Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #94449 > unrolled thread

Bug#1150677: linux: Linux logs error `ima: Can not allocate sha384 (reason: -2)`

Back to article view | Back to linux.debian.kernel

Contents

  Bug#1150677: linux: Linux logs error `ima: Can not allocate sha384 (reason: -2)` Paul Menzel <pmenzel@molgen.mpg.de> - 2026-10-12 09:10 +0200
    Bug#1150677: marked as done (linux: Linux logs error `ima: Can  not allocate sha384 (reason: -2)`) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-10-15 19:20 +0200
    Bug#1150677: marked as done (linux: Linux logs error `ima: Can  not allocate sha384 (reason: -2)`) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-10-16 05:40 +0200

#94449 — Bug#1150677: linux: Linux logs error `ima: Can not allocate sha384 (reason: -2)`

Package: src:linux
Version: 7.2.9-1
Severity: minor


Dear Debian folks,


On a Dell XPS 13 7390, BIOS 1.29.0, Nuvoton TPM 2.0 NTC0702, Linux 
7.2.9-1 (*linux-image-7.2.9+deb14-amd64* 7.2.9-1) logs the error below:

     [    0.546039] ima: Allocated hash algorithm: sha256
     [    0.548233] ima: Can not allocate sha384 (reason: -2)

sha384 is provided by `CONFIG_CRYPTO_SHA512` (`crypto/sha512.c`), which 
`debian/config/config` sets to m:

     $ grep SHA512 /boot/config-7.2.9+deb14-amd64
     # CONFIG_MODULE_SIG_SHA512 is not set
     CONFIG_CRYPTO_SHA512=m
     CONFIG_CRYPTO_LIB_SHA512=y
     CONFIG_CRYPTO_LIB_SHA512_ARCH=y

SHA-1 works because IMA selects `CRYPTO_SHA1` resulting in:

     $ grep CRYPTO_SHA1 /boot/config-7.2.9+deb14-amd64
     CONFIG_CRYPTO_SHA1=y

SHA-256 works because `debian/config/config` already builds it in “for 
IMA_DEFAULT_HASH_SHA256”.

     $ grep CRYPTO_SHA256 /boot/config-7.2.9+deb14-amd64
     CONFIG_CRYPTO_SHA256=y

SHA-384 gets -ENOENT.

Please consider setting 
  


     CONFIG_CRYPTO_SHA512=y 
  


next to `CONFIG_CRYPTO_SHA256=y`. `CONFIG_CRYPTO_LIB_SHA512` is already 
built in, so only the crypto API glue moves into vmlinux.

Tested on Dell XPS 13 7390.


Kind regards,

Paul


PS: `ima_init_crypto()` runs as a late initcall. It allocates a shash 
for every PCR bank, the TPM reports as active. 
`tpm2_get_pcr_allocation()` skips banks without selected PCRs. With the 
default ima_hash and no policy loaded yet, that loop is the only place 
requesting sha384, so this TPM has an active SHA-384 bank.

The effect is more than a log message. For a bank without a tfm, IMA 
extends PCR 10 with the zero-padded SHA-1 template digest (see the 
comment “for unmapped TPM algorithms digest is still a padded SHA1” in 
`ima_calc_field_array_hash()`). So the SHA-384 bank of PCR 10 does not 
contain SHA-384 measurements.

PPS: Related to bug report #1144056 [1].

https://bugs.debian.org/1144056

[toc] | [next] | [standalone]

#94485 — Bug#1150677: marked as done (linux: Linux logs error `ima: Can not allocate sha384 (reason: -2)`)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Thu, 15 Oct 2026 17:14:51 +0000
with message-id <E1xHP2Z-00000003hJQ-3Jte@fasolo.debian.org>
and subject line Bug#1150677: fixed in linux 7.2.11-1
has caused the Debian Bug report #1150677,
regarding linux: Linux logs error `ima: Can not allocate sha384 (reason: -2)`
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1150677: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150677
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#94497 — Bug#1150677: marked as done (linux: Linux logs error `ima: Can not allocate sha384 (reason: -2)`)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Fri, 16 Oct 2026 03:34:29 +0000
with message-id <E1xHYiD-00000005UHi-2hxW@fasolo.debian.org>
and subject line Bug#1150677: fixed in linux 7.3~rc7-1~exp1
has caused the Debian Bug report #1150677,
regarding linux: Linux logs error `ima: Can not allocate sha384 (reason: -2)`
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1150677: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150677
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web