In order to be able to perform local attestation to the integrity of files on a running RHCOS system, the IMA signatures from the RPMs should be installed as part of the image build.
    

RHCOS
    

100%
    

    1. Check a running RHCOS system for IMA signatures, for example: getfattr -m ^security -e hex --dump /usr/bin/bash
    

No security.ima attributes are present
    

Each file that originated from a RHEL RPM should have a security.ima attribute, and these can prove each file originated from Red Hat and has not been altered.