# Unexpected temporary files added to IMA measurement log **URL:** \ **Category:** Rocky Linux Help & Support\ **Tags:** rocky-linux-9, rocky-linux-10\ **Created:** [December 12, 2025, 8:33pm UTC](https://forums.rockylinux.org/t/unexpected-temporary-files-added-to-ima-measurement-log/20049 "2025-12-12T20:33:42Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![grydz](https://avatars.discourse-cdn.com/v4/letter/g/d9b06d/32.png) [@grydz](https://forums.rockylinux.org/u/grydz)\ **Post date:** [December 12, 2025, 8:33pm UTC](https://forums.rockylinux.org/t/unexpected-temporary-files-added-to-ima-measurement-log/20049/1 "2025-12-12T20:33:42Z")
Recent updates in Rocky Linux 9 and 10 changed [IMA](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/managing_monitoring_and_updating_the_kernel/enhancing-security-with-the-kernel-integrity-subsystem) behaviour and unexpectedly added temporary files related to `/etc/group` and `/etc/shadow` to IMA measurement log: ```bash $ cat /sys/kernel/security/ima/ascii_runtime_measurements | grep group 10 ca81f9acb96d029daeb9492d519b8b462d3e2a73 ima-ng sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 /etc/.#group89403d28bb57f300 10 ca81f9acb96d029daeb9492d519b8b462d3e2a73 ima-ng sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 etc/.#groupc970f5c062c3ccba ``` Unfortunately these temporary files are problematic for one of IMA’s use case which is to check that some files on the filesystem audited with a reference hash digest were not modified (exception to some SELinux types such as `tmp_t` as in `/usr/share/ima/policies/02-keylime-remote-attestation`, see [doc](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/managing_monitoring_and_updating_the_kernel/enhancing-security-with-the-kernel-integrity-subsystem#enabling-remote-attestation-with-ima-measurement)). Note that there were no temporary files with patterns like `/etc/group.1597` or `/etc/.#group89403d28bb57f300` added to IMA measurmeent log back in June 2025 with an up-to-date Rocky Linux 9 or RHEL 9. I think either these temporary files are not tagged with`tpm_t`type or the binary doing read/write on `/etc/group` and `/etc/shadow` should not write next to the original file and use one of `$TEMP`, `$TMP` or `$TMPDIR` as parent directory. Is anyone using IMA can confirm the issue? Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [February 10, 2026, 8:34pm UTC](https://forums.rockylinux.org/t/unexpected-temporary-files-added-to-ima-measurement-log/20049/2 "2026-02-10T20:34:37Z")
Closed on February 10, 2026, 8:34pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.