23.2. Enabling kernel’s runtime integrity monitoring through IMA-signature based appraisal

• Stores package file signature in security.ima for all installed packages.
• Includes the dracut integrity module to load the IMA code signing key to kernel.
• Copies the policy to /etc/ima/ima-policy so systemd loads it at boot time.

Verification

• The ip command can be successfully executed.

• If ip is copied to /tmp, by default, it loses its security.ima and therefore ip command is not executed.

  # cp /usr/sbin/ip /tmp
  # /tmp/ip
  -bash: /tmp/ip: Permission denied
  # /tmp/ip doesn't have security.ima
  # getfattr -m security.ima -d /tmp/ip
  # whereas /usr/sbin/ip has
  # getfattr -m security.ima /usr/sbin/ip
  # file: usr/sbin/ip
  security.ima=0sAwIE0zIESQBnMGUCMQCLXZ7ukyDcguLgPYwzXU16dcVrmlHxOta7vm7EUfX07Nf0xnP1MyE//AZaqeNIKBoCMFHNDOuA4uNvS+8OOAy7YEn8oathfsF2wsDSZi+NAoumC6RFqIB912zkRKxraSX8sA==