[PATCH] ima: debugging late_initcall_sync measurements

Mimi Zohar
2026-04-29T20:01:58Z

With this "[RFC PATCH v3 0/4] Fix IMA + TPM initialisation ordering
issue" patch set, how many records would be missing if IMA
initialization is deferred to late_initcall_sync [1]?

[1]https://lore.kernel.org/linux-integrity/cover.1777036497.git.noodles@meta.com/
---
Jonathan, Yeoreum, others -

By going into TPM-bypass mode, we can see how many measurements are actually
missing when deferring IMA initialization to late_initcall_sync. As this is
system/TPM dependent, I'd appreciate your checking. Please use the boot command
line option "ima_policy=tcb|critical_data".

thanks, Mimi

security/integrity/ima/ima.h | 1 +
security/integrity/ima/ima_init.c | 6 ++++++
security/integrity/ima/ima_main.c | 19 +++++++++++++++++++
3 files changed, 26 insertions(+)

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 01aae19ed365..9a1117112fb2 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -286,6 +286,7 @@ extern bool ima_canonical_fmt;

/* Internal IMA function definitions */
int ima_init_core(bool late);
+int ima_init_debug(bool late);
int ima_fs_init(void);
int ima_add_template_entry(struct ima_template_entry *entry, int violation,
const char *op, struct inode *inode,
diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c
index 5f335834a9bb..edd063b99685 100644
--- a/security/integrity/ima/ima_init.c
+++ b/security/integrity/ima/ima_init.c
@@ -122,6 +122,12 @@ void __init ima_load_x509(void)
}
#endif

+int __init ima_init_debug(bool late)
+{
+ ima_add_boot_aggregate(late); /* just add an additional record */
+ return 0;
+}
+
int __init ima_init_core(bool late)
{
int rc;
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 42099bfe7e43..23e669be54fc 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -1254,6 +1254,7 @@ static int ima_kernel_module_request(char *kmod_name)

#endif /* CONFIG_INTEGRITY_ASYMMETRIC_KEYS */

+#define TESTING 1
static int __init init_ima(bool late)
{
int error;
@@ -1264,6 +1265,23 @@ static int __init init_ima(bool late)
return 0;
}

+#ifdef TESTING
+ /*
+ * Initialize early, even if it means going into TPM-bypass mode,
+ * but add an additional boot_aggregrate message for the
+ * late_initcall_sync.
+ *
+ * If measurement list records exist between the boot_aggregate
+ * and the boot_aggregate_late records, these records would be
+ * missing when IMA initializion is deferred to late_initcall_sync.
+ */
+ if (ima_tpm_chip) {
+ ima_init_debug(late); /* Add an additional record */
+ return 0;
+ }
+
+ ima_tpm_chip = tpm_default_chip();
+#elif
/*
* If we found the TPM during our first attempt, or we know there's no
* TPM, nothing further to do
@@ -1276,6 +1294,7 @@ static int __init init_ima(bool late)
pr_debug("TPM not available, will try later\n");
return -EPROBE_DEFER;
}
+#endif

if (!ima_tpm_chip)
pr_info("No TPM chip found, activating TPM-bypass!\n");
--
2.53.0