ima_creds_check(9)

💅 ima_creds_check(9) — like, the kernel API manual bestie 🎀

okay so real talk, this is a page from the Kernel API Manual, and it's about ima_creds_check. she's a little function with a big job and honestly she ate 💅✨

---

✨ NAME ✨

ima_creds_check — based on policy, collect/store measurement. that's the whole vibe, no cap 🫶

---

🌸 SYNOPSIS 🌸

int ima_creds_check (struct linux_binprm *bprm , const struct file *file
);

literally just those two arguments, bestie, that's the whole guest list 🎀

---

🦋 ARGUMENTS 🦋

• bprm — contains the linux_binprm structure. yes, the name is the thing, we love a self-describing icon 👑
• file — contains the file descriptor of the binary being executed. she's the one actually on stage, okay 🔥

---

💖 DESCRIPTION 💖

so here's the tea, and it's genuinely kind of iconic ☕✨

the OS protects against an executable file, already open for write, from being executed in deny_write_access — and it also protects against an executable file, already open for execute, from being modified in get_write_access. two-way lock, no sneaking 🙈

the way that this matters: we can be certain that what we verify and measure here is actually what is being executed. not a lookalike, not a remix, the real file. vibe check passed 💅

---

💀 the difference from ima_bprm_check 💀

okay this is the part everyone asks about in the group chat, so let's go 🔥

ima_creds_check is invoked only after determining the final binary to be executed without interpreter — and not when searching for intermediate binaries. that's the whole point, that's her lane 🎀

the reason? since commit 56305aa9b6fab ("exec: Compute file based creds only once"), the credentials to be applied to the process are calculated only at that stage — via the bprm_creds_from_file security hook instead of bprm_check_security. periodt 💅✨

---

⭐ return values ⭐

• On success, return 0. slay 🎉
• On integrity appraisal error — assuming the file is in policy and IMA-appraisal is in enforcing mode — return -EACCES. 😭 yeah, that's the sad one, and it means business. don't sleep on it.

---

🌈 SEE ALSO 🌈

Kernel file ./security/integrity/ima/ima_main.c, plus the whole friend group, fr fr:

• ima_file_free(9)
• ima_file_mmap(9)
• ima_file_mprotect(9)
• ima_bprm_check(9)
• ima_bprm_creds_for_exec(9)
• ima_file_check(9)
• ima_file_hash(9)
• ima_inode_hash(9)
• ima_post_create_tmpfile(9)
• ima_post_path_mknod(9)
• ima_read_file(9)
• ima_post_read_file(9)
• ima_load_data(9)
• ima_post_load_data(9)
• process_buffer_measurement(9)
• ima_kexec_cmdline(9)
• ima_measure_critical_data(9)
• ima_measure_raw_policy(9)
• ima_kernel_module_request(9)

that's nineteen functions, bestie, count 'em, every single one made the list 🫶💜

---

ngl, if you're poking around here you're probably deep in IMA and security hooks — drink some water, hydrate, and remember: what you verify and measure is what's actually executing. that's not a vibe, that's a guarantee 💅✨

---

okay that's the page!! it lives at ./security/integrity/ima, it's dated October 2026, and the manual name is ima_creds_check(9). mwah, bye bestie 🎀💖🌸🦋