fix: detect IMA across legacy and modern kernel integration

[leodido]

An initialized Linux 6.8 IMA instance can expose securityfs/integrity/ima (and its ima compatibility symlink), with runtime_measurements_count=42, while its LSM list contains integrity,bpf but no ima. Previously both IMAEnabled and IMAAnyMeasurementActive were false: availability depended solely on the LSM list, and the measurement probe was skipped. Both now succeed for that fixture.

Runtime evidence and error behavior

• Accept either an ima LSM entry or a visible IMA-specific securityfs directory at /sys/kernel/security/ima or /sys/kernel/security/integrity/ima. Follow symlinks and verify both directory type and SECURITYFS_MAGIC with statfs on the resolved directory. Ordinary directories and mount placeholders are rejected. No version branching, configuration-only positive, or integrity-only positive.
• Independent positive evidence wins over a missing/unreadable LSM list or failure on the other directory path. ActiveLSMs and BPF LSM detection retain their existing behavior.
• Missing directory paths remain clean IMADirectory negatives; permission/type and filesystem-lookup failures remain errors unless another IMA directory is verified on securityfs. Without any positive evidence, availability carries an unavailable-evidence error with underlying failures, rather than diagnosing IMA as disabled because securityfs is hidden.
• Run the existing measurement algorithm after either positive signal, using the visible directory's count interface. Skipped probes carry errors; count read/parse errors remain visible. Count > 1 and the existing /bin/true stimulus semantics are unchanged.
• Diagnostics distinguish configuration showing IMA is not built, unavailable runtime evidence, count errors, and available IMA with no observed measurement activity. Document boot, built-in/architecture, and securityfs policy sources without prescribing a policy change.

The old unconditional lsm=...,ima advice was incorrect: Linux 6.8 initializes IMA via init_ima() without a separate IMA LSM; Linux 6.9 registers IMA as LSM_ORDER_LAST, which is automatically included. Linux 6.8 already implements bpf_ima_file_hash, and its underlying file-hash implementation can calculate a hash without a cached measurement. Availability does not guarantee measurement policy, appraisal enforcement, a file's cached hash, or BPF helper-call success.

Validation

The securityfs correction in 6d22f66 reproduced the ordinary-directory false positive before the fix using real Linux statfs (no mounts), then passed Linux race tests, coverage, vet, dependency verification, and the full Linux/macOS Bats suites.

• Reproduced the original failure using deterministic Linux fixtures before changing detection, including legacy count 42 and missing/unreadable LSM evidence; verified they pass after the fix.
• Linux ARM64 Go 1.24 container: go test -race -count=1 ./..., make cover-check, make vet, and make verify-deps passed. All six gated files remain above 90%; thresholds and exclusions are unchanged.
• Full bats test/ passed on Linux with Bats 1.13.0, run unprivileged (root-only mount tests and platform-inapplicable cases skipped). Debian's older Bats initially failed its non-Linux suite skip; using the CI version resolved that harness failure.
• macOS: go test ./... and full Bats 1.13.0 suite passed, with Linux-only cases skipped.
• PR CI on commit 6d22f66: Linux Test (Go 1.24), Linux Integration, macOS CLI, Lint, CodeQL/security analysis, and labeler all passed.
• Fixtures cover modern/legacy evidence, compatibility symlink and underlying directory, integrity-only negatives, missing/unreadable sources, permission precedence, directory type, no activity, count read/parse failures, BPF LSM preservation, and Diagnose. Additional regressions reject real ordinary directories and symlinks to them, and cover tmpfs identity, statfs EACCES/EIO/ENOENT failures, fallback, and independent LSM positives. New Linux Bats checks cover CLI availability consistency and diagnostic categories.
• README, CONTRIBUTING, AGENTS, public comments, and Unreleased changelog updated. No public API added and no CLI implementation changes.

Limits and scope

This is a fixture-based Linux reproduction, not a live IMA-enabled legacy-kernel reproduction. Runtime visibility cannot establish appraisal or per-file/helper usability. Standalone exec/file-check algorithms and their existing compatibility-path reads are unchanged. Root mount integration and lint passed in PR CI on 6d22f66. No host policy, boot settings, or security mounts were changed; no generated kernel-version files or validator gaps were touched. The separate RHASH/BCC refresh failure is outside this change.

Primary sources verified: Linux 6.8 initialization and file hashing, IMA securityfs paths, integrity infrastructure, Linux 6.9 IMA registration, LSM ordering, policy initialization, and BPF IMA helpers.