Re: [PATCH] ima: select the SHA384 PCR bank for the boot aggregate

[Mimi Zohar <zohar@linux.ibm.com>]

On Wed, 2026-08-26 at 19:11 +0000, Singh, Jashandeep wrote:
> From: Jashandeep Singh <jdsw@juniper.net>
> 
> ima_calc_boot_aggregate() selects a TPM PCR bank matching the
> configured IMA hash algorithm, otherwise falling back to the SHA256
> bank or the SHA1 bank.
> 
> A TPM 2.0 can be provisioned with only the SHA384 bank enabled, with no
> SHA256 or SHA1 bank. None of the above then matched, selection failed
> with
> 
>     ima: No suitable TPM algorithm for boot aggregate
> 
> and the boot aggregate digest was left as zeros, as for TPM bypass,
> making remote attestation impossible.
> 
> Accept the SHA384 bank as a fallback. The configured IMA hash algorithm
> is still matched first.

FYI, all enabled TPM banks are extended.  Refer to the functions
ima_pcr_extend() and tpm_pcr_extend().

The IMA measurement list contains file data hashes based on the IMA default hash
algorithm.  Similarly, the boot_aggregate hash is calculated using the IMA
default hash algorithm.

If you're seeing "ima: No suitable TPM algorithm for boot aggregate", it
probably means no TPM banks are configured.

Mimi