How to Configure Linux IMA (Integrity Measurement Architecture) for Executable Attestation

In highly regulated Linux environments—such as servers processing financial transactions, military infrastructure, or critical industrial control systems (ICS)—preventing malware execution is insufficient. You must mathematically prove that every single binary, shared library, and kernel module executing on the system has not been maliciously modified, tampered with, or silently replaced by an advanced persistent threat (APT). Traditional file integrity monitoring tools (like Tripwire or AIDE) only scan files on a schedule, leaving massive temporal gaps where malware can execute. To achieve real-time, mathematically guaranteed execution control, Linux security engineers deploy the Integrity Measurement Architecture (IMA), a powerful subsystem built directly into the Linux kernel.

The Architecture of Linux IMA

The Integrity Measurement Architecture operates at the absolute lowest level of the Linux kernel’s Virtual File System (VFS) layer. It intercepts every single attempt to open a file for execution (e.g., executing a bash script, launching an ELF binary, or dynamically loading a .so shared library).

When a user types /usr/bin/python3, the kernel pauses the execution. The IMA subsystem reads the entire binary into memory and calculates a cryptographic hash (typically SHA-256).

IMA operates in two primary modes:

1. Measurement Mode: IMA calculates the hash and appends it to a secure, append-only kernel log. This log can later be cryptographically attested (signed by a hardware TPM chip) and sent to a remote security server to prove the exact sequence of software executed on the host.
2. Appraisal Mode: This is the active enforcement mode. IMA calculates the hash of the file and compares it against a known-good digital signature stored directly in the file’s Extended Attributes (security.ima). If the calculated hash does not perfectly match the signed attribute, the kernel mathematically rejects the execution with a Permission denied error. The malware is blocked before the CPU processes a single instruction.

Enabling the IMA Subsystem

Because IMA introduces CPU overhead (hashing every executed file) and strict operational constraints, it is disabled by default in most generic Linux distributions, though the kernel modules are usually present. You must enable it by passing specific parameters to the kernel bootloader (GRUB).

Open your GRUB configuration file (e.g., /etc/default/grub) and append the following to the GRUB_CMDLINE_LINUX string:

ima_appraise=enforce ima_policy=tcb

The ima_policy=tcb (Trusted Computing Base) instructs the kernel to measure all programs executed by root, all files executed by anyone, and all kernel modules.

Update GRUB and reboot the server:

sudo update-grub
sudo reboot

Applying Cryptographic Signatures (EVMCTL)

If you boot a system directly into ima_appraise=enforce without first signing the binaries, the system will completely lock up, as the kernel will refuse to execute init or bash because they lack the required security.ima extended attribute.

In a production deployment, you must first boot into a “fix” or “log” mode, generate an RSA key pair, and utilize the evmctl (Extended Verification Module Control) utility to digitally sign the entire filesystem.

Assuming you have generated a private key (ima_key.pem) and loaded the public key into the kernel keyring, you recursively sign the /usr/bin directory:

find /usr/bin -type f -exec evmctl sign --imasig {} ~/.keys/ima_key.pem \;

This command injects the RSA digital signature into the extended attributes of every binary.

Verifying the Execution Block

Once the filesystem is signed and the kernel is booted in enforce mode, the security boundary is absolute.

If an attacker compromises the server via an SSH vulnerability, gains root privileges, and attempts to overwrite /usr/bin/sshd with a backdoored version, the attack will fail operationally. Even though the attacker is root and can technically overwrite the file, the moment they modify the binary, the file’s hash changes.

When the system attempts to execute the new sshd, the kernel’s IMA subsystem recalculates the hash. The new hash will not match the cryptographically signed hash residing in the security.ima extended attribute (which the attacker cannot successfully forge without possessing the offline private RSA key). The kernel will output bash: /usr/bin/sshd: Permission denied to the attacker’s terminal, and log an integrity violation to dmesg. Through IMA appraisal, the Linux kernel transforms from a discretionary access system into a cryptographically enforced, immutable execution environment.