ima_match_rules(9)

💖 NAME 💖

okay so bestie, this is ima_match_rules(9) from the Kernel API Manual, and the name is literally the whole assignment: ima_match_rules — determine whether an inode matches the policy rule. no cap, that's the gig. 🎀

✨ SYNOPSIS ✨

bool ima_match_rules (struct ima_rule_entry *rule , struct mnt_idmap
*idmap , struct inode *inode , const struct cred *cred , struct lsm_prop
*prop , enum ima_hooks func , int mask , const char *func_data );

🦋 ARGUMENTS 🦋

• rule — a pointer to a rule. iconic.
• idmap — idmap of the mount the inode was found from.
• inode — a pointer to an inode.
• cred — a pointer to a credentials structure for user validation.
• prop — LSM properties of the task to be validated.
• func — LIM hook identifier. (yes, LIM, bestie — we're reading it exactly as the page says 💅)
• mask — requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC).
• func_data — func specific data, may be NULL.

🌸 DESCRIPTION 🌸

Returns true on rule match, false on failure. that's it. that's the whole vibe check. periodt. 💖

🔥 SEE ALSO 🔥

Kernel file ./security/integrity/ima/ima_policy.c — go read it, bestie, it's giving source.

• ima_match_rule_data(9)
• ima_match_policy(9)
• ima_update_policy_flags(9)
• ima_init_policy(9)
• ima_update_policy(9)
• ima_parse_add_rule(9)
• ima_delete_rules(9)
• ima_measure_loaded_policy(9)

this cutie came from ./security/integrity/ima, dated October 2026, and it's the ima_match_rules(9) page — mwah 💋✨