SAM - Revision history

ThomasLeonard: /* Example */

ThomasLeonard — Fri, 18 Nov 2011 12:02:12 GMT

Example

New page

The [http://serscis.eu/sam/ SERSCIS Access Modeller] (SAM) takes a model of a system (e.g. a set of objects within a computer program or a set of machines on a network) and attempts to verify certain security properties about the system, by exploring all the ways access can propagate through the system. For example, it could prove that a web-server's logs can never be deleted except by the logging system or the administrator.

It is designed to handle dynamic systems (e.g. systems containing factories which may create new objects at runtime) and systems where behaviour of some of the objects is unknown or not trusted.

It is greatly inspired by [[Scollar]], but extends it by:

* Using a Java-like syntax for expressing behaviour, which is hopefully more natural for programmers.
* Considering multiple contexts (e.g. so that objects created by a factory for client A can be kept separate from objects created by the same factory for client B).

SAM is Open Source.

== Example ==

This factory.sam file defines known/trusted behaviour for a Factory and then sets up a scenario where the factory has two clients (objects with references to the factory). The clients and the Task objects created by the factory all have unknown behaviour, but are assumed to be running on a capability platform (and therefore confined):

/* Behaviour */

class Factory {
public Task newInstance() {
Task task = new Task();
return task;
}
}

config {
Factory factory;

setup {
factory = new Factory();
}

test "A" {
Object clientA = new Unknown(factory);
}

test "Other" {
Object otherClients = new Unknown(factory);
}
}

Processing this file with sam ('''sam factory.sam''') produces this graph showing the limits of how these objects may become connected:

[[Image:sam-factory.png]]

This shows that the tasks created by clientA (aggregated as aTask) may get access to and invoke the factory. However, clientA cannot get access to any of the other clients or their tasks.

[[Category:Formal Reasoning]]

ThomasLeonard at 08:40, 15 June 2011

ThomasLeonard — Wed, 15 Jun 2011 08:40:02 GMT

←Older revision		Revision as of 08:40, 15 June 2011
Line 40:		Line 40:

	This shows that the tasks created by clientA (aggregated as aTask) may get access to and invoke the factory. However, clientA cannot get access to any of the other clients or their tasks.		This shows that the tasks created by clientA (aggregated as aTask) may get access to and invoke the factory. However, clientA cannot get access to any of the other clients or their tasks.
		+
		+	[[Category:Formal Reasoning]]

ThomasLeonard: /* Example */

ThomasLeonard — Wed, 15 Jun 2011 08:39:20 GMT

Example

←Older revision		Revision as of 08:39, 15 June 2011
Line 25:		Line 25:
	/* Config */		/* Config */

-	initialObject("clientA", "~~Unknown~~").	+	initialObject("clientA", "Client").
-	initialObject("otherClients", "~~Unknown~~").	+	initialObject("otherClients", "Client").
	initialObject("factory", "Factory").		initialObject("factory", "Factory").

Line 38:		Line 38:

	[[Image:sam-factory.png]]		[[Image:sam-factory.png]]
		+
		+	This shows that the tasks created by clientA (aggregated as aTask) may get access to and invoke the factory. However, clientA cannot get access to any of the other clients or their tasks.

ThomasLeonard at 08:36, 15 June 2011

ThomasLeonard — Wed, 15 Jun 2011 08:36:52 GMT

←Older revision		Revision as of 08:36, 15 June 2011
Line 9:		Line 9:

	SAM is Open Source.		SAM is Open Source.
		+
		+	== Example ==
		+
		+	This factory.sam file defines known/trusted behaviour for a Factory and then sets up a scenario where the factory has two clients (objects with references to the factory). The clients and the Task objects created by the factory all have unknown behaviour, but are assumed to be running on a capability platform (and therefore confined):
		+
		+	/* Behaviour */
		+
		+	class Factory {
		+	public Task newInstance() {
		+	Task task = new Task();
		+	return task;
		+	}
		+	}
		+
		+	/* Config */
		+
		+	initialObject("clientA", "Unknown").
		+	initialObject("otherClients", "Unknown").
		+	initialObject("factory", "Factory").
		+
		+	field("clientA", "ref", "factory").
		+	field("otherClients", "ref", "factory").
		+
		+	initialInvocation("clientA", "a").
		+	initialInvocation("otherClients", "other").
		+
		+	Processing this file with sam ('''sam factory.sam''') produces this graph showing the limits of how these objects may become connected:
		+
		+	[[Image:sam-factory.png]]

ThomasLeonard at 08:32, 15 June 2011

ThomasLeonard — Wed, 15 Jun 2011 08:32:24 GMT

←Older revision		Revision as of 08:32, 15 June 2011
Line 9:		Line 9:

	SAM is Open Source.		SAM is Open Source.
-
-	~~== Example ==~~
-
-	This factory.sam file defines known/trusted behaviour for a Factory and then sets up a scenario where the factory has two clients (objects with references to the factory). The clients and the Task objects created by the factory all have unknown behaviour, but are assumed to be running on a capability platform (and therefore confined):
-
-	~~/* Behaviour */~~
-
-	~~class Factory {~~
-	~~public Task newInstance() {~~
-	~~Task task = new Task();~~
-	~~return task;~~
-	}
-	}
-
-	~~config {~~
-	~~Factory factory;~~
-
-	~~setup {~~
-	~~factory = new Factory();~~
-	}
-
-	~~test "A" {~~
-	~~Object clientA = new Unknown(factory);~~
-	}
-
-	~~test "Other" {~~
-	~~Object otherClients = new Unknown(factory);~~
-	}
-	}
-
-	~~Processing this file with sam ('''sam factory.sam''') produces this graph showing the limits of how these objects may become connected:~~
-
-	~~[[Image:sam-factory.png]]~~
-
-	~~This shows that the tasks created by clientA (aggregated as aTask) may get access to and invoke the factory. However, clientA cannot get access to any of the other clients or their tasks.~~
-
-	~~[[Category:Formal Reasoning]]~~