On Mon, 2020-01-13 at 17:06 -0700, Jerry Snitselaar wrote: > We had a report of messages from ima saying "Error communicating with > TPM". Looking into it a bit, it looks like with some Dell systems > (possibly others as well) in the bios they can set the hash algorithm > being used. In this case with that set to sha256 the messages > appear. Flipping the system to using sha1 makes them disappear. > Looking at the ima code, ima_calc_boot_aggregate_tfm hard codes using > sha1. Should that be changed to use whatever the default is in the > config, or possibly find out from the tpm what algorithm is being used? The ima-ng template contains two digests. The first digest is the value being extended into the TPM, while the second digest is either the boot aggregate or file data hash. It sounds like the problem is with the first digest. Changing the boot-aggregate to use sha256 might be a good idea, but probably won't fix the problem. Mimi
