## 5 Evaluation
### Functional Evaluation
While Figure 11b illustrates that there is a tiny increase in mean memory consumption from 50 to 1050 items in flist, no evidence supports an increase in the number of file list items as a cause of this variance. One possible shortcoming is that XLabel offers a greater attack surface than XList and is potentially more vulnerable. If an attacker achieves administrator privileges, then the attacker could manipulate the xattr adopted by XLabel. The vulnerability stems from the capacity CAP_SYS_ADMIN, originally requested by root, which has permissions for modification and deletion over xattr[54]. This may extend to the xattr used by LSM on SELinux and SMACK. The attack surface does not apply to XList because the bit-setting mechanism in the inode structure prevents any privileged users (including root) from modifying the file list through the pseudo-file interface once the IMA policy has been initialised. A feasible approach to mitigate the potential XLabel vulnerability is to apply the Extended Verification Module (EVM), in which the system calculates a hash of xattr and signs it using a private key stored in the TPM device [55]. By validating the signature with the corresponding public key, attempted modifications can be detected early. However there is a time cost with the application of EVM due to the complexity of the solution. Although this research covers most of what would be expected when developing new IMA policy mechanisms, some improvement is required. First, the performance evaluations are limited to specific policy scenarios. Expanding the range of policies may improve evaluation granularity, thereby highlighting the relationship between the length of the file list and function latency. In addition, including other LSM policies in the comparison can verify the suitability of XFilter as a replacement for the LSM-based IMA policy mechanism. Second, the cause of the increased latency observed in ima_file_mmap in contrast to ima_bprm_check and ima_file_check is still unknown. To explain this phenomenon, a deep investigation of the code may suggest why there are differences in the IMA hook implementation. Generally, the design and evaluations suggest that the XFilter implementation in the IMA subsystem is feasible when more evaluations and validations have been undertaken. This research provides a reference for further in-depth development related to policy mechanisms in system integrity measurement. Conceptualisation, A.L. and W.D. ; methodology, A.L. ; software, W.D. ; evaluation, A.L. ; formal analysis, W.D. ; writing--original draft preparation, W.D. ; writing--review and editing, A.L. ; supervision, A.L. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. The authors declare no conflict of interest. ## References

* Trusted Computing Group (2021) Trusted Computing Group. Trusted Computing. Available online: [[https://trustedcomputinggroup.org/trusted-computing](https://trustedcomputinggroup.org/trusted-computing)]([https://trustedcomputinggroup.org/trusted-computing](https://trustedcomputinggroup.org/trusted-computing)) (accessed on 1 May 2021). * [PERSON] et al. (2011) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON] Principles of remote attestation. _Int. J. Inf. Secur._**2011**, _10_, 63-81. [CrossRef]
* [PERSON] et al. (2014) [PERSON]; [PERSON]; [PERSON]; [PERSON] A minimalist approach to Remote Attestation. In Proceedings of the 2014 Design, Automation Test in Europe Conference Exhibition (DATE), Dresden, Germany, 24-28 March 2014; pp. 1-6. [CrossRef]
* [PERSON] and [PERSON] (2021) [PERSON]; [PERSON] Integrity Measurement Architecture (IMA). Available online: [[https://sourceforge.net/p/linux-ima/wiki](https://sourceforge.net/p/linux-ima/wiki)]([https://sourceforge.net/p/linux-ima/wiki](https://sourceforge.net/p/linux-ima/wiki)) (accessed on 1 May 2021). * [PERSON] et al.