0

I am digging into Integrity Measurement Architecture and try to enable it on an embedded device.

I have enabled the IMA related configuration flags and compiled the kernel. I can now see xattr security.ima and can set hashes or signatures via evmctl. Running signed files works after loading the keys into _ima keyring. On first sight it doesn't look too bad.

But when I check the logs I can see an error message during boot up:

IMA: No TPM chip found, activating TPM-bypass!

In this question I am not addressing the issue why the TPM is not found, but I would like to know, what are the consequences?

What does TPM-bypass mean in the end?

I assume there will be some functionality missing but I cannot find any information what TPM-bypass means and what will be affected.

One issue I face is that the file /sys/kernel/security/ima/ascii_runtime_measurements only shows one line and does not grow.

Is that related to the TPM-bypass and what else should I expect?

0

From what I have read IMA is totally useless without a TPM chip most likely TPM-bypass is just included in the code so users can test the software but it wont provide any real protections

Maybe you can try a TPM emulator like https://github.com/PeterHuewe/tpm-emulator if you just want to test

  • Thank you for you answer. I am not sure what this means in the end. Executing binaries that are not properly signed or hashed is prevented by IMA even with TPM-bypass. – Gerhardh Mar 25 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.