Hi folks, Im stumped with some issues with getting IMA to talk to the TPM interface driver, and was hoping you guys could help me out. I am building IMA as an out-of-tree Kernel module. We are based off CentOS v7.3 which is still sitting at the Linux v3.10 baseline (sad I know!). Everything seems to be fine but when I load the IMA module, it cannot seem to do a PCR read from the TPM driver: 2017-09-11T19:06:47.438 controller-1 kernel: info [ 228.152893] ima: No TPM chip found, activating TPM-bypass! (rc=-19) We also had to build TPM as an out-of-tree Kernel module, since we had to use the in-Kernel TPM resource manager which was unavailable till Jan 2017. TPM driver is loaded and operational: 2017-09-11T19:03:07.818 controller-1 kernel: info [ 5.929071] tpm_tis MSFT0101:00: 2.0 TPM (device-id 0x1A, rev-id 16) controller-1:~$ sudo lsmod | grep ima ima 47169 0 integrity 6430 1 ima controller-1:~$ sudo lsmod | grep tpm tpm_crb 6458 0 tpm_tis 5950 0 tpm_tis_core 10054 1 tpm_tis tpm 48093 3 tpm_crb,tpm_tis,tpm_tis_core I've tracked down the failure to the tpm_pcr_read() in tpm-interface.c, this was added as an interface to integrity: commit 659aaf2bb5496a425ba14036b5b5900f593e4484 Author: Rajiv Andrade > Date: Mon Feb 2 15:23:44 2009 -0200 TPM: integrity interface This patch adds internal kernel support for: - reading/extending a pcr value - looking up the tpm_chip for a given chip number Signed-off-by: Rajiv Andrade > Signed-off-by: Mimi Zohar > Signed-off-by: James Morris jmorris-gx6/JNMH7DfYtjvyW6yDsg@public.gmane.org The comment above the function implies that it cannot be executed if TPM is built as a Kernel module? "The TPM driver should be built-in, but for whatever reason it * isn't, protect against the chip disappearing, by incrementing * the module usage count." Is this understanding correct? If so then how do I get the IMA Kernel module to do a Kernel PCR read? Any help you guys can offer me would be greatly appreciated. Thanks, Kam P.S: I don't see a /sys/devices/pnp0//pcrs file on my system although TSS2 commands seem to indicate that the PCR list is active