Package: src:linux
Version: 7.2.9-1
Severity: minor
Dear Debian folks,
On a Dell XPS 13 7390, BIOS 1.29.0, Nuvoton TPM 2.0 NTC0702, Linux
7.2.9-1 (*linux-image-7.2.9+deb14-amd64* 7.2.9-1) logs the error below:
[ 0.546039] ima: Allocated hash algorithm: sha256
[ 0.548233] ima: Can not allocate sha384 (reason: -2)
sha384 is provided by `CONFIG_CRYPTO_SHA512` (`crypto/sha512.c`), which
`debian/config/config` sets to m:
$ grep SHA512 /boot/config-7.2.9+deb14-amd64
# CONFIG_MODULE_SIG_SHA512 is not set
CONFIG_CRYPTO_SHA512=m
CONFIG_CRYPTO_LIB_SHA512=y
CONFIG_CRYPTO_LIB_SHA512_ARCH=y
SHA-1 works because IMA selects `CRYPTO_SHA1` resulting in:
$ grep CRYPTO_SHA1 /boot/config-7.2.9+deb14-amd64
CONFIG_CRYPTO_SHA1=y
SHA-256 works because `debian/config/config` already builds it in “for
IMA_DEFAULT_HASH_SHA256”.
$ grep CRYPTO_SHA256 /boot/config-7.2.9+deb14-amd64
CONFIG_CRYPTO_SHA256=y
SHA-384 gets -ENOENT.
Please consider setting
CONFIG_CRYPTO_SHA512=y
next to `CONFIG_CRYPTO_SHA256=y`. `CONFIG_CRYPTO_LIB_SHA512` is already
built in, so only the crypto API glue moves into vmlinux.
Tested on Dell XPS 13 7390.
Kind regards,
Paul
PS: `ima_init_crypto()` runs as a late initcall. It allocates a shash
for every PCR bank, the TPM reports as active.
`tpm2_get_pcr_allocation()` skips banks without selected PCRs. With the
default ima_hash and no policy loaded yet, that loop is the only place
requesting sha384, so this TPM has an active SHA-384 bank.
The effect is more than a log message. For a bank without a tfm, IMA
extends PCR 10 with the zero-padded SHA-1 template digest (see the
comment “for unmapped TPM algorithms digest is still a padded SHA1” in
`ima_calc_field_array_hash()`). So the SHA-384 bank of PCR 10 does not
contain SHA-384 measurements.
PPS: Related to bug report #1144056 [1].
https://bugs.debian.org/1144056
