Re: [PATCH v3 2/8] ima: Switch to ima_hash_algo for boot aggregate

On Mon, 2020-03-02 at 15:11 +0000, Roberto Sassu wrote:

quoted

Yes, preference is given to the IMA default algorithm, but it should
fall back to using SHA256 or SHA1, based on the TPM.

Ok. The patch already does it even if the TPM version is not checked.
For TPM 1.2, if the default algorithm is not SHA1 the patch will select
the first PCR bank (SHA1).

Should I send a new patch which explicitly checks the TPM version?

Checking the TPM version shouldn't be necessary.  The code currently
sets bank_idx to the HASH_ALGO_SHA256.  If instead of initializing
bank_idx to 0, initialize it to the nr_allocated_banks or -1.  As long
as the bank_idx value is the same as the initialized value, set the
bank_idx to HASH_ALGO_SHA1.

The subsequent bank_idx would then be limited to testing for the
initialized value.

Mimi