ima_post_read_file(9)

📦 version 7.3.1, in nixpkgs unstable

💖 ima_post_read_file(9) 💖

okay so bestie, welcome to the Kernel API Manual — this one's ima_post_read_file(9) and it's literally the "in memory collect/appraise/audit measurement" girlie. she's giving integrity, she's giving policy, she's giving 🎀 in-memory file vibes 🎀. let's get into it.

✨ SYNOPSIS ✨

int ima_post_read_file (struct file *file , char *buf , loff_t size ,
       enum kernel_read_file_id read_id );

look at her signature, so clean, so main character 💅

🫶 ARGUMENTS 🫶

  • file — pointer to the file to be measured/appraised/audit. yes, all three. she multi-tasks 💖
  • buf — pointer to in memory file contents. like, the actual bytes, in RAM, iconic
  • size — size of in memory file contents. how many bytes we're dealing with, no cap
  • read_id — caller identifier. who's calling, iykyk 🌸

💜 DESCRIPTION 💜

Measure/appraise/audit in memory file based on policy. periodt. the policy rules are written in terms of a policy identifier — so it's the policy's world and we're just living in it 👑

On success return 0. slay ✨

On integrity appraisal error, assuming the file is in policy and IMA-appraisal is in enforcing mode, return -EACCES. so like... if the vibes are off and enforcement is on, you get the big no-no 🚫😭 not a warning, an actual error code. respect it.

🦋 SEE ALSO 🦋

Kernel file ./security/integrity/ima/ima_main.c — go read the source bestie, it's all there 🌈

that's the whole friend group fr fr 🫶 literally the entire IMA crew, go say hi to all of them 💖

ngl bestie, that SEE ALSO list is long but every single one of them is a real one. no skips, no skimming. the kernel doesn't do shortcuts and neither do we 💅

okay that's the page!! 🎀 sourced straight from ./security/integrity/ima, dated October 2026, and yes she's still ima_post_read_file(9) in the header, always and forever 🌸💖✨ muah, go measure something 🧚‍♀️

📦 where this page comes from