When IMA is initialized the default TPM is queried and saved.
If at this point a TPM wasn't available, but is detected and surfaced
later by the system, IMA doesn't update the TPM information.
security/integrity/ima/ima_init.c
int __init ima_init(void)
{
int rc;
ima_tpm_chip = tpm_default_chip();
if (!ima_tpm_chip)
pr_info("No TPM chip found, activating TPM-bypass!\n");
...
}
TPM PCR update function in IMA is essentially a NOP if TPM wasn't
detected during IMA init.
security/integrity/ima/ima_queue.c
static int ima_pcr_extend(const u8 *hash, int pcr)
{
int result = 0;
if (!ima_tpm_chip)
return result;
...
}
In one configuration I am testing, I see the TPM appear post IMA Init.
Likely this is rare, but I was wondering if there was a reason why TPM
information is only queried during IMA init, but never updated at a
later point.
Thanks,
-lakshmi