law execve_root_permitted

bend-osdev-caps@0.1.0.0 · LAWS.bend:96

import Base
import bend-osdev-caps@0.1.0.0/caps.bend as C
import bend-osdev-caps@0.1.0.0/exec.bend as E

96# "when a process whose real and effective UIDs are zero execve(2)s a
97# program": P'(permitted) = P(inheritable) | P(bounding), and
98# P'(effective) = P'(permitted). For every state with the ambient invariant,
99# every file that is not set-user-ID, without SECBIT_NOROOT.
100law execve_root_permitted:
101  for +k: C.CapsKernel
102  for +s: C.CapState
103  for +sv: U32
104  for +na: Bool
105  for +u: U32
106  for +sg: Bool
107  for +fc: Maybe<&2, C.CapFileSets>
108  for +ign: Bool
109  for h: {C.CapSet.subset(C.CapState.ambient(s), C.CapState.inheritable(s)) == True{} : Bool}
110  {C.CapState.permitted(E.Caps.execve.sets(k, C.CapCred{0, 0, sv, False{}, na, s}, C.CapFile{u, False{}, sg, fc}, ign)) == C.CapSet.union(C.CapState.inheritable(s), C.CapState.bounding(s)) : C.CapSet()}