## Article
### 1 Introduction  
Critical to protecting a system from malicious software and remote exploitation is ensuring the integrity of the operating system. To meet threats to system integrity, we consider the vulnerability of system security components where hardware with cryptographic processing capabilities are deployed increasingly. To meet this trend, the Trusted Computing Group (TCG) provides the Trusted Platform Module (TPM) as an open industry standard for hardware-based trust mechanism [1]. The technology delivered by the TPM specification is an enabler of remote attestation and is integrated into many network authorisation solutions. Remote attestation is a technique for verifying the status of a remote client through a trust mechanism over a network [2, 3]. On the Linux platform, the Integrity Measurement Architecture (IMA) measurement module was developed in the kernel to work with the TPM devices, thereby achieving the system integrity verification. As a subsystem in the Linux kernel, IMA proves to both remote and local systems that the files in a running system are not altered intentionally or accidentally [4]. As the focus of this study, the IMA policy mechanism identifies specific files that should be assessed by the measurement functions. By default, the IMA subsystem in the Linux kernel carries a built-in policy to determine what files are to be measured. IMA covers a large range of file operations in the system,such as file execution, library mmap, and file opening by the root user for reading [4]. The default policy settings rely on factors such as FSMAGIC and file owners, which are overly coarse-grained and may not be suitable for every use case. Usually, according to the threat models and application scenarios, only a few sensitive files need to be measured in many remote attestation solutions. The strategy of measuring a large number of files creates a nondeterminism problem [5], such that even though all file measurement operations are acceptable, the system status may not always be maintained or consistent. The IMA policy supports the policy system of some Linux Security Modules (LSM), such as SELinux and Simple Mandatory Access Control Kernel (SMACK), as a mechanism for refining measurement levels. However, this method is impractical because SELinux and SMACK are Mandatory Access Control (MAC) tools used within the system and not available in all use cases. Linux distributions such as SUSE Linux Enterprise are shipped with AppArmor as the default MAC application, whose support on SELinux is at a fairly early stage [6]. SMACK may also be absent from the support list. Additionally, due to their lower impact on the file loading overhead, many system installations choose AppArmor or TOMOYO instead of SELinux [7; 8]. Additionally, SELinux implements MAC policies by means of contexts composed of users, roles, and types [9]. It means SELinux cannot apply a policy to individual files and is not sufficiently fine-grained. However, increasing the level of granularity will increase complexity and make security maintenance more difficult. SMACK supports a labelling mechanism for fine-grained control, but it requires that a specific pseudo-filesystem be mounted for SMACK use only [10], thereby increasing complexity and maintenance costs. Therefore, the implementation of an LSM-independent fine-grained policy, especially at the file level, can bring multiple benefits. Such an approach can help lower Central Processing Unit (CPU) time spent on hash processing. Additionally, limiting the number of binaries to be measured can reduce the size of the Measurement List (ML), which is critical for constrained devices [11]. Moreover, this approach addresses the nondeterminism problem, enabling the verification of the integrity of critical executables without the need to obtain an ML. Thus, by avoiding the transmission and evaluation of each ML [12], the computational cost of record processing is lowered.