Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #94449

Bug#1150677: linux: Linux logs error `ima: Can not allocate sha384 (reason: -2)`

Cross-posted to 2 groups.

Show all headers | View raw

Package: src:linux
Version: 7.2.9-1
Severity: minor


Dear Debian folks,


On a Dell XPS 13 7390, BIOS 1.29.0, Nuvoton TPM 2.0 NTC0702, Linux 
7.2.9-1 (*linux-image-7.2.9+deb14-amd64* 7.2.9-1) logs the error below:

     [    0.546039] ima: Allocated hash algorithm: sha256
     [    0.548233] ima: Can not allocate sha384 (reason: -2)

sha384 is provided by `CONFIG_CRYPTO_SHA512` (`crypto/sha512.c`), which 
`debian/config/config` sets to m:

     $ grep SHA512 /boot/config-7.2.9+deb14-amd64
     # CONFIG_MODULE_SIG_SHA512 is not set
     CONFIG_CRYPTO_SHA512=m
     CONFIG_CRYPTO_LIB_SHA512=y
     CONFIG_CRYPTO_LIB_SHA512_ARCH=y

SHA-1 works because IMA selects `CRYPTO_SHA1` resulting in:

     $ grep CRYPTO_SHA1 /boot/config-7.2.9+deb14-amd64
     CONFIG_CRYPTO_SHA1=y

SHA-256 works because `debian/config/config` already builds it in “for 
IMA_DEFAULT_HASH_SHA256”.

     $ grep CRYPTO_SHA256 /boot/config-7.2.9+deb14-amd64
     CONFIG_CRYPTO_SHA256=y

SHA-384 gets -ENOENT.

Please consider setting 
  


     CONFIG_CRYPTO_SHA512=y 
  


next to `CONFIG_CRYPTO_SHA256=y`. `CONFIG_CRYPTO_LIB_SHA512` is already 
built in, so only the crypto API glue moves into vmlinux.

Tested on Dell XPS 13 7390.


Kind regards,

Paul


PS: `ima_init_crypto()` runs as a late initcall. It allocates a shash 
for every PCR bank, the TPM reports as active. 
`tpm2_get_pcr_allocation()` skips banks without selected PCRs. With the 
default ima_hash and no policy loaded yet, that loop is the only place 
requesting sha384, so this TPM has an active SHA-384 bank.

The effect is more than a log message. For a bank without a tfm, IMA 
extends PCR 10 with the zero-padded SHA-1 template digest (see the 
comment “for unmapped TPM algorithms digest is still a padded SHA1” in 
`ima_calc_field_array_hash()`). So the SHA-384 bank of PCR 10 does not 
contain SHA-384 measurements.

PPS: Related to bug report #1144056 [1].

https://bugs.debian.org/1144056

Back to linux.debian.kernel | Previous | Next | Find similar | Unroll thread

Thread

Bug#1150677: linux: Linux logs error `ima: Can not allocate sha384 (reason: -2)` Paul Menzel <pmenzel@molgen.mpg.de> - 2026-10-12 09:10 +0200

csiph-web