Cerise: Program Verification on a Capability Machine in the Presence of Untrusted Code - CNRS - Centre national de la recherche scientifique Accéder directement au contenu
Pré-Publication, Document De Travail Année : 2022

Cerise: Program Verification on a Capability Machine in the Presence of Untrusted Code

Résumé

A capability machine is a type of CPU allowing fine-grained privilege separation using capabilities, machine words that represent certain kinds of authority. We present a mathematical model and accompanying proof methods that can be used for formal verification of functional correctness of programs running on a capability machine, even when they invoke and are invoked by unknown (and possibly malicious) code. We use a program logic called Cerise for reasoning about known code, and an associated logical relation, for reasoning about unknown code. The logical relation formally captures the capability safety guarantees provided by the capability machine. The Cerise program logic, logical relation, and all the examples considered in the paper have been mechanized using the Iris program logic framework in the Coq proof assistant. The methodology we present underlies recent work of the authors on formal reasoning about capability machines [Georges et al. 2021; Skorstengaard et al. 2019a; Van Strydonck et al. 2021], but was left somewhat implicit in those publications. In this paper we present a pedagogical introduction to the methodology, in a simpler setting (no exotic capabilities), and starting from minimal examples. We work our way up to new results about a heap-based calling convention and implementations of sophisticated object-capability patterns of the kind previously studied for high-level languages with object-capabilities, demonstrating that the methodology scales to such reasoning.
Fichier principal
Vignette du fichier
paper.pdf (822.97 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03826854 , version 1 (24-10-2022)
hal-03826854 , version 2 (11-09-2023)
hal-03826854 , version 3 (06-11-2023)

Identifiants

Citer

Aïna Linn Georges, Armaël Guéneau, Thomas Van Strydonck, Amin Timany, Alix Trieu, et al.. Cerise: Program Verification on a Capability Machine in the Presence of Untrusted Code. 2022. ⟨hal-03826854v1⟩
155 Consultations
116 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More