[Linux-ima-user] extending IMA to measure files other than executables

[adrian g. <adr...@gm...>]

hi, in the IMA documentation, there was a section on equipping user space
application to measure input files.  This would mean that i apache would
have to be modified with the supplied code in the documentation file in
order to measure a certain config file it loads. However, for another
application X, i would have to do the change to it as well. so i might have
to modify code in many places.

if i want to modify IMA in a way that before it loads *any* file, it will
check :
a) if its something IMA now already measures
b) if that file is in a "to-be-measured" list (probably stored in the
harddrive - that list itself should also measured),

if either (a) or (b) is satisfied, the file will be measured.
how feasible is this?  How hard is it to implement this modification?

by allowing the user to specify a list of files that he wants to measure
before they are loaded, what kinds of implications will there be?

thank you - adrian