A Formally Verified Interpreter for a Shell-like Programming - PowerPoint PPT Presentation

A Formally Verified Interpreter for a Shell-like Programming Language Claude March´ e Nicolas Jeannerod Ralf Treinen VSTTE, July 22, 2017 Nicolas Jeannerod VSTTE’17 July 22, 2017 1 / 36

General goal The CoLiS project. “Correctness of Linux Scripts” Goal: Apply verification techniques to shell scripts in the Debian packages set -e eval "if true; then cmd=’echo foo ’; fi" ( cmd="$cmd bar" ) exit 1 | $cmd "$cmd" Nicolas Jeannerod VSTTE’17 July 22, 2017 2 / 36

General goal The CoLiS project. “Correctness of Linux Scripts” Goal: Apply verification techniques to shell scripts in the Debian packages set -e eval "if true; then cmd=’echo foo ’; fi" ( cmd="$cmd bar" ) exit 1 | $cmd "$cmd" Nicolas Jeannerod VSTTE’17 July 22, 2017 2 / 36

General goal The CoLiS project. “Correctness of Linux Scripts” Goal: Apply verification techniques to shell scripts in the Debian packages set -e eval "if true; then cmd=’echo foo ’; fi" ( cmd="$cmd bar" ) exit 1 | $cmd "$cmd" Nicolas Jeannerod VSTTE’17 July 22, 2017 2 / 36

Big picture Nicolas Jeannerod VSTTE’17 July 22, 2017 3 / 36

Big picture Nicolas Jeannerod VSTTE’17 July 22, 2017 3 / 36

Big picture Nicolas Jeannerod VSTTE’17 July 22, 2017 3 / 36

Big picture Nicolas Jeannerod VSTTE’17 July 22, 2017 3 / 36

Big picture Nicolas Jeannerod VSTTE’17 July 22, 2017 3 / 36

Big picture Nicolas Jeannerod VSTTE’17 July 22, 2017 3 / 36

Table of Contents 1. Language CoLiS Mechanised version 2. Sound and complete interpreter Let us see some code Soundness Completeness Looking for a variant... Skeletons Nicolas Jeannerod VSTTE’17 July 22, 2017 4 / 36

Language CoLiS Table of Contents 1. Language CoLiS Mechanised version 2. Sound and complete interpreter Let us see some code Soundness Completeness Looking for a variant... Skeletons Nicolas Jeannerod VSTTE’17 July 22, 2017 5 / 36

Language CoLiS Requirements Intermediate language (not a replacement of Shell); Clean; With formal syntax and semantics; Statically typed: strings and lists; Variables and functions explicitely declared in a header; Dangerous structures made more explicit. However, automatic translation from reasonnable Shell must be possible. Nicolas Jeannerod VSTTE’17 July 22, 2017 6 / 36

Language CoLiS Requirements Intermediate language (not a replacement of Shell); Clean; With formal syntax and semantics; Statically typed: strings and lists; Variables and functions explicitely declared in a header; Dangerous structures made more explicit. However, automatic translation from reasonnable Shell must be possible. Nicolas Jeannerod VSTTE’17 July 22, 2017 6 / 36

Language CoLiS Requirements Intermediate language (not a replacement of Shell); Clean; With formal syntax and semantics; Statically typed: strings and lists; Variables and functions explicitely declared in a header; Dangerous structures made more explicit. However, automatic translation from reasonnable Shell must be possible. Nicolas Jeannerod VSTTE’17 July 22, 2017 6 / 36

Language CoLiS Requirements Intermediate language (not a replacement of Shell); Clean; With formal syntax and semantics; Statically typed: strings and lists; Variables and functions explicitely declared in a header; Dangerous structures made more explicit. However, automatic translation from reasonnable Shell must be possible. Nicolas Jeannerod VSTTE’17 July 22, 2017 6 / 36

Language CoLiS A glimpse of the language var fruits : list var fruit : string var line : string begin fruits="banana apple .." fruits ::= [ ’banana ’ ; ’apple ’ ; .. ] { pipe for fruit in $fruits for fruit in [fruits] do do echo "$fruit" call [ ’echo ’ ; {fruit} ] ; done done } | { into while read line while call [ ’read ’ ; ’line ’ ] do do echo "- $line" call [ ’echo ’ ; {’- ’ , line} ] ; done end } end Nicolas Jeannerod VSTTE’17 July 22, 2017 7 / 36

Language CoLiS A glimpse of the language var fruits : list var fruit : string var line : string begin fruits="banana apple .." fruits ::= [ ’banana ’ ; ’apple ’ ; .. ] { pipe for fruit in $fruits for fruit in [fruits] do do echo "$fruit" call [ ’echo ’ ; {fruit} ] ; done done } | { into while read line while call [ ’read ’ ; ’line ’ ] do do echo "- $line" call [ ’echo ’ ; {’- ’ , line} ] ; done end } end Nicolas Jeannerod VSTTE’17 July 22, 2017 7 / 36

Language CoLiS How behaviours are handled n n e l r r e t t a s u u e e u e i e i t l s x x s t u t u r a a l E E l T e e F F r a r a R T R T F F Normal Pipe Normal Exception Sequence Test Success Failure Exception Function call Success Failure Success Failure Exception Subprocess Success Failure Success Failure Success Failure Nicolas Jeannerod VSTTE’17 July 22, 2017 8 / 36

Language CoLiS Interactions between Do-While and Fatal DoWhile-Test-Fatal t 1 / Γ ⇓ σ 1 ⋆ True / Γ 1 t 2 / Γ 1 ⇓ σ 2 ⋆ Fatal / Γ 2 do t 1 while t 2 / Γ ⇓ σ 1 σ 2 ⋆ True / Γ 2 DoWhile-Body-Fatal t 1 / Γ ⇓ σ 1 ⋆ Fatal / Γ 1 do t 1 while t 2 / Γ ⇓ σ 1 ⋆ Fatal / Γ 1 Nicolas Jeannerod VSTTE’17 July 22, 2017 9 / 36

Language CoLiS Interactions between Do-While and Fatal DoWhile-Test-Fatal t 1 / Γ ⇓ σ 1 ⋆ True / Γ 1 t 2 / Γ 1 ⇓ σ 2 ⋆ Fatal / Γ 2 do t 1 while t 2 / Γ ⇓ σ 1 σ 2 ⋆ True / Γ 2 DoWhile-Body-Fatal t 1 / Γ ⇓ σ 1 ⋆ Fatal / Γ 1 do t 1 while t 2 / Γ ⇓ σ 1 ⋆ Fatal / Γ 1 Nicolas Jeannerod VSTTE’17 July 22, 2017 9 / 36

Language Mechanised version Table of Contents 1. Language CoLiS Mechanised version 2. Sound and complete interpreter Let us see some code Soundness Completeness Looking for a variant... Skeletons Nicolas Jeannerod VSTTE’17 July 22, 2017 10 / 36

Language Mechanised version Why3 Deductive verification platform; WhyML: language for both specification and programming; Standard library: integer arithmetic, boolean operations, maps, etc.; Native support of imperative features: references, exceptions, while and for loops; Proof obligations are given to external theorem provers; Possibility to extract WhyML code to OCaml. Nicolas Jeannerod VSTTE’17 July 22, 2017 11 / 36

Language Mechanised version Why3 Deductive verification platform; WhyML: language for both specification and programming; Standard library: integer arithmetic, boolean operations, maps, etc.; Native support of imperative features: references, exceptions, while and for loops; Proof obligations are given to external theorem provers; Possibility to extract WhyML code to OCaml. Nicolas Jeannerod VSTTE’17 July 22, 2017 11 / 36

Language Mechanised version Why3 Deductive verification platform; WhyML: language for both specification and programming; Standard library: integer arithmetic, boolean operations, maps, etc.; Native support of imperative features: references, exceptions, while and for loops; Proof obligations are given to external theorem provers; Possibility to extract WhyML code to OCaml. Nicolas Jeannerod VSTTE’17 July 22, 2017 11 / 36

Language Mechanised version Why3 Deductive verification platform; WhyML: language for both specification and programming; Standard library: integer arithmetic, boolean operations, maps, etc.; Native support of imperative features: references, exceptions, while and for loops; Proof obligations are given to external theorem provers; Possibility to extract WhyML code to OCaml. Nicolas Jeannerod VSTTE’17 July 22, 2017 11 / 36

Language Mechanised version Why3 Deductive verification platform; WhyML: language for both specification and programming; Standard library: integer arithmetic, boolean operations, maps, etc.; Native support of imperative features: references, exceptions, while and for loops; Proof obligations are given to external theorem provers; Possibility to extract WhyML code to OCaml. Nicolas Jeannerod VSTTE’17 July 22, 2017 11 / 36

Language Mechanised version Why3 Deductive verification platform; WhyML: language for both specification and programming; Standard library: integer arithmetic, boolean operations, maps, etc.; Native support of imperative features: references, exceptions, while and for loops; Proof obligations are given to external theorem provers; Possibility to extract WhyML code to OCaml. Nicolas Jeannerod VSTTE’17 July 22, 2017 11 / 36

Language Mechanised version Syntax type term = | TTrue with sexpr = list sfrag | TFalse | TFatal with sfrag = | TReturn term | SLiteral string | TExit term | SVar svar | TAsString svar sexpr | SArg int | TAsList lvar lexpr | SProcess term | TSeq term term | TIf term term term with lexpr = list lfrag | TFor svar lexpr term | TDoWhile term term with lfrag = | TProcess term | LSingleton sexpr | TCall lexpr | LSplit sexpr | TShift | LVar lvar | TPipe term term Nicolas Jeannerod VSTTE’17 July 22, 2017 12 / 36