IMA Update - Lessons Learned from Re-implementing IMA-measurement in User Space

Learn about improvements to the Linux Integrity Measurement Architecture (IMA) through lessons gained from re-implementing IMA-measurement in user space in this 28-minute conference talk by Roberto Sassu from Huawei Technologies. Explore the evolution of IMA from its original IBM Research design for extending trusted boot chain measurements to running systems, including the addition of IMA-appraisal for secure boot extension and audit message support. Discover proposed kernel improvements including a new design for serializing and storing measurement lists in shared memory areas between primary and secondary kernels to eliminate kexec requirements. Examine a new testing tool for verifying IMA violation reporting when files are opened for read then write operations or vice versa, along with alternative violation detection methods. Understand a novel debugging technique that enables running extensive integration tests without kernel reboots, making IMA development and testing more efficient across diverse environments from embedded/IoT to large-scale systems.