LAWS.execve_permitted_bounded: law of bend-osdev-caps@0.1.0.0
Import: import bend-osdev-caps@0.1.0.0/LAWS.bend as LAWS
Lines 77-85 of bend-osdev-caps@0.1.0.0/LAWS.bend: https://jend.leeeet.dev/read.txt?path=bend-osdev-caps@0.1.0.0/LAWS.bend&start_line=77&end_line=85

import Base
import bend-osdev-caps@0.1.0.0/caps.bend as C
import bend-osdev-caps@0.1.0.0/exec.bend as E

# a capability that is in none of the bounding, inheritable and ambient sets
# never becomes permitted (the bounding set does not mask the inheritable
# set: capabilities(7), "Capability bounding set")
law execve_permitted_bounded:
  for +k: C.CapsKernel
  for +c: C.CapCred
  for +f: C.CapFile
  for +ign: Bool
  {C.CapSet.subset(C.CapState.permitted(E.Caps.execve.sets(k, c, f, ign)), C.CapSet.union(C.CapState.bounding(C.CapCred.sets(c)), C.CapSet.union(C.CapState.inheritable(C.CapCred.sets(c)), C.CapState.ambient(C.CapCred.sets(c))))) == True{} : Bool}

Uses (14):
  https://jend.leeeet.dev/definition.txt?path=Base/base.bend&name=Bool
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/PROOF.bend&name=ex.bound
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/caps.bend&name=CapCred
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/caps.bend&name=CapCred.sets
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/caps.bend&name=CapFile
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/caps.bend&name=CapSet.subset
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/caps.bend&name=CapSet.union
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/caps.bend&name=CapState.ambient
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/caps.bend&name=CapState.bounding
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/caps.bend&name=CapState.inheritable
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/caps.bend&name=CapState.permitted
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/caps.bend&name=CapsKernel
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/exec.bend&name=CapExec.flags
  https://jend.leeeet.dev/definition.txt?path=bend-osdev-caps@0.1.0.0/exec.bend&name=Caps.execve.sets