In my understanding (not an expert on this) the linux integrity measure hash should not change unless there is a real change to kernel/modules or the aggregate boot measure.
We are tying to use IMA for trusted boot and attestation. However, on 6.5.0-35-generic (ubuntu 22.04), the IMA hash keeps changing on every reboot without any software updates.
I may be wrong about the root cause, but it may be related to the order of evaluation of the kernel module files ?
Diff of /sys/kernel/security/ima/ascii_runtime_measurements between 2 reboots:
In my understanding (not an expert on this) the linux integrity measure hash should not change unless there is a real change to kernel/modules or the aggregate boot measure.
We are tying to use IMA for trusted boot and attestation. However, on 6.5.0-35-generic (ubuntu 22.04), the IMA hash keeps changing on every reboot without any software updates.
I may be wrong about the root cause, but it may be related to the order of evaluation of the kernel module files ?
Diff of /sys/kernel/ security/ ima/ascii_ runtime_ measurements between 2 reboots:
--- ascii_runtime_ measurements22 2024-06-06 14:00:23.440000000 +0000 measurements21 2024-06-06 13:58:33.229038384 +0000 cef902e2a8c2377 2d48798148 ima-ng sha1:b952f83314 30d08db2931db38 713342a45dcb9e1 /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ usb/host/ xhci-pci- renesas. ko 4df0f645a74f8f7 30dec9af7f ima-ng sha1:01f17ddccf fb8cbc8651b46f9 1916b21258ba82b /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ char/hw_ random/ virtio- rng.ko 7d7ada8218068c9 75bad1153f ima-ng sha1:e84dbae74b 7f246b964d3b073 b9a8847dd8e408f /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ usb/host/ xhci-pci. ko 4d3a7410a1b4c4a 7fab66b559 ima-ng sha1:0bc18fb894 d2f5b04331b239e 0e6073b51354211 /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ gpu/drm/ drm.ko 7efbee1aca74c79 c1d2f8a38e ima-ng sha1:2f902f7314 e44bba2d3056e63 40d587c376f641a /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ i2c/i2c- smbus.ko a30de2cca2de936 fd73580369 ima-ng sha1:99e31489a8 d3a958411ffd6e9 9c8ea0d0d01c210 /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ ata/libahci. ko 2cfc9f85194a31e f97d0b1623 ima-ng sha1:a0919355cf 28b07a7ec1a1f64 1cf1a4ed4219691 /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ i2c/busses/ i2c-i801. ko 4d3a7410a1b4c4a 7fab66b559 ima-ng sha1:0bc18fb894 d2f5b04331b239e 0e6073b51354211 /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ gpu/drm/ drm.ko abe7e47ac7e830f 81fa43878f ima-ng sha1:4190f2cc17 a89dac6afae4575 910487409a47b29 /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ mfd/lpc_ ich.ko a30de2cca2de936 fd73580369 ima-ng sha1:99e31489a8 d3a958411ffd6e9 9c8ea0d0d01c210 /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ ata/libahci. ko 3cd7784617d61ab 8dd97d4844 ima-ng sha1:32a600680f d22682c12fb34d2 e16ceb4c6415fd6 /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ input/mouse/ psmouse. ko 5bc4056538fc985 43c4ccb33b ima-ng sha1:4b0216c96c 99bfbab72daa30d f057e378029123b /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ crypto/ cryptd. ko 5aff73c125320db 0101f87825 ima-ng sha1:27856f6182 f8e76688055184d b94e1756d77da59 /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ ata/ahci. ko 2cfc9f85194a31e f97d0b1623 ima-ng sha1:a0919355cf 28b07a7ec1a1f64 1cf1a4ed4219691 /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ i2c/busses/ i2c-i801. ko 5bc4056538fc985 43c4ccb33b ima-ng sha1:4b0216c96c 99bfbab72daa30d f057e378029123b /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ crypto/ cryptd. ko 943dc00008c43bf 6a78722247 ima-ng sha1:f0c245e28c a906a8b3ced94ea af872175095c24e /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ crypto/ crypto_ simd.ko c5e188f18b6efb3 8d24066917 ima-ng sha1:0b4ba623e8 88760dee0d1227d 820058ff7e3e9d2 /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ drivers/ gpu/drm/ drm_kms_ helper. ko fd6ea8ee96299a8 697386b6fa ima-ng sha1:c4c9542d63 c603275d0846804 5e56d45a3f06dee /usr/lib/ modules/ 6.5.0-35- generic/ kernel/ arch/x86/ crypto/ aesni-intel. ko
+++ ascii_runtime_
@@ -2,14 +2,14 @@
10 b1d60291291154d
10 6489a4f054c3d0c
10 dc9529d9c1a17ea
-10 3f5e368749dbff8
10 17cccb8cb394efb
-10 d19437485bf5540
-10 591a35a9de40e75
+10 3f5e368749dbff8
10 4d2af98b6a28806
+10 d19437485bf5540
10 2a4b0265d580776
-10 6239ce08348df61
10 41b5ef647a33722
+10 591a35a9de40e75
+10 6239ce08348df61
10 1d2d52cc82f2ff0
10 9d233b196dac726
10 8283f095fbd71a3
--snipped-----