Integrity Measurement Architecture, digital hashes, and signatures for enhancing security
SELinux, as aforementioned, can increase your system security by confining processes to what is intended for them to do, but in order to improve the protection, you can make use of another feature of the kernel, the integrity subsystem, provided by two components (http://linux-ima.sourceforge.net/):
- Integrity Measurement Architecture (IMA), which maintains a runtime list of measures
- Extended Verification Module (EVM), which detects alterations to measurements
The first component, IMA, checks the file contents when opened or executed, stores the obtained values, and allows the validation while permitting tunning via custom policies.
The second component, EVM, hashes the values from IMA, and SELinux attributes via cryptographic functions.
Of course, if the system has support for the Trusted Platform Module (TPM), it can be used to increase the level of hardening of the...
