Linux IMA aims to provide verifiable evidence of file integrity, not just alerts

The article explains that detecting a malicious file after it has been opened does not confirm whether the executable or configuration file matched what the system expected. Linux's Integrity Measurement Architecture (IMA) addresses this by measuring files into a log that can be extended into a TPM PCR and by appraising files against trusted metadata before access is allowed. Measurement provides evidence for later verification but does not block a changed file, and it only covers files selected by policy. Appraisal can deny access but depends on protecting the keys and policy used to validate files, and it can disrupt availability after legitimate updates. The author recommends starting with a small set of high-value files, learning normal change patterns through measurement, and then introducing appraisal with tested recovery procedures.