ima_bprm_creds_for_exec(9)

💅 NAME 💅

ima_bprm_creds_for_exec — bestie, this is the one that collects, stores, and appraises the measurement ✨

---

🎀 SYNOPSIS 🎀

int ima_bprm_creds_for_exec (struct linux_binprm *bprm );

---

🦋 ARGUMENTS 🦋

• bprm — this cutie right here contains the linux_binprm structure, no cap 👑

---

🌸 DESCRIPTION 🌸

okay so here's the vibe: this function looks at the IMA policy and the execveat(2) AT_EXECVE_CHECK flag, and then it measures and appraises the integrity of a file that's about to be executed by script interpreters 🧚✨

and here's the part that's actually iconic — unlike literally every other LSM hook where the kernel is the one enforcing file integrity, this time around enforcing file integrity is left up to the discretion of the script interpreter (that's userspace, babe). so the kernel isn't the bouncer here, the interpreter is 💅

on success, it returns 0 🎉 but if there's an integrity appraisal error — assuming the file is in policy and IMA-appraisal is in enforcing mode — it returns -EACCES. so like, not a slay 😭

ngl this one's giving "trust the userspace to do the right thing" energy, which is a choice, but okay 🫶

---

🌈 SEE ALSO 🌈

kernel file ./security/integrity/ima/ima_main.c (the mothership 👑) plus all these besties:

• ima_file_free(9)
• ima_file_mmap(9)
• ima_file_mprotect(9)
• ima_bprm_check(9)
• ima_creds_check(9)
• ima_file_check(9)
• ima_file_hash(9)
• ima_inode_hash(9)
• ima_post_create_tmpfile(9)
• ima_post_path_mknod(9)
• ima_read_file(9)
• ima_post_read_file(9)
• ima_load_data(9)
• ima_post_load_data(9)
• process_buffer_measurement(9)
• ima_kexec_cmdline(9)
• ima_measure_critical_data(9)
• ima_measure_raw_policy(9)
• ima_kernel_module_request(9)

---

and that's the whole page, periodt 💖 this gem lives at ./security/integrity/ima, it's dated October 2026, and it's officially known as ima_bprm_creds_for_exec(9) — go off, kernel API manual, you ate 🍓✨