Post Syndicated from daroc original https://lwn.net/Articles/1103190/

When a computer hibernates, the kernel writes the contents of memory to disk and
then shuts the system down. Resuming from hibernation involves reading that data
back into memory, and then having the kernel pick up where it left off.
Unfortunately, the kernel does not have
any way to know that the data it is reading back has not been tampered with,
which is why lockdown, an optional kernel
feature that attempts to prevent modifications to the running kernel, disables hibernation.
Matthew Garrett, who has been working on lockdown for many years, has shared

a patch set that aims to fix this problem. His solution must also protect
against downgrade attacks (where an attacker reboots the computer with an older
kernel version to bypass new protections), which complicates the implementation.