## 5 Evaluation
### Functional Evaluation  
The functional evaluation for the XFilter solution applies black-box testing, in which the evaluation results are determined through observation and analysis of input and output data [45]. A bash shell test script that automates the assessment is provided, wherein bash was selected for its flexibility when calling external commands and tools. The scripts, xlabelling.sh and xlist_update.sh, provide options to specify the XFilter methods to be evaluated and the path of the RPM package. The test script extracts the file flist that contains the path of all target files from the Apache2 package (Figure 5). When the Apache2 program is launched, the script checks if the files that appear in the runtime ML are to be measured. For XLabel, the script examines if the extend attribute security.xlabel exists for files listed in ML. In the case of XList, the script verifies that both the file paths in the flist file and in runtime ML are included in /etc/sysconfig/ima-xlist. If successful, the script prints the evaluation results, and otherwise if the evaluation fails then the output message prints the files not matched. To confirm files to be measured, a verification routine is implemented from the software package to the XList configuration file, and then to the runtime ML. For both XFilter methods, the script also verifies that those files that should not be measured do not appear in the runtime ML. Prior to each measurement method running, the IMA policy file is re-configured as listed in Listings 1 and 2 below. The tests are then performed during system environment bootstrapping. Due to the volume of output, only relevant lines are shown in Listings 3 and 4 and demonstrate that the functional tests for both the XLabel and XList methods are successful. ```
measurefunc=MMAP_CHECK mask=MAY_EXEC xfltr=XF_XLABEL measurefunc=BPRM_CHECK mask=MAY_EXEC xfltr=XF_XLABEL measurefunc=FILE_CHECK mask=\"MAY_READ xfltr=XF_XLABEL euid=0 measurefunc=FILE_CHECK mask=\"MAY_READ xfltr=XF_XLABEL uid=0
``````
``` measurefunc=MMAP_CHECKmask=MAY_EXECxfltr=XF_XLIST measurefunc=BPRM_CHECKmask=MAY_EXECxfltr=XF_XLIST measurefunc=FILE_CHECKmask=\"MAY_READxfltr=XF_XLIST euid=0 measurefunc=FILE_CHECKmask=\"MAY_READxfltr=XF_XLIST uid=0
```  
Listing 3 XLabel test output  
```
#./ima_xfilter_test.shxlabelapache2-2.4.43-lp152.2.12.1.x86_64.rpm Extractingxlistfromthepackage...done! Extractedxlistfile:/tmp/imatest/etc/ima_xfilter/apache2/xlist Starttesting... Launchingapache2...done! Examiningthe'security.xlabel'xattrforthefileshavebeen measured... Foundxattrin/usr/sbin/start_apache2 Foundxattrin/usr/share/apache2/script-helpers...(omittedlines) Checkingthefilesnotlabeled......(omittedlines) TestResult:**Success**
```  
Listing 4 XList test output  
```
#./ima_xfilter_test.shxlistapache2-2.4.43-lp152.2.12.1.x86_64.rpm Extractingxlistfromthepackage...done! Extractedxlistfile:/tmp/imatest/etc/ima_xfilter/apache2/xlist Starttesting... Lanunchingapache2...done! Testingextractedlistagainst/etc/sysconfig/ima-xlist... Found:file=/usr/sbin/start_apache2 Found:file=/usr/share/apache2/script-helpers...(omittedlines) Testingruntimelistagainst/etc/sysconfig/ima-xlist... Found:/usr/sbin/start_apache2 Found:/usr/share/apache2/script-helpers...(omittedlines) Checkingthefilesnotinxlist... TestResult:**Success**

### Performance Evaluation for System Latency

Stress-testing a system during latency performance evaluation plays a critical role in nonfunctional software evaluation. A well-designed application should allow the user to use software functions without experiencing obvious delays [46]. In this research, any increase of latency from the inclusion of the IMA XFilter feature is assessed and recorded in an evaluation matrix (Table 1). The matrix includes the three layers of the user-space, syscall, and IMA kernel functions. The tools used for system latency data collection are time, strace, and ftrace.