabled
#10This would make a huge difference in battery life for Linux laptops with secure boot enabled. Lots of modern laptops don’t even properly support S3 sleep properly (looking at you dell) and want to be able to hibernate to save power.
Is this only true of Windows hardware, or does it include hardware designed for Linux?
Does consumer hardware designed for linux even exist? Even bigger shops like system76 buy preconfigured laptops and install coreboot and PopOS! on it.