...It utilizes the IMA logic (introduced to the Linux kernel in 2.6.30) to perform a SHA-1 measurement of all executables prior to their being placed in execution, either as a program or as a memory mapped file mapped for execution.
Utilizing the QUOTE feature of the TPM, it is possible to generate an Integrity measurement Report that accurately reflects the current programs that have run or are running, and these values can be compared against a set of golden values taken from the install image of the machine. If the hash values are different, then the program has been changed, and the computer should not be trusted.
...