IMA Update: Lessons Learned from Re-implementing IMA-measurement in User Space
summary
A user-space reimplementation called AlIMA user-space reimplementation reproduces 99% of Linux IMA behavior to enable test-driven development, fuzzing and formal checks; a verifier simulates files as monotonic counters, runs 200 concurrent threads and finds race-induced violations that led to concrete kernel fixes (merge critical sections, adjust counters). A new shared kexec measurement blob design and a UAPI-based IMA debugger reset cycle let tests run without rebooting and simplify kexec handover.
AI-written summary · about
chapters (7)
- 0:00IMA updates journey
- 3:36Kernel updates and IMA
- 10:21Al IMA user space project
- 15:13Measurement list memory fragmentation
- 17:22Verifying IMA measurement reliability
- 20:57Debugging and testing techniques
- 24:45Conclusion and future steps
related talks
35mIntegrity Measurements and the Cruel World
47mNamespacing the Linux Integrity Measurement Architecture
35mIMA Policy Support for fs-verity: A Win-win for IMA & fs-verity
19mSubsystem Update: Linux Integrity Status Update
42mSnapshotting IMA Log
21m(Ab)using Linux as a Trusted Bootloader
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...
35mUsing Linux as a Secure Boot Loader for OpenPOWER Servers