Cerise: Program Verification on a Capability Machine in the Presence of Untrusted Code - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Journal Articles Journal of the ACM (JACM) Year : 2023

Cerise: Program Verification on a Capability Machine in the Presence of Untrusted Code

Abstract

A capability machine is a type of CPU allowing fine-grained privilege separation using capabilities, machine words that represent certain kinds of authority. We present a mathematical model and accompanying proof methods that can be used for formal verification of functional correctness of programs running on a capability machine, even when they invoke and are invoked by unknown (and possibly malicious) code. We use a program logic called Cerise for reasoning about known code, and an associated logical relation, for reasoning about unknown code. The logical relation formally captures the capability safety guarantees provided by the capability machine. The Cerise program logic, logical relation, and all the examples considered in the paper have been mechanized using the Iris program logic framework in the Coq proof assistant. The methodology we present underlies recent work of the authors on formal reasoning about capability machines [Georges et al. 2021; Skorstengaard et al. 2019a; Van Strydonck et al. 2021], but was left somewhat implicit in those publications. In this paper we present a pedagogical introduction to the methodology, in a simpler setting (no exotic capabilities), and starting from minimal examples. We work our way up to new results about a heap-based calling convention and implementations of sophisticated object-capability patterns of the kind previously studied for high-level languages with object-capabilities, demonstrating that the methodology scales to such reasoning.
Fichier principal
Vignette du fichier
cerise-journal.pdf (853.93 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Licence : CC BY - Attribution

Dates and versions

hal-03826854 , version 1 (24-10-2022)
hal-03826854 , version 2 (11-09-2023)
hal-03826854 , version 3 (06-11-2023)

Licence

Attribution

Identifiers

Cite

Aïna Linn Georges, Armaël Guéneau, Thomas Van Strydonck, Amin Timany, Alix Trieu, et al.. Cerise: Program Verification on a Capability Machine in the Presence of Untrusted Code. Journal of the ACM (JACM), 2023, ⟨10.1145/3623510⟩. ⟨hal-03826854v3⟩
155 View
116 Download

Altmetric

Share

Gmail Facebook X LinkedIn More