I am digging into Integrity Measurement Architecture and try to enable it on an embedded device.
I have enabled the IMA related configuration flags and compiled the kernel. I can now see xattr
security.ima and can set hashes or signatures via
Running signed files works after loading the keys into
On first sight it doesn't look too bad.
But when I check the logs I can see an error message during boot up:
IMA: No TPM chip found, activating TPM-bypass!
In this question I am not addressing the issue why the TPM is not found, but I would like to know, what are the consequences?
What does TPM-bypass mean in the end?
I assume there will be some functionality missing but I cannot find any information what TPM-bypass means and what will be affected.
One issue I face is that the file /sys/kernel/security/ima/ascii_runtime_measurements only shows one line and does not grow.
Is that related to the TPM-bypass and what else should I expect?