Re: [PATCH] ima: select the SHA384 PCR bank for the boot aggregate

On Wed, 2026-08-26 at 19:11 +0000, Singh, Jashandeep wrote:

From: Jashandeep Singh <redacted>

ima_calc_boot_aggregate() selects a TPM PCR bank matching the
configured IMA hash algorithm, otherwise falling back to the SHA256
bank or the SHA1 bank.

A TPM 2.0 can be provisioned with only the SHA384 bank enabled, with no
SHA256 or SHA1 bank. None of the above then matched, selection failed
with

    ima: No suitable TPM algorithm for boot aggregate

and the boot aggregate digest was left as zeros, as for TPM bypass,
making remote attestation impossible.

Accept the SHA384 bank as a fallback. The configured IMA hash algorithm
is still matched first.

FYI, all enabled TPM banks are extended.  Refer to the functions
ima_pcr_extend() and tpm_pcr_extend().

The IMA measurement list contains file data hashes based on the IMA default hash
algorithm.  Similarly, the boot_aggregate hash is calculated using the IMA
default hash algorithm.

If you're seeing "ima: No suitable TPM algorithm for boot aggregate", it
probably means no TPM banks are configured.

Mimi