Le temps des cerises: efficient temporal stack safety on capability machines using directed capabilities

Abstract

Capability machines are a type of CPUs that support fine-grained privilege separation using capabilities , machine words that include forms of authority. Formal models of capability machines and associated calling conventions have so far focused on establishing two forms of stack safety properties, namely local state encapsulation and well-bracketed control flow. We introduce a novel kind of directed capabilities and show how to use them to make an earlier suggested calling convention more efficient. In contrast to earlier work on capability machine models we do not only consider integrity properties but also confidentiality properties; we provide a unary logical relation to reason about the former and a binary logical relation to reason about the latter, each expressive enough to reason about temporal stack safety. While the logical relations are useful for reasoning about concrete examples, they do not on their own demonstrate that stack safety holds for a large class of programs. Therefore, we also show full abstraction of a compiler from an overlay semantics that internalizes the calling convention as a single call step and explicitly keeps track of the call stack and frame lifetimes to a base capability machine. All results have been mechanized in Coq.

Asynchronous Probabilistic Couplings in Higher-Order Separation Logic

“…Separation logic: Relational separation logics have been developed on top of Iris for a range of properties, such as contextual refinement [38], [43], [50], [51], simulation [52]- [54], and security [55]- [57]. The representation of the righthand side program as a resource is a recurring idea, but our technical construction with run ahead is novel.…”

A Generic Framework to Develop and Verify Security Mechanisms at the Microarchitectural Level: Application to Control-Flow Integrity

“…Nienhuis et al [24] prove capability monotonicity for CHERI-MIPS while Bauereiss et al [4] prove it for the Arm Morello prototype. The work of Georges et al [11], [12] and Skorstengaard et al [28], [29] prove a variety of stack safety properties that can be enforced on capability machines. Similarly, Van Strydonck et al [30] develop a library of verified wrappers around drivers leveraging capabilities for enforcing security properties.…”

Coinductive Natural Semantics for Compiler Verification in Coq

“…In this regard, Krebbers et al [53] comment: 'We also show that the step-indexed "later" modality of Iris is an essential source of complexity, in that removing it leads to a logical inconsistency'. Recently, Linn Georges et al [54] formalize a capability machine in IRIS. As Linn Georges et al [54] point out, capability machines are promising targets for secure compilers.…”

“…Recently, Linn Georges et al [54] formalize a capability machine in IRIS. As Linn Georges et al [54] point out, capability machines are promising targets for secure compilers. Hence, the idea to extend IRIS to be used as secure compiler framework is imminent; in particular, to verify secure compilers from high-level concurrent languages to capability machines.…”