ima_bprm_check(9)

📦 version 7.3.1, in nixpkgs unstable

💅 ima_bprm_check(9) — Kernel API Manual ✨

okay so bestie, welcome to the ima_bprm_check(9) page, straight out of the Kernel API Manual 🎀 this one's a lil short and sweet but it ATE, trust.

🦋 NAME 🦋

ima_bprm_check — based on policy, collect/store measurement. literally that's the whole job description, no cap 💖

🌸 SYNOPSIS 🌸

int ima_bprm_check (struct linux_binprm *bprm );

✨ ARGUMENTS ✨

  • bprm — contains the linux_binprm structure. that's it, that's the whole argument, she's low maintenance 👑

🔥 DESCRIPTION 🔥

okay so here's the lore 📖 the OS is out here doing the most to protect you, fr fr. An executable file that's already open for write gets blocked from being executed in deny_write_access, and an executable file that's already open for execute gets blocked from being modified in get_write_access. iconic teamwork, honestly 🫶

so like. because of all that, we can be certain that what we verify and measure here is actually what is being executed. no sneaky swap-outs, no bait-and-switch, the vibe check is real 💅✨

on success, return 0 🎉 on integrity appraisal error — assuming the file is in policy and IMA-appraisal is in enforcing mode — return -EACCES. and yeah that -EACCES is giving "you shall not pass" energy, so handle it 😭

👑 SEE ALSO 👑

Kernel file ./security/integrity/ima/ima_main.c and honestly the whole friend group:

bestie reminder: this page lives in ./security/integrity/ima, and it's dated October 2026 — so like, future vibes 🌈💜

and that's the whole page!! short, sweet, slayed 🍓💫 mwah, go read the source, iykyk 🧚‍♀️

📦 where this page comes from