The Linux Integrity Measurement Architecture can collect hashes for executed and accessed files and can support appraisal against trusted signatures or stored hashes. That control is useful for detecting or blocking a modified system binary. It is not a complete statement that the machine is trustworthy.
IMA measurement records runtime evidence. Appraisal makes a policy decision using security metadata, trust anchors, and a configured policy. The kernel documentation describes IMA templates, file signatures, and EVM interactions. A signature may be based on a file digest or an EVM portable signature, and the kernel needs a trusted key and keyring path before it can make the expected decision.
Separate measurement from enforcement
Measurements can support remote attestation, local audit, or comparison with a known-good baseline. Appraisal is stronger in one direction because a policy can deny access to a file that does not match the expected signature or hash. The two functions should not be conflated in incident evidence. A file with a measurement record may have been allowed by policy, rejected later, or accessed by a process with a different path.
Define the policy before deploying enforcement. Identify which files require appraisal, which keyring must be trusted, how file capabilities and execution contexts are handled, and what happens when a signature is missing. Test with a signed system binary, an unsigned test file, a modified binary, and a key rotation case. A failed appraisal should produce a clear audit event rather than an unexplained service outage.
Protect the trust path
IMA appraisal assumes the kernel, initramfs, policy, keyring, and file metadata are protected from modification at the relevant stage. Secure boot, a measured boot path, a TPM-backed attestation service, signed initramfs content, and a protected kernel command line may all be part of that path. The exact design depends on hardware and distribution support, but the trust assumptions must be documented.
EVM can help protect security extended attributes, but it also has its own key and setup requirements. Do not add EVM to a host merely to solve one alert. Understand how file systems, package updates, backup restore, and fleet imaging will preserve and validate the metadata.
Operate for recovery
An appraisal failure during a package upgrade can block an essential service. Stage the policy on pilot hosts, keep a signed recovery image, record the exact kernel and userspace versions, and test the rollback. Limit who can load appraisal keys or change the policy. Monitor audit records for denied appraisals, unexpected keyring changes, and repeated failures during a maintenance window.
IMA is most valuable when its scope is explicit: which files, which trust anchors, which policy, and which boot assumptions. It becomes misleading when teams treat one measurement record as proof that every executed instruction was trustworthy.