The IMA Subsystem: Extending Attestation into Runtime

Beyond Boot: What Runs After the Kernel Loads?

Measured Boot and TPM sealing protect the boot chain, but they stop at the point the kernel finishes loading. Once the system is running, new executables are launched, kernel modules are loaded, and configuration files are read. An attacker who cannot compromise the boot chain might instead replace a running application binary or inject a malicious shared library.

Linux IMA (Integrity Measurement Architecture) extends the attestation chain into runtime. It is a kernel subsystem that intercepts every file execution, kernel module load, and (optionally) file read, calculates the SHA-256 hash of the file, and extends that hash into PCR 10.

IMA Policy

IMA is configured via a policy file that specifies which operations to measure — typically kernel module loads, executable launches, files opened by root, and any file carrying the IMA signature extended attribute.

When IMA measures a file, it appends an entry to the IMA measurement log (readable at /sys/kernel/security/ima/ascii_runtime_measurements) and extends PCR 10.

IMA Appraisal: Enforcement Mode

IMA has two modes:

• Measurement only: Records hashes into PCR 10 and the log. Does not block anything. Used for auditing and remote attestation.
• Appraisal: Checks the file's hash against a trusted value stored in the file's extended attributes (security.ima). If the hash does not match, the kernel refuses to execute the file. Signing a binary for appraisal (with a tool like evmctl) writes that trusted hash into its extended attributes; from then on, the kernel refuses to execute the binary if its contents have changed since signing.

IMA and Remote Attestation Together

The IMA log is the runtime complement to the boot-time PCR measurements. A remote attestation server can:

1. Verify the TPM Quote (PCR 0-7: boot chain is clean).
2. Request the IMA log and verify PCR 10 matches the log's aggregate hash.
3. Inspect the IMA log entries to confirm only approved executables ran.

This gives the verifier a complete picture: not just "did this machine boot correctly" but "has this machine only run approved software since it booted."

Key Point: IMA closes the gap between boot-time attestation and runtime integrity. Without IMA, a machine could boot cleanly and then have its application binaries replaced. With IMA, any post-boot file modification is either blocked (appraisal mode) or recorded in PCR 10 (measurement mode), making it detectable by a remote attestation verifier.