Hi Mimi,
On Fri, Aug 14, 2026, Mimi Zohar wrote:
> ima_tpm.sh: update test2 to detect integrity violations
> + if [ "$num_violations" -eq 0 ]; then
> + $cmd > hash.txt 2>&1
> + ret=$?
> + else
> + tst_res TINFO "ignoring $num_violations violations"
> cmd="$cmd --ignore-violations"
Could the failure path of the unflagged invocation retain a retry with
--ignore-violations?
The counter read races with new IMA violations. If another task triggers a
ToMToU or open_writers violation after the counter is read as zero but before
evmctl reads the PCRs, the kernel appends a zero-digest record and extends the
PCR with 0xff. This invocation processes that record without
--ignore-violations, extends zeroes instead, and reports a spurious PCR
mismatch. The removed fallback covered this window.
Verdict - Needs revision
---
Note:
The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.
Regards,
LTP AI Reviewer
--
Mailing list info: https://lists.linux.it/listinfo/ltp
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.