Symbolic Execution of Debian Packages Nicolas Jeannerod - - PowerPoint PPT Presentation

▶
symbolic execution of debian packages
SMART_READER_LITE
LIVE PREVIEW

Symbolic Execution of Debian Packages Nicolas Jeannerod - - PowerPoint PPT Presentation

Jun 06, 2023 202 likes •890 views

Symbolic Execution of Debian Packages Nicolas Jeannerod nicolas.jeannerod@irif.fr joint work with Benedikt Becker, Claude March Yann Rgis-Gianas, Mihaela Sighireanu, Ralf Treinen IRIF, Universit de Paris September 9, 2019 13th Alpine

slide-1
SLIDE 1

Symbolic Execution of Debian Packages

Nicolas Jeannerod nicolas.jeannerod@irif.fr

joint work with Benedikt Becker, Claude Marché Yann Régis-Gianas, Mihaela Sighireanu, Ralf Treinen

IRIF, Université de Paris

September 9, 2019

13th Alpine Verification Meeting

slide-2
SLIDE 2

1

Introduction

> CoLiS project: Correctness of Linux Scripts

slide-3
SLIDE 3

1

Introduction

> CoLiS project: Correctness of Linux Scripts > Goal: applying formal methods to the quality

assessment of Debian Packages.

slide-4
SLIDE 4

1

Introduction

> CoLiS project: Correctness of Linux Scripts > Goal: applying formal methods to the quality

assessment of Debian Packages.

> Debian: operating system. > Packages: way to provide (install, update, remove)

software.

slide-5
SLIDE 5

1

Introduction

> CoLiS project: Correctness of Linux Scripts > Goal: applying formal methods to the quality

assessment of Debian Packages.

> Debian: operating system. > Packages: way to provide (install, update, remove)

software.

> Goal (reformulated): making sure that

installing/updating/removing software does not:

> make other softwares unusable, > make the whole computer unusable, > remove your personnal files, > etc.

slide-6
SLIDE 6

2

Installing a Software on Debian

  • 1. Download the package.
slide-7
SLIDE 7

2

Installing a Software on Debian

  • 1. Download the package.
  • 2. Execute a pre-installation script.
slide-8
SLIDE 8

2

Installing a Software on Debian

  • 1. Download the package.
  • 2. Execute a pre-installation script.
  • 3. Unpack static archive.
slide-9
SLIDE 9

2

Installing a Software on Debian

  • 1. Download the package.
  • 2. Execute a pre-installation script.
  • 3. Unpack static archive.
  • 4. Execute a post-installation script.
slide-10
SLIDE 10

2

Installing a Software on Debian

  • 1. Download the package.
  • 2. Execute a pre-installation script.

> This is a POSIX shell script ran as administrator.

  • 3. Unpack static archive.
  • 4. Execute a post-installation script.

> This is a POSIX shell script ran as administrator.

slide-11
SLIDE 11

2

Installing a Software on Debian

  • 1. Download the package.
  • 2. Execute a pre-installation script.

> This is a POSIX shell script ran as administrator.

  • 3. Unpack static archive.
  • 4. Execute a post-installation script.

> This is a POSIX shell script ran as administrator.

POSIX shell:

> scripting language

slide-12
SLIDE 12

2

Installing a Software on Debian

  • 1. Download the package.
  • 2. Execute a pre-installation script.

> This is a POSIX shell script ran as administrator.

  • 3. Unpack static archive.
  • 4. Execute a post-installation script.

> This is a POSIX shell script ran as administrator.

POSIX shell:

> scripting language > legacy (born in 1971)

slide-13
SLIDE 13

2

Installing a Software on Debian

  • 1. Download the package.
  • 2. Execute a pre-installation script.

> This is a POSIX shell script ran as administrator.

  • 3. Unpack static archive.
  • 4. Execute a post-installation script.

> This is a POSIX shell script ran as administrator.

POSIX shell:

> scripting language > legacy (born in 1971)

Administrator:

> can do anything

  • n the system
slide-14
SLIDE 14

2

Installing a Software on Debian

  • 1. Download the package.
  • 2. Execute a pre-installation script.

> This is a POSIX shell script ran as administrator.

  • 3. Unpack static archive.
  • 4. Execute a post-installation script.

> This is a POSIX shell script ran as administrator.

POSIX shell:

> scripting language > legacy (born in 1971)

Administrator:

> can do anything

  • n the system

Complicated and dangerous

slide-15
SLIDE 15

2

Installing a Software on Debian

  • 1. Download the package.
  • 2. Execute a pre-installation script.

> This is a POSIX shell script ran as administrator.

  • 3. Unpack static archive.
  • 4. Execute a post-installation script.

> This is a POSIX shell script ran as administrator.

POSIX shell:

> scripting language > legacy (born in 1971)

Administrator:

> can do anything

  • n the system

Complicated and dangerous. Formal methods?

slide-16
SLIDE 16

3

Our Tools: An Overview

CoLiS Debian Package Report

slide-17
SLIDE 17

3

Our Tools: An Overview

CoLiS Debian Package Report Symbolic Engine Shell script Specification

  • f the script
slide-18
SLIDE 18

3

Our Tools: An Overview

CoLiS Debian Package Report Symbolic Engine Specification

  • f the script

Morbig, Morsmall and ColisFromShell S h e l l s c r i p t Colis inter. language

slide-19
SLIDE 19

3

Our Tools: An Overview

CoLiS Debian Package Report Symbolic Engine Specification

  • f the script

Morbig, Morsmall and ColisFromShell S h e l l s c r i p t Colis inter. language Specifications

  • f commands
slide-20
SLIDE 20

3

Our Tools: An Overview

CoLiS Debian Package Report Symbolic Engine Specification

  • f the script

Morbig, Morsmall and ColisFromShell S h e l l s c r i p t Colis inter. language Specifications

  • f commands

SAT solver for specifications SAT?

slide-21
SLIDE 21

3

Our Tools: An Overview

CoLiS Debian Package Report Symbolic Engine Specification

  • f the script

Morbig, Morsmall and ColisFromShell S h e l l s c r i p t Colis inter. language Specifications

  • f commands

SAT solver for specifications SAT?

  Régis-Gianas, J & Treinen SLE 2018     J, Marché & Treinen VSTTE 2017  

slide-22
SLIDE 22

Specifications, Feature Trees & Constraints

slide-23
SLIDE 23

4

Feature Trees

f g h f g h f g

> Unranked unordered trees;

slide-24
SLIDE 24

4

Feature Trees

f g h f g h f g

> Unranked unordered trees; > Good models for the UNIX filesystem;

slide-25
SLIDE 25

4

Feature Trees

f g h f g h f g

> Unranked unordered trees; > Good models for the UNIX filesystem; > Shell scripts can be seen as programs that modify

such trees;

slide-26
SLIDE 26

4

Feature Trees

f g h f g h f g

> Unranked unordered trees; > Good models for the UNIX filesystem; > Shell scripts can be seen as programs that modify

such trees;

> Constraints will express relations between such

trees.

slide-27
SLIDE 27

5

Constraints On Feature Trees

Atom (Informal) Semantics

slide-28
SLIDE 28

5

Constraints On Feature Trees

Atom (Informal) Semantics x[f ]y From x’s tree, through f , we go to y’s tree x[f ]↑ In x’s tree, there is no f Ax The root of x’s tree has decoration A

    Aït-Kaci Podelski & Smolka 1992    

slide-29
SLIDE 29

5

Constraints On Feature Trees

Atom (Informal) Semantics x[f ]y From x’s tree, through f , we go to y’s tree x[f ]↑ In x’s tree, there is no f Ax The root of x’s tree has decoration A x[F] x’s tree can also use features in F

    Aït-Kaci Podelski & Smolka 1992       Smolka & Treinen 1994  

slide-30
SLIDE 30

5

Constraints On Feature Trees

Atom (Informal) Semantics x[f ]y From x’s tree, through f , we go to y’s tree x[f ]↑ In x’s tree, there is no f Ax The root of x’s tree has decoration A x[F] x’s tree can also use features in F x ∼F y x and y’s trees are similar except in F

    Aït-Kaci Podelski & Smolka 1992       Smolka & Treinen 1994  

slide-31
SLIDE 31

6

Example Specification: mkdir q/f

∃x, x′, y′· resolve(r, cwd, q, x) ∧ dir(x) ∧ x[f ]↑ ∧ similar(r, r′, cwd, q, x, x′) ∧ x ∼{f } x′ ∧ dir(x′) ∧ x′[f ]y′ ∧ dir(y′) ∧ y′[∅] Success ∃y · resolve(r, cwd, q/f , y) ∧ r . = r′ noresolve(r, cwd, q) ∧ r . = r′ ∃x·resolve(r, cwd, q, x)∧¬dir(x)∧r . = r′ Error

slide-32
SLIDE 32

6

Example Specification: mkdir q/f

∃x, x′, y′· resolve(r, cwd, q, x) ∧ dir(x) ∧ x[f ]↑ ∧ similar(r, r′, cwd, q, x, x′) ∧ x ∼{f } x′ ∧ dir(x′) ∧ x′[f ]y′ ∧ dir(y′) ∧ y′[∅] Success ∃y · resolve(r, cwd, q/f , y) ∧ r . = r′ noresolve(r, cwd, q) ∧ r . = r′ ∃x·resolve(r, cwd, q, x)∧¬dir(x)∧r . = r′ Error

slide-33
SLIDE 33

6

Example Specification: mkdir q/f

∃x, x′, y′· resolve(r, cwd, q, x) ∧ dir(x) ∧ x[f ]↑ ∧ similar(r, r′, cwd, q, x, x′) ∧ x ∼{f } x′ ∧ dir(x′) ∧ x′[f ]y′ ∧ dir(y′) ∧ y′[∅] Success ∃y · resolve(r, cwd, q/f , y) ∧ r . = r′ noresolve(r, cwd, q) ∧ r . = r′ ∃x·resolve(r, cwd, q, x)∧¬dir(x)∧r . = r′ Error r ∃x q

slide-34
SLIDE 34

6

Example Specification: mkdir q/f

∃x, x′, y′· resolve(r, cwd, q, x) ∧ dir(x) ∧ x[f ]↑ ∧ similar(r, r′, cwd, q, x, x′) ∧ x ∼{f } x′ ∧ dir(x′) ∧ x′[f ]y′ ∧ dir(y′) ∧ y′[∅] Success ∃y · resolve(r, cwd, q/f , y) ∧ r . = r′ noresolve(r, cwd, q) ∧ r . = r′ ∃x·resolve(r, cwd, q, x)∧¬dir(x)∧r . = r′ Error r ∃x

(dir)

q

slide-35
SLIDE 35

6

Example Specification: mkdir q/f

∃x, x′, y′· resolve(r, cwd, q, x) ∧ dir(x) ∧ x[f ]↑ ∧ similar(r, r′, cwd, q, x, x′) ∧ x ∼{f } x′ ∧ dir(x′) ∧ x′[f ]y′ ∧ dir(y′) ∧ y′[∅] Success ∃y · resolve(r, cwd, q/f , y) ∧ r . = r′ noresolve(r, cwd, q) ∧ r . = r′ ∃x·resolve(r, cwd, q, x)∧¬dir(x)∧r . = r′ Error r ∃x

(dir)

q ⊥ f

slide-36
SLIDE 36

6

Example Specification: mkdir q/f

∃x, x′, y′· resolve(r, cwd, q, x) ∧ dir(x) ∧ x[f ]↑ ∧ similar(r, r′, cwd, q, x, x′) ∧ x ∼{f } x′ ∧ dir(x′) ∧ x′[f ]y′ ∧ dir(y′) ∧ y′[∅] Success ∃y · resolve(r, cwd, q/f , y) ∧ r . = r′ noresolve(r, cwd, q) ∧ r . = r′ ∃x·resolve(r, cwd, q, x)∧¬dir(x)∧r . = r′ Error r ∃x

(dir)

q ⊥ f r′ ∃x′ q ∼{q}

slide-37
SLIDE 37

6

Example Specification: mkdir q/f

∃x, x′, y′· resolve(r, cwd, q, x) ∧ dir(x) ∧ x[f ]↑ ∧ similar(r, r′, cwd, q, x, x′) ∧ x ∼{f } x′ ∧ dir(x′) ∧ x′[f ]y′ ∧ dir(y′) ∧ y′[∅] Success ∃y · resolve(r, cwd, q/f , y) ∧ r . = r′ noresolve(r, cwd, q) ∧ r . = r′ ∃x·resolve(r, cwd, q, x)∧¬dir(x)∧r . = r′ Error r ∃x

(dir)

q ⊥ f r′ ∃x′ q ∼{q} ∼{f }

slide-38
SLIDE 38

6

Example Specification: mkdir q/f

∃x, x′, y′· resolve(r, cwd, q, x) ∧ dir(x) ∧ x[f ]↑ ∧ similar(r, r′, cwd, q, x, x′) ∧ x ∼{f } x′ ∧ dir(x′) ∧ x′[f ]y′ ∧ dir(y′) ∧ y′[∅] Success ∃y · resolve(r, cwd, q/f , y) ∧ r . = r′ noresolve(r, cwd, q) ∧ r . = r′ ∃x·resolve(r, cwd, q, x)∧¬dir(x)∧r . = r′ Error r ∃x

(dir)

q ⊥ f r′ ∃x′

(dir)

q ∼{q} ∼{f }

slide-39
SLIDE 39

6

Example Specification: mkdir q/f

∃x, x′, y′· resolve(r, cwd, q, x) ∧ dir(x) ∧ x[f ]↑ ∧ similar(r, r′, cwd, q, x, x′) ∧ x ∼{f } x′ ∧ dir(x′) ∧ x′[f ]y′ ∧ dir(y′) ∧ y′[∅] Success ∃y · resolve(r, cwd, q/f , y) ∧ r . = r′ noresolve(r, cwd, q) ∧ r . = r′ ∃x·resolve(r, cwd, q, x)∧¬dir(x)∧r . = r′ Error r ∃x

(dir)

q ⊥ f r′ ∃x′

(dir)

q ∼{q} ∼{f } ∃y′ f

slide-40
SLIDE 40

6

Example Specification: mkdir q/f

∃x, x′, y′· resolve(r, cwd, q, x) ∧ dir(x) ∧ x[f ]↑ ∧ similar(r, r′, cwd, q, x, x′) ∧ x ∼{f } x′ ∧ dir(x′) ∧ x′[f ]y′ ∧ dir(y′) ∧ y′[∅] Success ∃y · resolve(r, cwd, q/f , y) ∧ r . = r′ noresolve(r, cwd, q) ∧ r . = r′ ∃x·resolve(r, cwd, q, x)∧¬dir(x)∧r . = r′ Error r ∃x

(dir)

q ⊥ f r′ ∃x′

(dir)

q ∼{q} ∼{f } ∃y′

(empty dir)

f

slide-41
SLIDE 41

Symbolic Execution

slide-42
SLIDE 42

7

Symbolic Execution

if [ -e foo ]; then rm foo fi

slide-43
SLIDE 43

7

Symbolic Execution

if [ -e foo ]; then rm foo fi In progress r

slide-44
SLIDE 44

7

Symbolic Execution

if [ -e foo ]; then rm foo fi Case 1 Success r = r′ ⊥ foo In progress r x foo

slide-45
SLIDE 45

7

Symbolic Execution

if [ -e foo ]; then rm foo fi Case 1 Success r = r′ ⊥ foo Case 2 Success r x

(¬dir)

foo r′ ⊥ foo ∼foo Case 3 Error r = r′ x

(dir)

foo

slide-46
SLIDE 46

8

Chaining Specifications

mkdir /usr/lib ; mkdir /usr/lib/foo

slide-47
SLIDE 47

8

Chaining Specifications

mkdir /usr/lib ; mkdir /usr/lib/foo r1 x1 ⊥ usr lib r′

1

x′

1

y′

1[∅]

usr lib ∼{usr} ∼{lib}

slide-48
SLIDE 48

8

Chaining Specifications

mkdir /usr/lib ; mkdir /usr/lib/foo r1 x1 ⊥ usr lib r′

1

x′

1

y′

1[∅]

usr lib ∼{usr} ∼{lib} r2 x2 y2 ⊥ usr lib foo r′

2

x′

2

y′

2

z′

2[∅]

usr lib foo ∼{usr} ∼{lib} ∼{foo}

slide-49
SLIDE 49

8

Chaining Specifications

mkdir /usr/lib ; mkdir /usr/lib/foo r1 x1 ⊥ usr lib r′

1

x′

1

y′

1[∅]

usr lib ∼{usr} ∼{lib} r2 x2 y2 ⊥ usr lib foo r′

2

x′

2

y′

2

z′

2[∅]

usr lib foo ∼{usr} ∼{lib} ∼{foo}

slide-50
SLIDE 50

8

Chaining Specifications

mkdir /usr/lib ; mkdir /usr/lib/foo r1 x1 ⊥ usr lib x′

1

y′

1[∅]

lib ∼{lib} x2 y2 ⊥ lib foo r′

2

x′

2

y′

2

z′

2[∅]

usr lib foo ∼{lib} ∼{foo} r12 ∼{usr} ∼{usr} usr usr

slide-51
SLIDE 51

8

Chaining Specifications

mkdir /usr/lib ; mkdir /usr/lib/foo r1 x1 ⊥ usr lib y′

1[∅]

y2 ⊥ foo r′

2

x′

2

y′

2

z′

2[∅]

usr lib foo ∼{foo} r12 ∼{usr} ∼{usr} x12 usr ∼{lib} ∼{lib} lib lib

slide-52
SLIDE 52

8

Chaining Specifications

mkdir /usr/lib ; mkdir /usr/lib/foo r1 x1 ⊥ usr lib r′

2

x′

2

y′

2

z′

2[∅]

usr lib foo r12 ∼{usr} ∼{usr} x12 usr ∼{lib} ∼{lib} y12[∅] lib ∼{foo}

slide-53
SLIDE 53

8

Chaining Specifications

mkdir /usr/lib ; mkdir /usr/lib/foo r1 x1 ⊥ usr lib r′

2

x′

2

y′

2

z′

2[∅]

usr lib foo r12 ∼{usr} ∼{usr} x12 usr ∼{lib} ∼{lib} y12[∅] lib ∼{foo} ∼{usr} ∼{lib}

slide-54
SLIDE 54

8

Chaining Specifications

mkdir /usr/lib ; mkdir /usr/lib/foo r1 x1 ⊥ usr lib r′

2

x′

2

y′

2[{foo}]

z′

2[∅]

usr lib foo r12 ∼{usr} ∼{usr} x12 usr ∼{lib} ∼{lib} y12[∅] lib ∼{foo} ∼{usr} ∼{lib}

slide-55
SLIDE 55

8

Chaining Specifications

mkdir /usr/lib ; mkdir /usr/lib/foo r1 x1 ⊥ usr lib r′

2

x′

2

y′

2[{foo}]

z′

2[∅]

usr lib foo ∼{usr} ∼{lib}

[J & Treinen, IJCAR 2018]

slide-56
SLIDE 56

Demo

slide-57
SLIDE 57

9

Package Report

slide-58
SLIDE 58

10

Installation Scenario

slide-59
SLIDE 59

11

An Other Scenario

slide-60
SLIDE 60

12

An Execution Case

slide-61
SLIDE 61

13

The postrm Script

slide-62
SLIDE 62

Conclusion

slide-63
SLIDE 63

14

Conclusion

> Demo report accessible from my website:

http://nicolas.jeannerod.fr/

slide-64
SLIDE 64

14

Conclusion

> Demo report accessible from my website:

http://nicolas.jeannerod.fr/

> CoLiS project: Correctness of Linux Script. > Webpage: http://colis.irif.fr/ > Tools: https://github.com/colis-anr/

slide-65
SLIDE 65

14

Conclusion

> Demo report accessible from my website:

http://nicolas.jeannerod.fr/

> CoLiS project: Correctness of Linux Script. > Webpage: http://colis.irif.fr/ > Tools: https://github.com/colis-anr/ > So far, 148 bugs found and reported to Debian; > Several talks at DebConf;

The Debian maintainers are very enthusiastic!

slide-66
SLIDE 66

14

Conclusion

> Demo report accessible from my website:

http://nicolas.jeannerod.fr/

> CoLiS project: Correctness of Linux Script. > Webpage: http://colis.irif.fr/ > Tools: https://github.com/colis-anr/ > So far, 148 bugs found and reported to Debian; > Several talks at DebConf;

The Debian maintainers are very enthusiastic!

> Future work: support more packages > Support more shell constructs, > Add more command specifications, > Improve the constraint solver;

slide-67
SLIDE 67

14

Conclusion

> Demo report accessible from my website:

http://nicolas.jeannerod.fr/

> CoLiS project: Correctness of Linux Script. > Webpage: http://colis.irif.fr/ > Tools: https://github.com/colis-anr/ > So far, 148 bugs found and reported to Debian; > Several talks at DebConf;

The Debian maintainers are very enthusiastic!

> Future work: support more packages > Support more shell constructs, > Add more command specifications, > Improve the constraint solver; > Thank you for your attention!