seL4: from general purpose to a proof of information flow enforcement (2013)
| Venue: | In IEEE Symp. Security & Privacy |
| Citations: | 25 - 7 self |
BibTeX
@INPROCEEDINGS{Murray13sel4:from,
author = {Toby Murray and Daniel Matichuk and Matthew Brassil and Peter Gammie and Timothy Bourke and Sean Seefried and Corey Lewis and Xin Gao and Gerwin Klein},
title = {seL4: from general purpose to a proof of information flow enforcement},
booktitle = {In IEEE Symp. Security & Privacy},
year = {2013}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract—In contrast to testing, mathematical reasoning and formal verification can show the absence of whole classes of security vulnerabilities. We present the, to our knowledge, first complete, formal, machine-checked verification of information flow security for the implementation of a general-purpose microkernel; namely seL4. Unlike previous proofs of information flow security for operating system kernels, ours applies to the actual 8,830 lines of C code that implement seL4, and so rules out the possibility of invalidation by implementation errors in this code. We assume correctness of compiler, assembly code, hardware, and boot code. We prove everything else. This proof is strong evidence of seL4’s utility as a separation kernel, and describes precisely how the general purpose kernel should be configured to enforce isolation and mandatory information flow control. We describe the information flow security statement we proved (a variant of intransitive noninterference), including the assumptions on which it rests, as well as the modifications that had to be made to seL4 to ensure it was enforced. We discuss the practical limitations and implications of this result, including covert channels not covered by the formal proof. I.
Keyphrases
information flow enforcement general purpose information flow security security vulnerability formal verification information flow security statement strong evidence sel4 utility separation kernel mandatory information flow control general-purpose microkernel implementation error intransitive noninterference previous proof operating system kernel practical limitation general purpose kernel formal proof covert channel mathematical reasoning machine-checked verification boot code whole class implement sel4
