ima_match_policy(9)

💖 ima_match_policy — decision based on LSM and other conditions 💖

okay so bestie, welcome to the ima_match_policy(9) page from the Kernel API Manual. This is the function that makes a decision based on LSM and other conditions, and we are going to cover every single detail together. no cap, every detail stays ✨

---

🌸 NAME 🌸

ima_match_policy — decision based on LSM and other conditions.

---

✨ SYNOPSIS ✨

       int ima_match_policy (struct mnt_idmap *idmap , struct inode *inode ,
       const struct cred *cred , struct lsm_prop *prop , enum ima_hooks func ,
       int mask , int flags , int *pcr , struct ima_template_desc
       **template_desc , const char *func_data , unsigned int *allowed_algos );

---

🎀 ARGUMENTS 🎀

• idmap — idmap of the mount the inode was found from.
• inode — pointer to an inode for which the policy decision is being made.
• cred — pointer to a credentials structure for which the policy decision is being made.
• prop — LSM properties of the task to be validated.
• func — IMA hook identifier.
• mask — requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC).
• flags — IMA actions to consider (e.g. IMA_MEASURE | IMA_APPRAISE).
• pcr — set the pcr to extend.
• template_desc — the template that should be used for this rule.
• func_data — func specific data, may be NULL.
• allowed_algos — allowlist of hash algorithms for the IMA xattr.

---

🦋 DESCRIPTION 🦋

This is the measure decision, based on func/mask/fsmagic and LSM(subj/obj/type) conditions. it’s giving policy-decision main character energy 💅

Since the IMA policy may be updated multiple times, we need to lock the list when walking it. Reads are many orders of magnitude more numerous than writes, so ima_match_policy is a classical RCU candidate. highkey a very important little lock-and-read situation 🔥

---

🔥 SEE ALSO 🔥

• Kernel file ./security/integrity/ima/ima_policy.c
• ima_match_rule_data(9)
• ima_match_rules(9)
• ima_update_policy_flags(9)
• ima_init_policy(9)
• ima_update_policy(9)
• ima_parse_add_rule(9)
• ima_delete_rules(9)
• ima_measure_loaded_policy(9)

---

Cute sign-off time, bestie: this page’s source/version is ./security/integrity/ima, its date is October 2026, and its manual-name moment is ima_match_policy(9) 🫶✨💖