CME-505

IMA/EVM (Integrity Measurement Architecture)

Harden OS/Kernel Unquantified evidence Preventive

Description

Kernel subsystem that measures file hashes at access time and optionally enforces an integrity policy. EVM extends this with extended attribute protection. Creates an audit trail of all executed code.

CVSS Vector Impacts

Metric	Transition	Rationale
Integrity (I)	H → L	Modified binaries detected/blocked at execution time

CWE Relationships

CWE-345 CWE-494 CWE-347

Verification

Check IMA policy is loaded and enforcing

$ cat /sys/kernel/security/ima/policy | head -5
# Expected: appraise

Platform: linux

Remediation

rhel IMA appraise policy with enforce mode via boot parameter


grubby --update-kernel=ALL --args='ima_policy=appraise_tcb ima_appraise=enforce'
find / -fstype ext4 -o -fstype xfs | xargs -P4 evmctl ima_hash --hashalgo sha256 2>/dev/null
systemctl reboot

linux Custom IMA measurement and appraisal policy loaded at runtime


printf 'measure func=BPRM_CHECK\nmeasure func=MMAP_CHECK mask=MAY_EXEC\nappraise func=BPRM_CHECK fowner=0\nappraise func=MMAP_CHECK mask=MAY_EXEC fowner=0\n' > /etc/ima/ima-policy
cat /etc/ima/ima-policy > /sys/kernel/security/ima/policy