Symbolic Execution of Debian Packages Nicolas Jeannerod nicolas.jeannerod@irif.fr joint work with Benedikt Becker, Claude Marché Yann Régis-Gianas, Mihaela Sighireanu, Ralf Treinen IRIF, Université de Paris September 9, 2019 13th Alpine Verification Meeting
Introduction > CoLiS project: Correctness of Linux Scripts 1
Introduction > CoLiS project: Correctness of Linux Scripts > Goal: applying formal methods to the quality assessment of Debian Packages. 1
Introduction > CoLiS project: Correctness of Linux Scripts > Goal: applying formal methods to the quality assessment of Debian Packages. > Debian: operating system. > Packages: way to provide (install, update, remove) software. 1
Introduction > CoLiS project: Correctness of Linux Scripts > Goal: applying formal methods to the quality assessment of Debian Packages. > Debian: operating system. > Packages: way to provide (install, update, remove) software. > Goal (reformulated): making sure that installing/updating/removing software does not: > make other softwares unusable, > make the whole computer unusable, > remove your personnal files, > etc. 1
Installing a Software on Debian 1. Download the package. 2
Installing a Software on Debian 1. Download the package. 2. Execute a pre-installation script. 2
Installing a Software on Debian 1. Download the package. 2. Execute a pre-installation script. 3. Unpack static archive. 2
Installing a Software on Debian 1. Download the package. 2. Execute a pre-installation script. 3. Unpack static archive. 4. Execute a post-installation script. 2
Installing a Software on Debian 1. Download the package. 2. Execute a pre-installation script. > This is a POSIX shell script ran as administrator. 3. Unpack static archive. 4. Execute a post-installation script. > This is a POSIX shell script ran as administrator. 2
Installing a Software on Debian 1. Download the package. 2. Execute a pre-installation script. > This is a POSIX shell script ran as administrator. 3. Unpack static archive. 4. Execute a post-installation script. > This is a POSIX shell script ran as administrator. POSIX shell: > scripting language 2
Installing a Software on Debian 1. Download the package. 2. Execute a pre-installation script. > This is a POSIX shell script ran as administrator. 3. Unpack static archive. 4. Execute a post-installation script. > This is a POSIX shell script ran as administrator. POSIX shell: > scripting language > legacy (born in 1971) 2
Installing a Software on Debian 1. Download the package. 2. Execute a pre-installation script. > This is a POSIX shell script ran as administrator. 3. Unpack static archive. 4. Execute a post-installation script. > This is a POSIX shell script ran as administrator. POSIX shell: Administrator: > scripting language > can do anything on the system > legacy (born in 1971) 2
Installing a Software on Debian 1. Download the package. 2. Execute a pre-installation script. > This is a POSIX shell script ran as administrator. 3. Unpack static archive. 4. Execute a post-installation script. > This is a POSIX shell script ran as administrator. POSIX shell: Administrator: > scripting language > can do anything on the system > legacy (born in 1971) Complicated and dangerous 2
Installing a Software on Debian 1. Download the package. 2. Execute a pre-installation script. > This is a POSIX shell script ran as administrator. 3. Unpack static archive. 4. Execute a post-installation script. > This is a POSIX shell script ran as administrator. POSIX shell: Administrator: > scripting language > can do anything on the system > legacy (born in 1971) Complicated and dangerous. Formal methods? 2
Our Tools: An Overview Debian Package CoLiS Report 3
Our Tools: An Overview Debian Package Shell script Specification Symbolic CoLiS of the script Engine Report 3
Our Tools: An Overview Debian Morbig, Morsmall Package and ColisFromShell t p i r c Colis s l l inter. e h S language Specification Symbolic CoLiS of the script Engine Report 3
Our Tools: An Overview Debian Morbig, Morsmall Package and ColisFromShell t p i r c Colis s l l inter. e h S language Specification Symbolic Specifications CoLiS of the script Engine of commands Report 3
Our Tools: An Overview Debian Morbig, Morsmall Package and ColisFromShell t p i r c Colis s l l inter. e h S language Specification Symbolic Specifications CoLiS of the script Engine of commands SAT? SAT solver for specifications Report 3
Our Tools: An Overview Debian Régis-Gianas, Morbig, Morsmall J & Treinen Package and ColisFromShell SLE 2018 t p i r c Colis s J, Marché l l inter. & Treinen e h S VSTTE 2017 language Specification Symbolic Specifications CoLiS of the script Engine of commands SAT? SAT solver for specifications Report 3
Specifications, Feature Trees & Constraints
Feature Trees g g f h f h g f > Unranked unordered trees; 4
Feature Trees g g f h f h g f > Unranked unordered trees; > Good models for the UNIX filesystem; 4
Feature Trees g g f h f h g f > Unranked unordered trees; > Good models for the UNIX filesystem; > Shell scripts can be seen as programs that modify such trees; 4
Feature Trees g g f h f h g f > Unranked unordered trees; > Good models for the UNIX filesystem; > Shell scripts can be seen as programs that modify such trees; > Constraints will express relations between such trees. 4
Constraints On Feature Trees Atom (Informal) Semantics 5
Constraints On Feature Trees Atom (Informal) Semantics x [ f ] y From x ’s tree, through f , we go to y ’s tree Aït-Kaci x [ f ] ↑ In x ’s tree, there is no f Podelski & Smolka Ax The root of x ’s tree has decoration A 1992 5
Constraints On Feature Trees Atom (Informal) Semantics x [ f ] y From x ’s tree, through f , we go to y ’s tree Aït-Kaci x [ f ] ↑ In x ’s tree, there is no f Podelski & Smolka Ax The root of x ’s tree has decoration A 1992 Smolka x [ F ] x ’s tree can also use features in F & Treinen 1994 5
Constraints On Feature Trees Atom (Informal) Semantics x [ f ] y From x ’s tree, through f , we go to y ’s tree Aït-Kaci x [ f ] ↑ In x ’s tree, there is no f Podelski & Smolka Ax The root of x ’s tree has decoration A 1992 Smolka x [ F ] x ’s tree can also use features in F & Treinen 1994 x ∼ F y x and y ’s trees are similar except in F 5
Example Specification: mkdir q/f ∃ x , x ′ , y ′ · resolve ( r , cwd , q , x ) ∧ dir ( x ) ∧ x [ f ] ↑ Success ∧ similar ( r , r ′ , cwd , q , x , x ′ ) ∧ x ∼ { f } x ′ ∧ dir ( x ′ ) ∧ x ′ [ f ] y ′ ∧ dir ( y ′ ) ∧ y ′ [ ∅ ] ∃ y · resolve ( r , cwd , q / f , y ) ∧ r . = r ′ noresolve ( r , cwd , q ) ∧ r . = r ′ Error ∃ x · resolve ( r , cwd , q , x ) ∧¬ dir ( x ) ∧ r . = r ′ 6
Example Specification: mkdir q/f ∃ x , x ′ , y ′ · resolve ( r , cwd , q , x ) ∧ dir ( x ) ∧ x [ f ] ↑ Success ∧ similar ( r , r ′ , cwd , q , x , x ′ ) ∧ x ∼ { f } x ′ ∧ dir ( x ′ ) ∧ x ′ [ f ] y ′ ∧ dir ( y ′ ) ∧ y ′ [ ∅ ] ∃ y · resolve ( r , cwd , q / f , y ) ∧ r . = r ′ noresolve ( r , cwd , q ) ∧ r . = r ′ Error ∃ x · resolve ( r , cwd , q , x ) ∧¬ dir ( x ) ∧ r . = r ′ 6
Example Specification: mkdir q/f ∃ x , x ′ , y ′ · resolve ( r , cwd , q , x ) ∧ dir ( x ) ∧ x [ f ] ↑ Success ∧ similar ( r , r ′ , cwd , q , x , x ′ ) ∧ x ∼ { f } x ′ ∧ dir ( x ′ ) ∧ x ′ [ f ] y ′ ∧ dir ( y ′ ) ∧ y ′ [ ∅ ] r ∃ y · resolve ( r , cwd , q / f , y ) ∧ r . = r ′ q ∃ x noresolve ( r , cwd , q ) ∧ r . = r ′ Error ∃ x · resolve ( r , cwd , q , x ) ∧¬ dir ( x ) ∧ r . = r ′ 6
Example Specification: mkdir q/f ∃ x , x ′ , y ′ · resolve ( r , cwd , q , x ) ∧ dir ( x ) ∧ x [ f ] ↑ Success ∧ similar ( r , r ′ , cwd , q , x , x ′ ) ∧ x ∼ { f } x ′ ∧ dir ( x ′ ) ∧ x ′ [ f ] y ′ ∧ dir ( y ′ ) ∧ y ′ [ ∅ ] r ∃ y · resolve ( r , cwd , q / f , y ) ∧ r . = r ′ q ∃ x noresolve ( r , cwd , q ) ∧ r . = r ′ (dir) Error ∃ x · resolve ( r , cwd , q , x ) ∧¬ dir ( x ) ∧ r . = r ′ 6
Example Specification: mkdir q/f ∃ x , x ′ , y ′ · resolve ( r , cwd , q , x ) ∧ dir ( x ) ∧ x [ f ] ↑ Success ∧ similar ( r , r ′ , cwd , q , x , x ′ ) ∧ x ∼ { f } x ′ ∧ dir ( x ′ ) ∧ x ′ [ f ] y ′ ∧ dir ( y ′ ) ∧ y ′ [ ∅ ] r ∃ y · resolve ( r , cwd , q / f , y ) ∧ r . = r ′ q ∃ x noresolve ( r , cwd , q ) ∧ r . = r ′ (dir) Error f ∃ x · resolve ( r , cwd , q , x ) ∧¬ dir ( x ) ∧ r . ⊥ = r ′ 6
Recommend
More recommend
