Re: [PATCH 09/27] hibernate: Disable when the kernel is locked down

[Alan Cox]

On Wed,  6 Mar 2019 15:58:55 -0800
Matthew Garrett <matthewgarrett@xxxxxxxxxx> wrote:

> From: Josh Boyer <jwboyer@xxxxxxxxxxxxxxxxx>
> 
> There is currently no way to verify the resume image when returning
> from hibernate.  This might compromise the signed modules trust model,
> so until we can work with signed hibernate images we disable it when the
> kernel is locked down.

That one is a bit worrying since whilst the other stuff may be useful in
some business environments, mandatory hibernate not suspend to RAM is a
common corporate IT policy because of concerns about theft and recovery
of memory contents.

Alan