File Integrity Monitoring on Linux

eBPF FIM for Linux

eBPF FIM watches file access inside the kernel as it happens, instead of scanning the disk later. The Tetragon project is one example. Its documentation lists file integrity monitoring as a capability and shows policies that hook the Linux security module file hooks, such as file_open. Tetragon documentation.

Tetragon describes its LSM BPF programs as runtime instrumentation of the security hooks by privileged users. That model fits a container host where you want an event at the moment a process opens a sensitive file. A policy example from the project watches /etc/passwd and /etc/shadow.

Check what an eBPF tool records before you choose it. The sources above describe file access events. Ask whether the tool also stores file hashes and compares them with an approved state. If it does not, it cannot tell you that a file differs from last week. Many teams pair an eBPF tool for live events with AIDE or Vigilance for the state of the files.

Runtime integrity with IMA and Keylime

IMA and Keylime prove to a remote verifier that a machine runs only files you approved. IMA is the Integrity Measurement Architecture, a part of the Linux kernel. It has three features: measurement, appraisal and audit. IMA documentation.

Measurement keeps a log of file hashes. If the machine has a TPM chip, IMA also keeps an aggregate value of that log in a platform configuration register. Appraisal checks a file signature or hash and denies access if the check fails. Audit adds the file hash to the audit log. The kernel policy format is in the kernel ima_policy document. You can read the live measurement log as root.

sudo head -n 5 /sys/kernel/security/ima/ascii_runtime_measurements

Keylime is the verifier side. Its documentation calls it a TPM-based, highly scalable remote boot attestation and runtime integrity measurement solution. It began in the MIT Lincoln Laboratory security research team. Keylime documentation. Keylime polls TPM quotes to PCR 10 on the agent and compares the measurements with a runtime policy. A basic runtime policy is a set of golden cryptographic hashes of files in their untampered state. If the hashes do not match, Keylime places the agent in a failed state. Keylime runtime guide. This command adds an agent with a policy.

keylime_tenant -c add --uuid <agent-uuid> --runtime-policy /path/to/policy.json

This route gives the strongest proof, and it takes the most work. You need TPM hardware, a kernel policy, a verifier service and a list of approved hashes. Each software update changes the list, so you must update the policy with every update. It suits a controlled fleet more than a laptop.

Vigilance on Linux

Vigilance checks the state of the files and reports the capability a changed file gained, with no agent and no rule file. It is one binary for Linux, macOS, Windows and the BSDs. Install it, point it at a folder and let it watch.

brew install vigihq/vigi/vigi
vigi ./the-folder
vigi setup

The first run records what is there. Each later run reports what changed. vigi setup installs a scheduled check, and the machine owns that job. To check an update before you install it, hand Vigilance both versions.

vigi diff --old ./xz-5.4.6 --new ./xz-5.6.1

That example uses the xz Utils backdoor. In release 5.6.1, a hidden backdoor shipped inside liblzma that can intercept a remote login. Read the record on the xz Utils backdoor page. A fingerprint check shows that the library changed, and a normal update changes it too. Vigilance shows what the change can do.

Vigilance reads inside deb, rpm, npm, pip and container packages, so you can check a package file before it lands on the server. See the AIDE comparison, the Wazuh comparison and the attack library.

The best monitoring tool for Linux

No single tool is best, because the tools answer different questions. Pick the tool that answers the question you have.

Many teams run two of these. For example, they run AIDE or an audit rule for the live server and Vigilance for each update. For the wider category, read the file integrity monitoring overview. For audit rules that assessors read, see FIM for PCI DSS 4.0.1.