## 5 Evaluation
### Functional Evaluation
Figure 6(b) shows that the means of the latency value in the policies of the TCB, XLabel, and XList with 50 records have little variation, while the XList file lists with 550 and 1050 records shows that latency is slightly higher. The XList with 1050 records has the highest latency value among all policy settings. #### 5.2.3 ftrace

The ftrace tool in kernel provides a complete interface for tracing kernel events and functions to evaluate the IMA hooks ima_file_check, ima_bprm_check, and ima_file_mmap (Table 1). In the evaluation process, a front-end command, namely trace-cmd (Version 2.6.1), is applied to call the ftrace interface. To reduce the number of repeat syscalls, a specific binary, /usr/bin/hello, is compiled as the target program. Kernel operations are simplified through the use of minimised logic, in which the main function contains only a return statement. The result of this serves to reduce the number of debug messages produced by the trace-cmd command. For each iteration, a report that contains the function graph for specific IMA hook functions is generated, from which the latency values measured in microseconds (us) are filtered out immediately. Due to high levels of skewness and kurtosis found in the data, a trimmed mean at 5% was applied. The tabular data in Figure 9 indicate that across all three hook functions, there is an upward trend in latency from the IMA TCB policy to the XList at 1050 items. The differences are minor for the ima_file_check function (Figure 9b) and significant for XList with 1050 items in ima_bprm_check (Figure 9c) and XList with 550 and 1050 items in ima_file_mmap (Figure 9d). Figure 8: Evaluation results for strace. ### Memory Use Performance Evaluation

Since the IMA XFilter functions are implemented at the kernel level, any measurement should focus on the memory usage during kernel processes. It is possible to measure the kernel memory usage of XFilter by identifying all allocated slabs utilised by kernel operations. The slab is comprised of sections of contiguous virtual memory divided into chunks of equal size [53]. This provides the allocation mechanism for kernel objects. In this evaluation, the status of slab allocation is obtained from /proc/meminfo. Since IMA functions are not implemented as dynamic loading modules, only total slab usage is measured. Considering the time cost, 40 samples of slab information for each policy are collected. Each dataset is collected in a freshly bootstrapped system environment where the kernel and userspace applications run in a stable state. The target system for the evaluation is deployed in the virtual machine environment. A bash shell script running on the host system monitors and controls the measurement via

Figure 9: Evaluation results for ftrace. a ssh connection (Figure 10), which restarts the guest machine after each round of data collection. When the rounds have completed, the data are processed to calculate mean and trimmed mean values. As shown in the tabular data in Figure 10(a), skewness and kurtosis from the measurement results are within the acceptable range, and therefore the mean value is applied in the evaluation. A comparison across five policies (Figure 10(b)) shows that there is little variance between total slab allocation, while the largest differential value is 87 kB, which is insignificant when system memory provides more than 34,000 kB. ## 6 Discussion and Conclusions

This research proposes a flexible and fine-grained mechanism for policy-making in IMA measurement. Although two XFilter methods exist to address the same problem, the mechanisms behind their implementations and the user configuration processes are quite

Figure 11: Evaluation results for slab allocation. Figure 10: Memory usage performance evaluation workflow. different. For XLabel, the files to be measured are recorded as extended attributes in the filesystem layer, whereas XList introduces the provision for the creation and management of a pseudo-file in securityfs, which stores the file path of the target file.