The tests in FMT_MEC_EXT.1.1 should be expanded to allow for other platform-supported configuration storage mechanisms.

For FMT_MEC_EXT.1.1, the Assurance Activity for Windows and Linux shall be modified as follows (modifications are underlined):

For Windows: The evaluator shall determine and verify that Windows Universal Applications use either the Windows.UI.ApplicationSettings namespace or the IsolatedStorageSettings namespace for storing application specific settings. For Classic Desktop applications, the evaluator shall run the application while monitoring it with the SysInternal tool ProcMon and make changes to its configuration. The evaluator shall verify that ProcMon logs show corresponding changes to the the Windows Registry or C:\ProgramData\ directory.

For Linux: The evaluator shall run the application while monitoring it with the utility strace. The evaluator shall make security-related changes to its configuration. The evaluator shall verify that strace logs corresponding changes to configuration files that reside in /etc (for system-specific configuration) or in the user's home directory (for user-specific configuration) or /var/lib (for configurations controlled by UI and not intended to be directly modified by an administrator).

For Windows, the C:\ProgramData\ directory only gives platform administrators write privileges.  Allowing the use of INI files at this location allows for better cross platform support and is able to provide similar security measures as the Windows Registry. 

 For Linux, the /var/lib directory is documented as the storage location for state information, which better maps to a TOE that uses a UI to control configuration options.  The concern is that moving these configurations to the /etc/ directory could mislead a user to believe that these configuration files can be readily edited with a text editor which may have undesired effects since these values are intended to be set in the UI only