Lion Cipher Lab

Enforce Linux runtime file integrity with IMA + EVM (get -EPERM when a signed file is tampered)

• Cyber / Security Engineer
• Advanced
• ~90 min
• Free · no account required

Why it matters

Most integrity tools tell you about a change AFTER it happened: AIDE runs from cron, hashes your files, and emails you that /usr/bin/sshd is different than it was last night — useful, but the attacker already ran their code. IMA + EVM is the Linux kernel's answer to the harder question: don't just detect the tampered file, REFUSE TO USE IT. IMA can measure every file into an append-only list (the basis for remote attestation), and — the part this lab drives home — it can APPRAISE a file against a cryptographic signature before any process is allowed to read or execute it, returning -EPERM the…

What you'll learn

• what IMA's three jobs actually are — MEASURE (hash into the append-only measurement list), APPRAISE (verify a signature/hash before access), and AUDIT — and how they differ
• reading the runtime measurement list at /sys/kernel/security/ima/ascii_runtime_measurements and knowing what each line means
• what EVM adds: protecting the security.ima signature xattr AND the inode metadata (owner/mode) so a valid signature can't be transplanted onto another file
• generating an IMA x509 signing key + self-signed cert and importing the public cert into the kernel's .ima keyring with keyctl/evmctl
• writing an IMA appraisal policy SCOPED by fsuuid so enforcement touches only a throwaway mount and can never lock the host out
• signing files with `evmctl ima_sign` to write the security.ima xattr, and inspecting it with getfattr
• the fix-then-enforce ordering: why every appraised file must be LABELED before the kernel is switched to enforce, or nothing runs
• proving the guarantee: reading a signed file succeeds, tampering one byte makes the very next read fail with -EPERM, and the denial appears in the audit log
• recovering a boot LOCKOUT caused by enforce-before-label via `ima_appraise=off`/`ima_appraise=fix` on the kernel command line in the GRUB/rescue menu
• the judgment call: when to reach for IMA/EVM vs AIDE (userspace scan) vs dm-verity (read-only block device) vs fapolicyd (execution allowlist), and the production do-it-better (keys sealed to measured boot, EVM in HMAC+signature mode, distro-signed policy)

Steps in this lab

1. The mental model: measure, appraise, audit — and where EVM fits
2. Stand up the disposable VM, install the tools, and confirm IMA is present
3. Generate an IMA signing key and import the public cert into the .ima keyring
4. Build a THROWAWAY filesystem to appraise — and scope the whole exercise to it
5. LABEL first: sign the files (write security.ima) before any enforcement
6. Turn on enforce (safely) and load the scoped appraisal policy
7. The money shot: signed reads work, one tampered byte returns -EPERM
8. The named failure modes — including the boot LOCKOUT and how to recover
9. The judgment: IMA/EVM vs AIDE vs dm-verity vs fapolicyd, and how a pro ships it

Open the full interactive lab →