Re: [gentoo-hardened] Hardened gentoo and hibernation

[RB]

My first advice would be to forget about suspend-to-disk (hibernate)
and go for suspend-to-ram (sleep) - you can implement it securely with
the existing feature set of hardened-sources.  If you absolutely must
hibernate, then yes - you'll need to patch hardened-sources with the
suspend2 patchset if you're committed to using that kernel.  Once you
patch, there are many resources and HOWTOs available discussing the
steps to use the suspend2 toolkit to encrypt your hibernation image.

I, for one, question why you require hardened-sources (or
rsbac-sources).  The gains they offer over an appropriately secured
user-space are marginal at best, and those are mostly eliminated by
the concessions you'll make to run typical laptop setups (X,
hibernation, etc.)  IMO, they're designed as a tertiary layer of
defense to protect against malicious local users where firewalls and
user-space controls have failed.  Unless there is a specific feature
of the hardened trees you are looking for, your inexperience with
manually patching kernel sources indicates to me you may be just as
well off using suspend2-sources.  Remember - the only fully secured
system is disconnected, powered off, buried in 10 feet of concrete,
and guarded by a dozen Marines that haven't been fed in a week.
Beyond that, there is only a concept of "sufficiently secure."

Not to discourage you - I run hardened-sources on a laptop myself, but
it doesn't hibernate and doesn't run X.
-- 
gentoo-hardened@g.o mailing list