Include PCRs 8 & 9 in per TPM 2.0 bank boot_aggregate calculation
ima: extend boot_aggregate with kernel measurements

Registers 8-9 are used to store measurements of the kernel and its
command line (e.g., grub2 bootloader with tpm module enabled). IMA
should include them in the boot aggregate. Registers 8-9 should be
only included in non-SHA1 digests to avoid ambiguity.

Signed-off-by: Maurizio Drocco <>
Reviewed-by: Bruno Meneguele <>
Tested-by: Bruno Meneguele <>  (TPM 1.2, TPM 2.0)
Signed-off-by: Mimi Zohar <>
2 files changed