[Linux-ima-user] Attesting integrity of openoffice using IMA

[adrian g. <adr...@gm...>]

hi, i wonder if it is possible, taking openoffice2.0 as an example, that we
can use ima to detect an attack (on openoffice)?  If so, do i have to
measure additional files? Since most of the measurements are dynamically
linked libraries, there will be no changes in measurements if i make trivial
changes to options/configurations in the application.  I am wondering in
what general cases, for an application like openoffice (or any other large
application), when we can expect a legitimate change in the measurements.
One obvious case i can think of is updating to a newer version of the
application.

thanks - adrian