Linux Lockdown and Hibernation (again)
Linux Lockdown blocks hibernation because root can forge swap images that resume into attacker-controlled kernel memory.
Matthew Garrett revisits why the Linux Lockdown LSM disables hibernation when protecting the kernel from root. Lockdown closes interfaces such as unsigned modules, device DMA, and MSR writes so UEFI Secure Boot cannot be undone after boot. Linux hibernation stores an unsigned resume image in swap, letting root plant an image that the kernel copies back into memory. Encrypted swap does not stop root, and the post discusses TPM-sealed keys, localities, and PCR extension as ways to prove the kernel wrote the image.
- Lockdown blocks kernel-modifying userspace interfaces and requires signed modules.
- Root can forge a hibernation image in swap and gain kernel control on resume.
- Encrypted swap does not help because root already sees plaintext swap.
- TPM localities are often unavailable, so PCR extension is the alternative path.
- Vendors
- Microsoft
From the original article
14 min read at codon.org.uk(This is an updated version of an older post - the introduction remains the same, the technical details are different) Linux draws a distinction between code running in kernel (kernel space) and applications running in userland (user space). This is enforced at the hardware level - in x86-speak 1 , kernel space code runs in ring 0 and user space code runs in ring 3 2 .
By codon.org.uk via binjip978 · codon.org.uk
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.