author | chunhan |
Mon, 24 Jun 2013 09:01:42 +0800 | |
changeset 25 | 259a50be4381 |
parent 23 | 25e55731ed01 |
child 26 | b6333712cb02 |
permissions | -rw-r--r-- |
19 | 1 |
(*<*) |
18 | 2 |
theory Current_prop |
3 |
imports Main Flask_type Flask My_list_prefix Init_prop Valid_prop Delete_prop |
|
4 |
begin |
|
19 | 5 |
(*>*) |
18 | 6 |
|
7 |
context flask begin |
|
8 |
||
9 |
lemma procs_of_shm_prop1: "\<lbrakk> p_flag \<in> procs_of_shm s h; valid s\<rbrakk> \<Longrightarrow> h \<in> current_shms s" |
|
10 |
apply (induct s arbitrary:p_flag) |
|
11 |
apply (case_tac p_flag, simp, drule init_procs_has_shm, simp) |
|
12 |
apply (frule vd_cons, frule vt_grant_os) |
|
13 |
apply (case_tac a, auto split:if_splits option.splits) |
|
14 |
done |
|
15 |
||
16 |
lemma procs_of_shm_prop2: "\<lbrakk>(p, flag) \<in> procs_of_shm s h; valid s\<rbrakk> \<Longrightarrow> p \<in> current_procs s" |
|
17 |
apply (induct s arbitrary:p flag) |
|
18 |
apply (simp, drule init_procs_has_shm, simp) |
|
19 |
apply (frule vd_cons, frule vt_grant_os) |
|
20 |
apply (case_tac a, auto split:if_splits option.splits) |
|
21 |
done |
|
22 |
||
23 |
lemma procs_of_shm_prop3: "\<lbrakk>(p, flag) \<in> procs_of_shm s h; (p, flag') \<in> procs_of_shm s h; valid s\<rbrakk> |
|
24 |
\<Longrightarrow> flag = flag'" |
|
25 |
apply (induct s arbitrary:p flag flag') |
|
26 |
apply (simp, drule_tac flag = flag in init_procs_has_shm, drule_tac flag = flag' in init_procs_has_shm, simp) |
|
27 |
apply (frule vd_cons, frule vt_grant_os) |
|
28 |
apply (case_tac a, auto split:if_splits option.splits dest:procs_of_shm_prop2) |
|
29 |
done |
|
30 |
||
31 |
lemma procs_of_shm_prop4: "\<lbrakk>(p, flag) \<in> procs_of_shm s h; valid s\<rbrakk> \<Longrightarrow> flag_of_proc_shm s p h = Some flag" |
|
32 |
apply (induct s arbitrary:p flag) |
|
33 |
apply (simp, drule init_procs_has_shm, simp) |
|
34 |
apply (frule vd_cons, frule vt_grant_os) |
|
35 |
apply (case_tac a, auto split:if_splits option.splits dest:procs_of_shm_prop2) |
|
36 |
done |
|
37 |
||
38 |
lemma procs_of_shm_prop4': |
|
39 |
"\<lbrakk>flag_of_proc_shm s p h = None; valid s\<rbrakk> \<Longrightarrow> \<forall> flag. (p, flag) \<notin> procs_of_shm s h" |
|
40 |
by (auto dest:procs_of_shm_prop4) |
|
41 |
||
42 |
lemma not_init_intro_proc: |
|
43 |
"\<lbrakk>p \<notin> current_procs s; valid s\<rbrakk> \<Longrightarrow> deleted (O_proc p) s \<or> p \<notin> init_procs" |
|
44 |
using not_deleted_init_proc by auto |
|
45 |
||
46 |
lemma not_init_intro_proc': |
|
47 |
"\<lbrakk>p \<notin> current_procs s; valid s\<rbrakk> \<Longrightarrow> \<not> (\<not> deleted (O_proc p) s \<and> p \<in> init_procs)" |
|
48 |
using not_deleted_init_proc by auto |
|
49 |
||
23
25e55731ed01
locale of tainting for seeds when same shm/inode bugs
chunhan
parents:
19
diff
changeset
|
50 |
lemma info_shm_flow_in_procs: |
25e55731ed01
locale of tainting for seeds when same shm/inode bugs
chunhan
parents:
19
diff
changeset
|
51 |
"\<lbrakk>info_flow_shm s p p'; valid s\<rbrakk> \<Longrightarrow> p \<in> current_procs s \<and> p' \<in> current_procs s" |
25
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
52 |
apply (induct rule:info_flow_shm.induct ) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
53 |
by (auto intro:procs_of_shm_prop2) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
54 |
|
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
55 |
(*********** simpset for info_flow_shm **************) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
56 |
|
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
57 |
lemma info_flow_shm_prop1: |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
58 |
"\<lbrakk>info_flow_shm s p p'; p \<noteq> p'; valid s\<rbrakk> |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
59 |
\<Longrightarrow> \<exists> h h' flag. (p, SHM_RDWR) \<in> procs_of_shm s h \<and> (p', flag) \<in> procs_of_shm s h'" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
60 |
by (induct rule: info_flow_shm.induct, auto) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
61 |
|
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
62 |
lemma info_flow_shm_cases: |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
63 |
"\<lbrakk>info_flow_shm \<tau> pa pb; \<And>p s. \<lbrakk>s = \<tau> ; pa = p; pb = p; p \<in> current_procs s\<rbrakk> \<Longrightarrow> P; |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
64 |
\<And>s p p' h p'' flag. \<lbrakk>s = \<tau>; pa = p; pb = p''; info_flow_shm s p p'; (p', SHM_RDWR) \<in> procs_of_shm s h; |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
65 |
(p'', flag) \<in> procs_of_shm s h\<rbrakk>\<Longrightarrow> P\<rbrakk> |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
66 |
\<Longrightarrow> P" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
67 |
by (erule info_flow_shm.cases, auto) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
68 |
|
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
69 |
definition one_flow_shm :: "t_state \<Rightarrow> t_process \<Rightarrow> t_process \<Rightarrow> bool" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
70 |
where |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
71 |
"one_flow_shm s p p' \<equiv> p \<noteq> p' \<and> (\<exists> h flag. (p, SHM_RDWR) \<in> procs_of_shm s h \<and> (p', flag) \<in> procs_of_shm s h)" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
72 |
|
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
73 |
inductive flows_shm :: "t_state \<Rightarrow> t_process \<Rightarrow> t_process \<Rightarrow> bool" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
74 |
where |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
75 |
"p \<in> current_procs s \<Longrightarrow> flows_shm s p p" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
76 |
| "\<lbrakk>flows_shm s p p'; one_flow_shm s p' p''\<rbrakk> \<Longrightarrow> flows_shm s p p''" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
77 |
|
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
78 |
definition attached_procs :: "t_state \<Rightarrow> t_shm \<Rightarrow> t_process set" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
79 |
where |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
80 |
"attached_procs s h \<equiv> {p. \<exists> flag. (p, flag) \<in> procs_of_shm s h}" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
81 |
|
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
82 |
definition flowed_procs:: "t_state \<Rightarrow> t_shm \<Rightarrow> t_process set" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
83 |
where |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
84 |
"flowed_procs s h \<equiv> {p'. \<exists> p \<in> attached_procs s h. flows_shm s p p'}" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
85 |
|
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
86 |
fun Info_flow_shm :: "t_state \<Rightarrow> t_process \<Rightarrow> t_process set" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
87 |
where |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
88 |
"Info_flow_shm [] = (\<lambda> p. {p'. flows_shm [] p p'})" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
89 |
| "Info_flow_shm (Attach p h flag # s) = (\<lambda> p'. if (p' = p) then {p''. \<exists> }" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
90 |
|
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
91 |
|
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
92 |
lemma info_flow_shm_attach: |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
93 |
"valid (Attach p h flag # s) \<Longrightarrow> info_flow_shm (Attach p h flag # s) = (\<lambda> pa pb. (info_flow_shm s pa pb) \<or> |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
94 |
(if (pa = p) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
95 |
then (if (flag = SHM_RDWR) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
96 |
then (\<exists> flag. (pb, flag) \<in> procs_of_shm s h) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
97 |
else (pb = p)) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
98 |
else (if (pb = p) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
99 |
then (pa, SHM_RDWR) \<in> procs_of_shm s h |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
100 |
else info_flow_shm s pa pb)) )" |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
101 |
apply (frule vd_cons, frule vt_grant_os, rule ext, rule ext) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
102 |
apply (case_tac "info_flow_shm s pa pb", simp) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
103 |
|
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
104 |
thm info_flow_shm.cases |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
105 |
apply (auto split:if_splits intro:info_flow_shm.intros elim:info_flow_shm_cases) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
106 |
apply (erule info_flow_shm_cases, simp, simp split:if_splits) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
107 |
apply (rule_tac p = pa and p' = p' in info_flow_shm.intros(2), simp+) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
108 |
apply (rule notI, erule info_flow_shm.cases, simp+) |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
109 |
pr 5 |
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
110 |
|
259a50be4381
wrong of info-flow-shm, it is a inductive(transitive) notion, not a simple relation just between 2 nodes, more information, see 5.7 of ideas_of_selinux.txt
chunhan
parents:
23
diff
changeset
|
111 |
lemmas info_flow_shm_simps = info_flow_shm_other |
23
25e55731ed01
locale of tainting for seeds when same shm/inode bugs
chunhan
parents:
19
diff
changeset
|
112 |
|
19 | 113 |
lemma has_same_inode_in_current: |
114 |
"\<lbrakk>has_same_inode s f f'; valid s\<rbrakk> \<Longrightarrow> f \<in> current_files s \<and> f' \<in> current_files s" |
|
115 |
by (auto simp add:has_same_inode_def current_files_def) |
|
116 |
||
117 |
lemma has_same_inode_prop1: |
|
118 |
"\<lbrakk>has_same_inode s f f'; is_file s f; valid s\<rbrakk> \<Longrightarrow> is_file s f'" |
|
119 |
by (auto simp:has_same_inode_def is_file_def) |
|
120 |
||
121 |
lemma has_same_inode_prop1': |
|
122 |
"\<lbrakk>has_same_inode s f f'; is_file s f'; valid s\<rbrakk> \<Longrightarrow> is_file s f" |
|
123 |
by (auto simp:has_same_inode_def is_file_def) |
|
124 |
||
125 |
lemma has_same_inode_prop2: |
|
126 |
"\<lbrakk>has_same_inode s f f'; file_of_proc_fd s p fd = Some f; valid s\<rbrakk> \<Longrightarrow> is_file s f'" |
|
127 |
apply (drule has_same_inode_prop1) |
|
128 |
apply (simp add:file_of_pfd_is_file, simp+) |
|
129 |
done |
|
130 |
||
131 |
lemma has_same_inode_prop2': |
|
132 |
"\<lbrakk>has_same_inode s f f'; file_of_proc_fd s p fd = Some f'; valid s\<rbrakk> \<Longrightarrow> is_file s f" |
|
133 |
apply (drule has_same_inode_prop1') |
|
134 |
apply (simp add:file_of_pfd_is_file, simp+) |
|
135 |
done |
|
136 |
||
137 |
lemma tobj_in_init_alive: |
|
138 |
"tobj_in_init obj \<Longrightarrow> init_alive obj" |
|
139 |
by (case_tac obj, auto) |
|
140 |
||
141 |
lemma tobj_in_alive: |
|
142 |
"tobj_in_init obj \<Longrightarrow> alive [] obj" |
|
143 |
by (case_tac obj, auto simp:is_file_nil) |
|
144 |
||
18 | 145 |
end |
146 |
||
147 |
end |