IMA

Contents

• Introduction
• Quick Start
• IMA and EVM Concepts
  • Threat Model
    • Memory Attacks
    • File Name Changes
  • Measurement
  • Appraisal
    • Hash
    • Signature
  • Audit
  • Extended Verification Module (EVM)
    • Enabling EVM
    • EVM HMAC
    • EVM Signature
  • Keyrings
    • .builtin_trusted_keys
    • .machine
    • .platform
    • .secondary_trusted_keys
    • .ima
    • .evm
    • .blacklist
  • kexec Implications
    • kexec Background
    • kexec IMA Impact
    • kexec IMA Configuration
  • Appended Signatures
• IMA Configuration
  • Kernel Support
  • Build Flags
    • General
      • CONFIG_INTEGRITY
      • CONFIG_IMA
      • CONFIG_IMA_WRITE_POLICY
      • CONFIG_IMA_READ_POLICY
      • CONFIG_IMA_DEFAULT_HASH
      • CONFIG_FS_VERITY
    • Compiled-In Policies
      • CONFIG_IMA_ARCH_POLICY
        • ARM and x86
        • PowerPC
      • CONFIG_MODULE_SIG
      • CONFIG_IMA_APPRAISE_BUILD_POLICY
      • CONFIG_IMA_APPRAISE_REQUIRE_FIRMWARE_SIGS
      • CONFIG_IMA_APPRAISE_REQUIRE_KEXEC_SIGS
      • CONFIG_IMA_APPRAISE_REQUIRE_MODULE_SIGS
      • CONFIG_IMA_APPRAISE_REQUIRE_POLICY_SIGS
    • Measure
      • CONFIG_IMA_DEFAULT_TEMPLATE
      • CONFIG_IMA_MEASURE_PCR_IDX
      • CONFIG_IMA_KEXEC
      • CONFIG_IMA_DISABLE_HTABLE
      • CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
      • CONFIG_IMA_LSM_RULES
      • CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS
    • Appraise
      • CONFIG_IMA_APPRAISE
      • CONFIG_IMA_APPRAISE_BOOTPARAM
      • CONFIG_IMA_APPRAISE_MODSIG
      • CONFIG_IMA_TRUSTED_KEYRING
      • CONFIG_INTEGRITY_SIGNATURE
      • CONFIG_INTEGRITY_ASYMMETRIC_KEYS
      • CONFIG_IMA_APPRAISE_SIGNED_INIT
      • CONFIG_SYSTEM_BLACKLIST_KEYRING
      • CONFIG_LOAD_UEFI_KEYS
      • CONFIG_LOAD_IPL_KEYS
      • CONFIG_LOAD_PPC_KEYS
    • EVM Build Flags
      • CONFIG_EVM
      • CONFIG_ENCRYPTED_KEYS
      • CONFIG_USER_DECRYPTED_DATA
      • CONFIG_TRUSTED_KEYS
      • CONFIG_EVM_ADD_XATTRS
      • CONFIG_EVM_EXTRA_SMACK_XATTRS
    • Keyring Configuration
      • CONFIG_SECONDARY_TRUSTED_KEYRING
      • CONFIG_INTEGRITY_PLATFORM_KEYRING
      • CONFIG_INTEGRITY_MACHINE_KEYRING
      • CONFIG_INTEGRITY_CA_MACHINE_KEYRING
      • CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX
  • Boot Command Line Arguments
    • Hash Specifiers
      • ima_hash
    • Policy Specifiers
      • ima_policy
    • Appraise Specifiers
      • ima_appraise
      • evm
    • Template Specifiers
      • ima_template
      • ima_canonical_fmt
      • ima_template_fmt
• IMA Policy
  • Measure Policy Rule Design
  • Appraise Policy Rule Design
  • Policy Rule Order
  • Reading Policies
  • Built-in Policy Rules
    • Secure Boot State
    • IMA Measurement Policies
      • ima_tcb
      • ima_policy=tcb
      • ima_policy=critical_data
    • IMA Appraise Policies
      • ima_policy=secure_boot
      • ima_appraise_tcb
      • ima_policy=appraise_tcb
      • ima_policy=fail_securely
    • IMA Template Configuration
      • ima_template
      • ima_template_fmt
  • Custom Policy
    • Boot Time Custom Policy
    • Runtime Custom Policy
• Policy Syntax
  • Policy Syntax Action
  • Policy Syntax Conditions
    • func
      • func=MMAP_CHECK
      • func=BPRM_CHECK
      • func=CREDS_CHECK
      • func=FILE_CHECK
      • func=MODULE_CHECK
      • func=PATH_CHECK
      • func=FIRMWARE_CHECK
      • func=POLICY_CHECK
      • func=KEXEC_KERNEL_CHECK
      • func=KEXEC_INITRAMFS_CHECK
      • func=KEXEC_CMDLINE
      • func=KEY_CHECK
      • func=CRITICAL_DATA
      • func=SETXATTR_CHECK
    • mask
    • keyrings
    • fsmagic
    • fsname
    • fsuuid
    • uid=id
    • euid=id
    • gid=id
    • egid=id
    • fowner=id
    • fgroup=id
    • label
    • appraise_type
    • template
    • permit_directio
    • digest_type
    • appraise_flag
    • appraise_algos
    • pcr=value
    • obj_user=
    • obj_role=
    • obj_type=
    • subj_user=
    • subj_role=
    • subj_type=
    • SELinux variations
    • SMACK
• SELinux Labels
  • obj_type
• IMA Event Log
  • IMA Log Verification
    • IMA Attestation Background
    • IMA Attestation Recommendations
    • Multiple PCRs
  • IMA Event Log Location
  • IMA Event Log Format
  • IMA Event Log Ascii Format
  • IMA Event Log Binary Format
    • PCR Index
    • Template Hash
      • PCR Extend Type 1 (zero pad)
      • PCR Extend Type 2 (hash)
    • Template Name Length
    • Template Name
    • Template Data Length
    • Template Data
  • Built-in Templates
    • ima
    • ima-ng
    • ima-sig
    • ima-buf
    • ima-modsig
    • ima-ngv2
    • ima-sigv2
    • evm-sig
  • Template Data Fields
    • d
    • d-ng
      • Hash Length
      • Hash Algorithm
      • File Data Hash
    • d-modsig
    • d-ngv2
    • n
    • n-ng
      • File Name Length
      • File Name
    • sig
      • Signature Length
      • Signature Header
        • Signature Type
        • Signature Version
        • Hash Algorithm
        • Public Key Identifier
        • Signature Size
      • Signature
    • evmsig
    • buf
      • func=KEY_CHECK
      • func=CRITICAL_DATA
      • func=KEXEC_CMDLINE
    • modsig
    • uuid
    • iuid
    • igid
    • imode
    • xattrnames
    • xattrlengths
    • xattrvalues
  • Integer Format
• HOWTO
  • Utility Installation
    • keyctl
    • evmctl
    • mokutil
  • evmctl portable signature
  • evmctl fsverity signature
  • View a keyring
  • keyctl add key to keyring
  • sign-file
    • sign-file appended signature
  • verify-file
  • xz
  • Secure Boot State
  • Kernel Signing Key Generation
  • MOK Certificate Export
  • MOK Certificate Delete
  • IMA CA Key and Certificate
  • IMA Signing Key and Certificate
  • Sign and Install a Custom Policy
  • pesign Database
  • setfattr
  • fsverity
  • efikeygen
  • ima-inspect
  • imaextend
    • IMA log parsing
• Policy Samples
  • Policy 1 Template
    • Use Case
    • Explanation
    • Policy

Indices and tables

• Index

• Module Index

• Search Page