Re: [PATCH] ima: select the SHA384 PCR bank for the boot aggregate

[Mimi Zohar]

On Thu, 2026-08-27 at 16:56 +0200, Roberto Sassu wrote:
> On Thu, 2026-08-27 at 14:46 +0000, Singh, Jashandeep wrote:
> > Mimi, the patch covers the case where the TPM is provisioned with a single PCR
> > bank, SHA-384, while the default IMA hash is configured as SHA-256.
> > 
> > The SHA-384 bank is present in nr_allocated_banks, but it matches neither the
> > configured default (SHA-256) nor the current hardcoded fallbacks (SHA-256, then
> > SHA-1). As a result, bank_idx remains -1, and we hit "No suitable TPM algorithm
> > for boot aggregate", leaving the boot aggregate zeroed.
> > 
> > Roberto, it is not strictly true that the boot aggregate algorithm is always the
> > same as the default IMA hash algorithm.
> > 
> > When the bank corresponding to the default hash is not allocated, the existing
> > SHA-256/SHA-1 fallback logic selects a different bank than the default.
> > Therefore, the boot aggregate can already use a different algorithm from the
> > configured IMA hash.
> > 
> > My patch adds SHA-384 as one more fallback for the case where SHA-384 is the
> > only allocated bank. This allows users with such a configuration to have the
> > boot aggregate computed, without requiring them to change their default IMA
> > hash to SHA-384.
> 
> That would work for your use case, but what about anyone using a single
> SHA-512 PCR bank?
> 
> Would it be fine to add a new Kconfig and kernel option to specify a
> custom boot aggregate algorithm?

Yes, I'm fine with defining a new Kconfig and kernel option.  

Examples:
sha384: <digest> boot_aggregate, where the digest is calculated based on the TPM
384 bank PCRs.
 
sha512: <digest> boot_aggregate, where the digest is calculated based on the TPM
512 bank PCRs.

Mimi
>