24.4. Loading an IMA policy signed by your custom IMA key

Procedure

1. Add your custom IMA code signing key to the .ima keyring:

   # keyctl padd asymmetric <KEY_SUBJECT> %:.ima < <PATH_TO_YOUR_CUSTOM_IMA_KEY>

2. Prepare your IMA policy and sign it with your custom IMA code signing key:

   # evmctl ima_sign <PATH_TO_YOUR_CUSTOM_IMA_POLICY> -k <PATH_TO_YOUR_CUSTOM_IMA_KEY>

3. Load the signed IMA policy:

   # echo <PATH_TO_YOUR_CUSTOM_SIGNED_IMA_POLICY> > /sys/kernel/security/ima/policy
   # echo $?
   0

   0

   indicates that the IMA policy was loaded successfully. If the command returns a nonzero value, the IMA policy was not loaded successfully.

   警告

   Do not skip this step. If you do, your system might fail to boot and you need to recover your system.

   If the IMA policy fails to load, repeat the steps 2 and 3 to fix the issue.

4. Copy the signed IMA policy to /etc/ima/ima-policy to enable systemd load it automatically on boot:

   # cp --preserve=xattr <PATH_TO_YOUR_CUSTOM_IMA_POLICY> /etc/ima/ima-policy

5. Automatically add your custom IMA code signing key to .ima keyring on boot by using the dracut integrity module:

   # cp <PATH_TO_YOUR_CUSTOM_IMA_KEY> /etc/keys/ima/
   # cp --preserve=xattr /usr/share/ima/dracut-98-integrity.conf /etc/dracut.conf.d/98-integrity.conf
   # dracut -f

   • Additionally for s390x systems:

     # zipl