Open Source Summit North America 2025

Maintaining system integrity requires making sure that only permitted files are run. By calculating and comparing file digests, conventional techniques like the Integrity Measurement Architecture (IMA) confirm the integrity of files. Unfortunately, these methods lack flexibility in policy modifications and frequently result in performance bottlenecks from repetitive disk reads. An eBPF-based method that improves file integrity verification without requiring modifications to current data formats is shown in this session. This eBPF solution functions as a stand-alone element, in contrast to earlier suggestions like IMA Digest Lists, which rely on static configurations. It enables dynamic policy modifications based on real-time observations by giving other security modules on-demand reference digest values. Through techniques like eBPF, this system may be expanded with additional parsers and comes with parsers for a variety of data formats. In order to guarantee that cryptographic keys are only used when accessed files have known digests, it can function during the early startup stages and provide deterministic reading of data sources.