archive mirror
 help / color / mirror / Atom feed
From: Lakshmi Ramasubramanian <>
To: Mimi Zohar <>,
Subject: ima_tpm_chip is queried and saved only at IMA init, but never later
Date: Tue, 24 Sep 2019 15:31:18 -0700	[thread overview]
Message-ID: <> (raw)

When IMA is initialized the default TPM is queried and saved.
If at this point a TPM wasn't available, but is detected and surfaced 
later by the system, IMA doesn't update the TPM information.

int __init ima_init(void)
	int rc;

	ima_tpm_chip = tpm_default_chip();
	if (!ima_tpm_chip)
		pr_info("No TPM chip found, activating TPM-bypass!\n");

TPM PCR update function in IMA is essentially a NOP if TPM wasn't 
detected during IMA init.

static int ima_pcr_extend(const u8 *hash, int pcr)
	int result = 0;

	if (!ima_tpm_chip)
		return result;

In one configuration I am testing, I see the TPM appear post IMA Init. 
Likely this is rare, but I was wondering if there was a reason why TPM 
information is only queried during IMA init, but never updated at a 
later point.


             reply	other threads:[~2019-09-24 22:31 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-24 22:31 Lakshmi Ramasubramanian [this message]
2019-09-24 22:37 ` James Bottomley
2019-10-03 15:40   ` Lakshmi Ramasubramanian
2019-10-03 15:49     ` Mimi Zohar
2019-10-04  0:39       ` Lakshmi Ramasubramanian
2019-10-03 15:58     ` James Bottomley

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \
    --subject='Re: ima_tpm_chip is queried and saved only at IMA init, but never later' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).