A Formally Verified Interpreter for a Shell-Like Programming Language

Abstract

The shell language is widely used for various system administration tasks on UNIX machines, as for instance as part of the installation process of software packages in FOSS distributions. Our mid-term goal is to analyze these scripts as part of an ongoing effort to use formal methods for the quality assurance of software distributions, to prove their correctness, or to pinpoint bugs. However, the syntax and semantics of POSIX shell are particularly treacherous. We propose a new language called CoLiS which, on the one hand, has well-defined static semantics and avoids some of the pitfalls of the shell, and, on the other hand, is close enough to the shell to be the target of an automated translation of the scripts in our corpus. The language has been designed so that it will be possible to compile automatically a large number of shell scripts into the CoLiS language. We formally define its syntax and semantics in Why3, define an interpreter for the language in the WhyML programming language, and present an automated proof in the Why3 proof environment of soundness and completeness of our interpreter with respect to the formal semantics. This work has been partially supported by the ANR project CoLiS, contract number ANR-15-CE25-0001.

Ghost Code in Action: Automated Verification of a Symbolic Interpreter

“…Indeed, we believe the complexity of symbolic execution tools for complex languages relies more on the complexity of data, which must be handled by the constraints and not the symbolic engine itself. Second, as a matter of fact, we recently finish to transfer the correctness properties and proof techniques developed in this article to the CoLiS language [8]. The CoLiS language is an intermediate language for a subset of the POSIX shell language with formally defined and easily understandable semantics.…”

Analysing installation scenarios of Debian packages

“…The CoLiS language. It was first presented in 2017 [23]. Its design aims to avoid some pitfalls of the shell, and to make explicit the dangerous constructions we cannot eliminate.…”

“…For this case study, we improved the language proposed formerly [23] to increase the number of analysed Debian maintainer scripts. First, we added a number of constructs to the language.…”

“…First, we added a number of constructs to the language. Second, we provide a formal semantics for the new constructs and we align the previous semantics [23] to the one of the Posix shell for a few other constructs. These changes and a complete description of the current CoLiS language are described in a technical report [6].…”

“…Its formal specifications (preconditions and post-conditions) state the soundness of the interpreter, i.e., that any result corresponds to the formal semantics with unbounded number of loop iterations and unbounded nested function calls. The specifications are checked using automated theorem provers [23].…”