ima_update_policy_flags(9)

💅 ima_update_policy_flags(9) — Kernel API Manual, bestie edition

okay so picture this: you're deep in the kernel, everything's cozy, and then a policy update happens and all your global IMA variables are just sitting there like 👁️👄👁️ not knowing what's true anymore. that's literally this function's whole job. it's from the Kernel API Manual and it's giving "tiny function, huge slay" energy, ngl 🎀

---

✨ NAME ✨

ima_update_policy_flags — update global IMA variables, periodt 💖

---

🌸 SYNOPSIS 🌸

void ima_update_policy_flags (void );

that's it, that's the whole signature, no cap 🫶

---

🦋 ARGUMENTS 🦋

• void — no arguments. literally none. zero. nada. it takes nothing and it slays anyway 💅

---

⭐ DESCRIPTION ⭐

so here's the tea 🍓 — this function updates ima_policy_flag and ima_setxattr_allowed_hash_algorithms based on the currently loaded policy. both of them. at the same time. main character multitasking behavior tbh.

with ima_policy_flag, the decision to short circuit out of a function — or to just not call the function in the first place — can be made earlier. like, why do the work later when you could skip it sooner? efficiency icon ✨

with ima_setxattr_allowed_hash_algorithms, the policy can restrict the set of hash algorithms accepted when updating the security.ima xattr of a file. so it's not just a vibe check, it's a hash algorithm vibe check 🔥

---

🌈 CONTEXT 🌈

called after a policy update and at system initialization. two moments, one iconic function 👑

---

🧚 SEE ALSO 🧚

these are the besties it hangs out with, go give them a read:

• Kernel file ./security/integrity/ima/ima_policy.c
• ima_match_rule_data(9)
• ima_match_rules(9)
• ima_match_policy(9)
• ima_init_policy(9)
• ima_update_policy(9)
• ima_parse_add_rule(9)
• ima_delete_rules(9)
• ima_measure_loaded_policy(9)

---

aaaaand that's the page!! mwah 💖 this one lives under ./security/integrity/ima and the version on the tin says October 2026 — jot that down bestie, future you will thank you 🎀💜