IMA的简单理解

IMA的全称是The Integrity Measurement Architecture。他的作用是检测一个文件是否被修改，包括本地和远程修改.其原理是比较文件的hash值是否相等，这个hash值是被保存到文件系统的 extended attribute中.与之相似的的机制是selinux作为IMA的一种补充.
IMA 子系统引入了一些hooks来创建和手机被打开准备读写的文件的hash.IMA机制在2.6.30的时候就被引入到linux kernel中.
IMA的作用是手机文件的hast并将其放到用户态app无法修改的kernel memory中，并且孕育本地或者远程来检测这个值.EVM的全称是 Extended Verification Module，其作用是检测试图修改security extended attributes。
可以再kernel命令行加"ima=on ima_policy=<policy>"来使能IMA和玄策ima的policy，其中policy可以选择下面三种值
tcb - measures all executables run, all mmap'd files for execution (such as shared libraries), all kernel modules loaded, and all firmware loaded. Additionally, all files read by root are measured as well.

appraise_tcb - appraises all files owned by root.

secure_boot - appraises all loaded modules, firmware, kexec'd kernel, and IMA policies. It also requires them to have an IMA signature as well. This is normally used with the CONFIG_INTEGRITY_TRUSTED_KEYRING option in the kernel in "secure boot" scenario, with the public key obtained from the OEM in firmware or via the MOK (Machine Owner Key) in shim.

IMA除了在文件系统的 extended attribute保存hash值外，还在内存中维护了一个runtime measurement list。其路径是/sys/kernel/security/ima/ascii_runtime_measurements

举例如下：
[root@kvm-05-guest13 ~]# head -5 /sys/kernel/security/ima/ascii_runtime_measurements
10 1d8d532d463c9f8c205d0df7787669a85f93e260 ima-ng sha1:ddee6004dc3bd4ee300406cd93181c5a2187b59b boot_aggregate
10 bfe074db49e639b3d65aff5d29714c0ada7584ae ima-ng sha1:b23cdfea2ad736ea9f2591270fe644d8052cc86f /usr/lib/systemd/systemd
10 63c80ba8646fb4d8a48e0b6baf38650fef1b3ffb ima-ng sha1:8c8d12052c4684e696da0bee28d7a2f3c4f408e4 /usr/lib64/ld-2.28.so
10 2a07e7f032ba91832d267e6c58437cec1dccf35d ima-ng sha1:381429f65d66187f866361e8dc19e96808f9424f /usr/lib/systemd/libsystemd-shared-239.so
10 a4c7964b6581dcf3aa5495dc94a17bb7ee82554c ima-ng sha1:1abcf3c99faad55856d49e3ds210abec56d95e4a51 /etc/ld.so.cache

前面介绍了如果产生hash，如果要让系统自动比较hash值是否正确，则第一次启动时需要在命令行添加 ima_appraise_tcb and ima_appraise='fix'
例如下面这个就已经包含的ima
[root@kvm-05-guest13 ~]# getfattr -m - -d /sbin/init
getfattr: Removing leading '/' from absolute path names
# file: sbin/init
security.ima=0sAbI83+oq1zbqnyWRJw/mRNgFLMhv
security.selinux="system_u:object_r:init_exec_t:s0"
第二次启动时在kernel的命令加上ima_appraise_tcp and ima_appraise=enforce

这个时候如果hash值不对，会有log打印出来