Linux Lockdown and Hibernation (again)

Linux operates in two distinct spaces - kernel space, where code runs in ring 0, and userland, where applications run in ring 3. User space cannot directly access kernel space memory, but root users could bypass this restriction by loading kernel modules or mapping memory ranges belonging to PCI devices. The boundary between root and kernel was traditionally porous, allowing root to potentially compromise the kernel.

In 2012, Microsoft introduced UEFI Secure Boot, which required systems to only boot with authorized code. This led to the development of the Lockdown Linux Security Module, which blocks userspace interfaces that modify the kernel and enforces trusted signatures for modules. However, Lockdown also disabled hibernation, which some users relied on.

The challenge was to prevent root from modifying the hibernation image to inject malicious code into kernel space. The solution involved using Trusted Platform Modules (TPMs), which provide cryptographic coprocessors capable of encrypting and decrypting data using keys tied to specific TPMs. By encrypting part of the hibernation image with a TPM-generated key and storing the encrypted key within the image, the kernel could verify the image's authenticity during the next boot.

This approach ensured that only the kernel could generate the encryption key, preventing root from tampering with the hibernation image. However, this method relies on TPMs with Dynamic Root of Trust Measurement (TXT) support, which is not widely available on consumer systems.