feat: add ProbeIMAFileCheckMeasurementActive

[leodido]

Added

ProbeIMAFileCheckMeasurementActive() ProbeResult — checks whether an IMA measurement rule covering file open (e.g., func=FILE_CHECK) is active by creating a fresh temporary file, then opening it O_RDONLY and checking for a measurement count increase.

Semantic contract

• Returns Supported=true only when the controlled file-open stimulus increments the IMA measurement count
• No count > 1 shortcut (unlike ProbeIMAAnyMeasurementActive)
• Uses a fresh inode to avoid false negatives from IMA's per-inode measurement cache
• Rewrites the file with unique random content before the baseline count — invalidates the per-inode cache from the initial create and ensures the digest has not been seen before in IMA's global hash table
• Uses a non-tmpfs temp directory — prefers /var/tmp, then os.TempDir() if non-tmpfs; returns Error if no writable non-tmpfs candidate exists
• Failed count read or failed file operations → Supported=false with Error set
• Direct Linux-only helper, not wired into Feature/Check/SystemFeatures yet

Why FILE_CHECK needs different windowing than BPRM_CHECK

For the exec probe (#59), the temp binary is materialized before the baseline count and the exec is the only operation in the window. FILE_CHECK is trickier: the open() that creates the temp file may itself trigger a FILE_CHECK measurement. The probe handles this by:

1. Creating the file (may trigger FILE_CHECK — doesn't matter, happens before baseline)
2. Rewriting the file with unique random content to invalidate IMA's per-inode cache and avoid global hash-table deduplication
3. Taking the baseline count
4. Opening O_RDONLY — this is the stimulus
5. Taking the count again

The O_RDONLY stimulus is consistent with IMA's documented FILE_CHECK behavior, where FILE_CHECK triggers on file open and can be qualified with mask=MAY_READ.

Correctness fixes (also applied to exec probe)

Two fixes applied to both ProbeIMAExecMeasurementActive and ProbeIMAFileCheckMeasurementActive:

1. Unique content per invocation: IMA maintains a global hash table and may suppress measurements for content it has already seen. The exec probe now appends random bytes to the copied ELF (past the segment table, does not affect execution). The file-check probe rewrites with unique random content before the baseline.

2. Non-tmpfs temp directory: Common IMA policies (e.g., the default tcb policy) exclude tmpfs before FILE_CHECK/BPRM_CHECK rules. Both probes now prefer /var/tmp, then os.TempDir() if non-tmpfs; they return Error if no writable non-tmpfs candidate exists rather than silently falling back to tmpfs.

Series

This is PR 3 of 3 after #57:

1. feat: add ReadIMARuntimeMeasurementsCount exported helper #58 — ReadIMARuntimeMeasurementsCount ✅
2. feat: add ProbeIMAExecMeasurementActive #59 — ProbeIMAExecMeasurementActive ✅
3. This PR — ProbeIMAFileCheckMeasurementActive