See documentation at Linux IMA/EVM Wiki
Linux Integrity Subsystem

The goals of the kernel integrity subsystem are to detect if files have been accidentally or maliciously altered, both remotely and locally, appraise a file's measurement against a "good" value stored as an extended attribute, and enforce local file integrity. These goals are complementary to Mandatory Access Control(MAC) protections provided by LSM modules, such as SElinux and Smack, which, depending on policy, can attempt to protect file integrity. The following modules provide serveral integrity functions:

• Collect - measure a file before it is accessed.
• Store - add the measurement to a kernel resident list and, if a hardware Trusted Platform Module (TPM) is present, extend the IMA PCR
• Attest -if present, use the TPM to sign the IMA PCR value, to allow a remote validation of the measurement list.
• Appraise - enforce local validation of a measurement against a 'good' value stored in an extended attribute of the file.
• Protect - protect a file's security extended attributes

The first three functions were introduced with Integrity Measurement Architecture (IMA) in 2.6.30. The EVM/IMA-appraisal patches add support for the last two features.

For additional information about the Linux integrity subsystem, refer to the Wiki.

Trusted Computing: architecture and opensource components

IMA measurement, one component of the kernel's integrity subsystem, is part of an overall Integrity Architecture based on the Trusted Computing Group's open standards, including Trusted Platform Module (TPM), Trusted Boot, Trusted Software Stack (TSS), Trusted Network Connect (TNC), and Platform Trust Services (PTS). The diagram shows how these standards relate, and provides links to the respective specifications and open source implementations. IMA and EVM can still run on platforms without a hardware TPM, although without the hardware guarantee of compromise detection.