ima_file_check(9)

💖 NAME 💖

ima_file_check — based on policy, collect/store measurement. ✨

okay hi bestie 🫶 this is the ima_file_check(9) page from the Kernel API Manual, and it's lowkey iconic for one very specific job: measuring files based on policy. let's get into it.

🌸 SYNOPSIS 🌸

int ima_file_check (struct file *file , int mask );

🎀 ARGUMENTS 🎀

• file — pointer to the file to be measured. yes bestie, the actual file.
• mask — contains MAY_READ, MAY_WRITE, MAY_EXEC or MAY_APPEND. those are the flags in the mix.

✨ DESCRIPTION ✨

Measure files based on the ima_must_measure policy decision. that's the whole vibe: the policy decision is doing its thing, and this is the file-checking moment.

On success return 0. On integrity appraisal error, assuming the file is in policy and IMA-appraisal is in enforcing mode, return -EACCES.

bestie the caveat is important: that -EACCES return is tied to integrity appraisal error plus the file being in policy plus IMA-appraisal being in enforcing mode. periodt.

👀 SEE ALSO 👀

Kernel file: ./security/integrity/ima/ima_main.c

• ima_file_free(9)
• ima_file_mmap(9)
• ima_file_mprotect(9)
• ima_bprm_check(9)
• ima_creds_check(9)
• ima_bprm_creds_for_exec(9)
• ima_file_hash(9)
• ima_inode_hash(9)
• ima_post_create_tmpfile(9)
• ima_post_path_mknod(9)
• ima_read_file(9)
• ima_post_read_file(9)
• ima_load_data(9)
• ima_post_load_data(9)
• process_buffer_measurement(9)
• ima_kexec_cmdline(9)
• ima_measure_critical_data(9)
• ima_measure_raw_policy(9)
• ima_kernel_module_request(9)

okay that's the page, bestie 🫶 source/version: ./security/integrity/ima; date: October 2026; title: ima_file_check(9). mwah 💅