IMA (Integrity Measurement Architecture) is a Linux kernel subsystem, merged in kernel 2.6.30, that hooks into the kernel’s file access paths — execve(), mmap(), open() — and computes a cryptographic hash of each file’s contents before it is accessed, according to a configurable policy. It is the runtime half of the Linux integrity story: where TPM PCR measurements and Secure Boot cover what was loaded during the boot sequence, IMA covers what happens after the OS is running, hashing executables, libraries, kernel modules, firmware, and configuration files as they are opened, creating a continuously updated record of everything the system has actually used.
IMA operates across four distinct modes, selectable per-rule in its policy. Measurement is the foundational mode: each hash is appended to a kernel-resident measurement log and, if a TPM is present, extended into PCR 10 — the register reserved exclusively for IMA across the Linux TPM PCR allocation. Because PCR registers can only be extended (never reset without a reboot), the aggregate value in PCR 10 accumulates a tamper-evident record of every measured file access across the system’s uptime; any software tampering with the log without also tampering with the TPM would produce a mismatch. Appraisal adds local enforcement: the kernel compares the computed hash against a reference value stored in the file’s security.ima extended attribute, and denies access if they do not match — this is how IMA can prevent execution of files that have been modified since they were last signed. Audit logs measurements to the kernel audit subsystem without enforcing. The fourth mode, protect, is implemented by the companion EVM (Extended Verification Module): EVM computes an HMAC over a file’s security extended attributes (including security.ima, security.selinux, and others) and detects offline tampering with those attributes — closing the attack where an adversary modifies a file and updates its security.ima hash to match while the system is powered off.
The primary operational use case for IMA measurement is remote runtime attestation via Keylime: a lightweight agent running on the attested system periodically produces a TPM quote over PCR 10 and the full measurement log; a remote verifier receives the quote, validates it against the TPM’s endorsement key, replays the log to confirm it matches the PCR value, and checks every entry against a policy-defined allowlist of approved file hashes. Any unexpected binary — a dropped rootkit, a modified library, an unapproved kernel module — appears as an unknown hash and immediately triggers a failed attestation state. This makes IMA the mechanism that extends the TPM’s boot-time attestation guarantee into a continuous, file-level runtime guarantee: the TPM and measured boot stack can prove what was loaded at boot; IMA and Keylime can prove what has been executed since.