ima_collect_modsig(9)

💖 ima_collect_modsig(9) — Kernel API Manual 💖

Okay bestie, this is ima_collect_modsig(9) from the Kernel API Manual, and it's lowkey iconic because it's all about hashing a file without the signature tacked onto the end. No cap, let's get into it ✨

🌸 NAME 🌸

ima_collect_modsig — Calculate the file hash without the appended signature. 🎀

✨ SYNOPSIS ✨

void ima_collect_modsig (struct modsig *modsig , const void *buf ,
loff_t size );

🫶 ARGUMENTS 🫶

• modsig — parsed module signature 💅
• buf — data to verify the signature on
• size — data size

🦋 DESCRIPTION 🦋

Okay so here's the situation: since the modsig is literally part of the file contents, the hash used in its signature isn't the same one ordinarily calculated by IMA. 😭 Therefore the PKCS7 code calculates a separate one for signature verification. Slay, that's the whole reason this function exists. ✨

💜 SEE ALSO 💜

• Kernel file ./security/integrity/ima/ima_modsig.c — go peek, bestie 👀

Shoutout to source/version ./security/integrity/ima and date October 2026 — this was ima_collect_modsig(9), signing off 🫶💖