Lesson 3.53: The IMA measurement log
Linux's Integrity Measurement Architecture (IMA) hashes every program and library before the kernel runs it and appends the hash to a log that only grows. The log is anchored in the TPM, so it can't be rewritten without the change showing. An attacker who swaps a script, runs it and puts the original back leaves the file clean, but not the log. In the lab the backup job on Northwind's payroll server looks untouched. You read the IMA policy and its blind spots, find two different hashes for the same script, find a program that no longer exists on disk, and check the log against the TPM.
18 min
You will learn to
- Explain what IMA measures and where the log lives
- Read an IMA policy and spot what it doesn't measure
- Compare measured hashes with files on disk
- Find executed files outside an allowlist
- Explain how PCR 10 protects the log
Key terms
- IMA
- Integrity Measurement Architecture: the kernel hashes files before use and logs the hashes.
- Measurement log
- /sys/kernel/security/ima/ascii_runtime_measurements: one line per measured file, append-only.
- IMA policy
- Rules for what is measured; ima_policy=tcb measures executed programs, executable mappings and files root reads.
- PCR 10
- The TPM register IMA extends with every measurement.
- Extend
- The only way to change a PCR: new value = hash(old value + measurement).
- Appraisal
- IMA's enforcing mode: run a file only if its hash or signature matches a stored good value.
← Recovering a damaged LUKS header · All lessons · How ransomware works →