Re: [PATCH] ima: allow users to specify the pcr index with IMA_MEASURE_PCR_IDX

[Mimi Zohar]

On Mon, 2026-08-24 at 17:22 +0100, Julian Braha wrote:
> The IMA_MEASURE_PCR_IDX option is currently not visible in the kconfig
> frontend, so it always uses its default, 10. This means that the
> 'range 8 14' is dead code, and users are unable to specify the pcr index
> value.
> 
> In a previous discussion, Mimi explained that users should be able to use
> this config option to specify the pcr index. [1]
> 
> Let's add a prompt for users to specify the pcr index, when EXPERT is
> enabled.
> 
> This dead range was found by kconfirm, a static analysis tool for Kconfig.
> 
> Signed-off-by: Julian Braha <julianbraha@xxxxxxxxx>
> ---
> Link: https://lore.kernel.org/all/1feff118-4afa-4b9c-86f1-271a7a88208f@xxxxxxxxx/T/#mc4efa2491b4937eb7c9e532c29ffba516a70e662 [1]
> ---
>  security/integrity/ima/Kconfig | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
> index b3a9f86809b0..2d5bb19ea6ac 100644
> --- a/security/integrity/ima/Kconfig
> +++ b/security/integrity/ima/Kconfig
> @@ -46,6 +46,7 @@ config IMA_KEXEC
>  
>  config IMA_MEASURE_PCR_IDX
>  	int
> +	prompt "PCR Index for Aggregate" if EXPERT
>  	range 8 14
>  	default 10
>  	help

Thanks, Julian.  The existing Help says, "If unsure, use the default 10."  Could
we make this recommendation stronger?  AI suggested:

	  IMA_MEASURE_PCR_IDX determines the TPM PCR register index
	  that IMA uses to maintain the integrity aggregate of the
	  measurement list. Most attestation tooling expects PCR 10.

	  The default is almost always what you want. Only change
	  this if you know what you are doing.

Thanks,

Mimi