lota-ima-policy

# SPDX-License-Identifier: MIT
#
# LOTA IMA appraisal policy.
#
# The agent's startup check (kernel_ima_appraise_enforcing) gates
# only on the ima_appraise= kernel boot parameter, not on the
# contents of /sys/kernel/security/ima/policy (write-only on
# kernels without CONFIG_IMA_READ_POLICY). This file is the
# developer-host baseline written by scripts/lota-dev-bringup.sh
# and supplies the rules the kernel evaluates once
# ima_appraise=enforce|fix is on the cmdline.
#
# Rule semantics:
#   - dont_appraise covers ephemeral / non-security-relevant paths
#     so the runtime IMA cost stays bounded.
#   - measure rules emit IMA log entries for every exec / mmap
#     PROT_EXEC the LSM stack sees; the LOTA verifier consumes the
#     IMA log for kernel-side audit.
#   - appraise rules instruct the kernel to verify a stored hash
#     before allowing the exec / mmap. The "appraise_type=imasig"
#     selector verifies signatures that already exist as
#     security.ima xattrs; on a dev host without signatures the
#     appraise call records the absent signature and the kernel
#     follows whichever ima_appraise= mode was set on the cmdline
#     (log on a dev host).
#
# This file is a DEVELOPER baseline, not a production appraisal
# policy. The appraise rules match every exec/mmap (IMA rules
# cannot match by path), so loading it under ima_appraise=enforce
# on a rootfs without IMA signatures blocks every execution on
# the host. LOTA ships no xattr-signing pipeline: production
# appraisal content - the signatures and the rule set - is
# distribution- or operator-supplied. See "IMA appraisal policy"
# in Documentation/operator/production-bringup/index.rst for the
# supported routes;
# LOTA's own binaries are integrity-bound through fs-verity and
# the PCR14 boot commitment independent of IMA.

dont_appraise fsmagic=0x9fa0
dont_appraise fsmagic=0x62656572
dont_appraise fsmagic=0x64626720
dont_appraise fsmagic=0x01021994
dont_appraise fsmagic=0x73636673
dont_appraise fsmagic=0xf97cff8c
dont_appraise fsmagic=0x43415d53
dont_appraise fsmagic=0x6e736673
dont_appraise fsmagic=0xde5e81e4
dont_appraise fsmagic=0x9fa2
measure func=BPRM_CHECK
measure func=MMAP_CHECK mask=MAY_EXEC
appraise func=BPRM_CHECK appraise_type=imasig
appraise func=MMAP_CHECK mask=MAY_EXEC appraise_type=imasig