What were you trying to do that didn't work?

After running ima-add-sigs, there are several files that have IMA signatures but fail the verification

What is the impact of this issue to you?

These files can cause trouble for the booting since they will fail IMA-appraisal.

Please provide the package NVR for which the bug is seen:

ima-evm-utils-1.5-3.el9.x86_64

How reproducible is this bug?:

always

Steps to reproduce

1.  ima-add-sigs
2. Count the files that have IMA signatures but fail verification

   for i in `find / -fstype xfs -type f -uid 0`; do     if getfattr -m security.ima -d -e hex $i 2> /dev/null | grep -qs security.ima=0x03 && ! evmctl ima_verify -k /etc/keys/ima/redhatimarelease-9.der $i &> /dev/null; then         echo $i;     fi; done | wc -l
   
   

Expected results

All files with IMA signature can pass verification.

Actual results

There are ~1000 files that fail signature verification.