Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 24. Enhancing security with the kernel integrity subsystem

You can improve the security of your system by using components of the kernel integrity subsystem. Learn more about the relevant components and their configuration.

24.1. The kernel integrity subsystem
Copy link

Protect system integrity by detecting file tampering and enforcing access policies with the kernel integrity subsystem. Comprising IMA and EVM, it logs access data to validation by remote parties through attestation.

Overview of IMA and EVM

Integrity Measurement Architecture (IMA) maintains the integrity of file content. It includes three features that you can enable through an IMA policy:

IMA-Measurement
Collect the file content hash or signature and store the measurements in the kernel. If a TPM is available, each measurement extends a TPM PCR, which enables remote attestation with an attestation quote.
IMA-Appraisal
Verify file integrity by comparing the calculated file hash with a known good reference value or by verifying a signature stored in the security.ima attribute. If verification fails, the system denies access.
IMA-Audit
Store the calculated file content hash or signature in the system audit log.

The Extended Verification Module (EVM) protects file metadata, including extended attributes related to system security such as security.ima and security.selinux. EVM stores a reference hash or HMAC for these security attributes in security.evm and uses it to detect if the file metadata has been changed maliciously.

Secure Boot integration

Secure Boot establishes the chain of trust from firmware to boot loader and then to kernel. With the integrity subsystem of the trusted kernel making sure only trusted user space code is executed, the chain of trust is now extended to the user space. Although the integrity subsystem can be used alone, some behaviours of the integrity subsystem are tied to secure boot, for example,

  • Some IMA policy rules is activated automatically when Secure Boot is enabled. For example, IMA-Measurement is enabled for kexec’ed kernel and kernel modules on UEFI systems, and IMA-Appraisal is enabled for kexec’ed kernel on PowerPC.
  • Currently, for Red Hat Enterprise Linux 10, only IMA policy signed by trusted keys can be loaded when secure boot is enabled

Enable signature-based IMA appraisal to ensure only authorized package files are accessed. Starting from RHEL 9, all package files are signed per file.

Enable the signature-based IMA appraisal: 

ima-setup --policy=/usr/share/ima/policies/01-appraise-executable-and-lib-signatures

This command:

  • Stores package file signature in security.ima for all installed packages.
  • Includes the dracut integrity module to load the IMA code signing key to kernel.
  • Copies the policy to /etc/ima/ima-policy so systemd loads it at boot time.

Verification

  • The ip command can be successfully executed.

  • If ip is copied to /tmp, by default, it loses its security.ima and therefore ip command is not executed. 

    # cp /usr/sbin/ip /tmp
# /tmp/ip
-bash: /tmp/ip: Permission denied
# /tmp/ip doesn’t have security.ima
# getfattr -m security.ima -d /tmp/ip
# whereas /usr/sbin/ip has
# getfattr -m security.ima /usr/sbin/ip
# file: usr/sbin/ip
security.ima=0sAwIE0zIESQBnMGUCMQCLXZ7ukyDcguLgPYwzXU16dcVrmlHxOta7vm7EUfX07Nf0xnP1MyE//AZaqeNIKBoCMFHNDOuA4uNvS+8OOAy7YEn8oathfsF2wsDSZi+NAoumC6RFqIB912zkRKxraSX8sA==

If the sample policy 01-appraise-executable-and-lib-signatures does not meet your requirements, you can create and use a custom policy.

Enable remote attestation with IMA measurement to verify system integrity. Use IMA measurement with tools such as Keylime by deploying the signed measurement policy from /usr/share/ima/policies/02-keylime-remote-attestation.

Prerequisites

  • A signed measurement policy is available at /usr/share/ima/policies/02-keylime-remote-attestation.

Procedure

  1. Deploy the policy: 

    # cp --preserve=xattr /usr/share/ima/policies/02-keylime-remote-attestation /etc/ima/ima-policy

  2. Load the policy: 

    # echo /etc/ima/ima-policy > /sys/kernel/security/integrity/ima/policy

If the sample policy does not meet your requirements, or if you want to ensure that only signed IMA policies are loaded for security reasons, see Deploying a custom signed IMA policy for UEFI systems.

Verification

  • Verify that the policy is loaded: 

    # cat /sys/kernel/security/integrity/ima/policy
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top