## 5 Evaluation
### Functional Evaluation
strace obtains latency data by measuring the syscall execve and mmap, whereas ftrace evaluates the IMA hooks ima_file_check, ima_bprm_check, and ima_file_mmap. The three layers are closely linked such that the user-space program that is evaluated with time involves syscalls via execve and mmap, which are in turn evaluated with strace. During the processing of these syscalls, the IMA hook functions are called by ftrace. In addition to the evaluation layers, five policy rule sets are applied, including IMA TCB, XLabel, and XList with 50, 550 and 1050 file paths. For XList, the processing time spent on file path traversal depends on the length of the file list, and therefore different file \begin{table}
\begin{tabular}{l l l l l l l} \hline \hline \multirow{2}{*}{**Layers**} & \multirow{2}{*}{**Tools**} & \multirow{2}{*}{**Functions**} & \multicolumn{4}{c}{**Scenarios**} \\ \cline{3-8}  & & & **TCB** & **XLabel** & **XList** & **XList** & **XList** \\  & & & & **(50)** & **(550)** & **(1050)** \\ \hline User-space & time & - & & & & \\ \hline \multirow{2}{*}{Syscall} & \multirow{2}{*}{strace} & execve & & & & \\  & & & mmap & & & \\  & & & & & & \\  & & & & & & \\  & & & & & & \\  & & & & & & \\  & & & & & & \\  & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Performance evaluation matrix for system latency. Figure 5: The workflow of functional evaluation for XFilter. path numbers are included. A typical number for a single application such as Apache2 is 50, while 550 and 1050 were selected to provide intervals of 500. The MAC components, SELinux and SMACK, contribute considerable overhead to system operations. For example, the impact of SELinux on the overall performance may be as high as 7% [47]. Therefore, a comparison between the policies for LSM and XFilter is likely to be inaccurate and is not covered in this research. To ensure that the results accurately reflect any latency introduced by the new policy mechanism and given that the evaluation targets IMA policy processing, the IMA measurement actions for the XLabel and XList scenarios are temporarily disabled during testing. That is actioned by defining a new KConfig option in the code, IMA_POLICY_XFLTR_EVAL, which is set before the evaluation. The evaluation begins with environment preparation (Figure 6), such as detecting IMA policies and creating temporary files. The collection and processing of latency data is automated by bash scripts ima_eval_time.sh, ima_eval_strace.sh, and ima_eval_ftrace.sh, from where the commands time, strace, and ftrace are called. The test commands are executed 100 times while flushing system buffers and clearing memory caches between each round. A log file formatted as Comma-Separated Values (CSV) is created to record the time value in seconds or microseconds. The calculation results, skewness, and kurtosis are appended to the file. One hundred latency values are obtained for each scenario in the matrix. The central tendencies for multiple sample sets are compared after skewness and kurtosis of the variable distributions are determined [48]. To establish normality, the mean is used for normal distribution [49] while the trimmed mean is used when there are outliers [42]. So that data present a normal distribution, skewness and kurtosis should be in the range of \(-2\pm 2\) after trimming [50; 51; 52]. #### 5.2.1 Time Command

In this evaluation, the bash command time is capable of millisecond measurement precision, compared with the centisecond level provided by GNU time. Only CPU time is collected, because it directly measures the time spent on kernel processing for a program. As the target program in this measurement, GNU tar is executed in a loop of 100 iterations. In each round, nine text files are created prior to them being compressed by the tar command 128 times. Figure 6: The workflow of performance evaluation for system latency. The results indicate that the skewness and kurtosis are within range and the mean was applied to represent the central location (tabular results in Figure 6(a)).