On 2/9/2018 11:23 AM, James Bottomley wrote:
On Fri, 2018-02-09 at 07:26 -0500, Mimi Zohar wrote:
On Fri, 2018-02-09 at 12:02 +0200, Jarkko Sakkinen wrote:
It seems that the PCRs are one of the earliest things to come
on-line, so IMA always works. This is on my current laptop where I'm
running this patch with IMA: I no longer see the IMA bypass message and
IMA comes up normally.
I would expect PCRs to be available by the time IMA needs them because
the firmware also extends to PCRs. Therefore, the hash algorithms will
be tested very early in boot.
I only worry about the resume from suspend case, where firmware won't be
doing extends.
