Documentation
DY
.
Label
.
Labels
Search
return to top
source
Imports
Init
DY.Label.Basic
DY.Trace.Basic
DY.Trace.Invariant
Imported by
DY
.
Label
.
pub
DY
.
Label
.
pubIsCorrupt
DY
.
canFlowPubEqIsCorrupt
DY
.
Label
.
pubCanFlow
DY
.
Label
.
secret
DY
.
Label
.
secretIsCorrupt
DY
.
Label
.
secret
.
canFlow
DY
.
Label
.
join
DY
.
Label
.
joinIsCorrupt
DY
.
Label
.
meet
DY
.
Label
.
meetIsCorrupt
DY
.
Label
.
meetEq
DY
.
Label
.
joinEq
DY
.
Label
.
joinCanFlowLeft
DY
.
Label
.
joinCanFlowRight
DY
.
Label
.
join_pub_left
DY
.
Label
.
join_pub_right
DY
.
Label
.
join_commutes
source
def
DY
.
Label
.
pub
[
ExecTraceTypes
]
:
Label
Equations
DY.Label.pub
=
{
isCorrupt
:=
fun (
tr
:
DY.ExecTrace
) =>
True
,
isCorruptLater
:=
⋯
}
Instances For
source
@[simp]
theorem
DY
.
Label
.
pubIsCorrupt
[
ExecTraceTypes
]
(
tr
:
ExecTrace
)
:
pub
.
isCorrupt
tr
source
theorem
DY
.
canFlowPubEqIsCorrupt
[
ExecTraceTypes
]
(
l
:
Label
)
(
tr
:
ExecTrace
)
:
l
.
isCorrupt
tr
=
l
.
canFlow
Label.pub
tr
source
theorem
DY
.
Label
.
pubCanFlow
[
ExecTraceTypes
]
(
l
:
Label
)
(
tr
:
ExecTrace
)
:
pub
.
canFlow
l
tr
source
def
DY
.
Label
.
secret
[
ExecTraceTypes
]
:
Label
Equations
DY.Label.secret
=
{
isCorrupt
:=
fun (
tr
:
DY.ExecTrace
) =>
False
,
isCorruptLater
:=
⋯
}
Instances For
source
@[simp]
theorem
DY
.
Label
.
secretIsCorrupt
[
ExecTraceTypes
]
(
tr
:
ExecTrace
)
:
¬
secret
.
isCorrupt
tr
source
theorem
DY
.
Label
.
secret
.
canFlow
[
ExecTraceTypes
]
(
l
:
Label
)
(
tr
:
ExecTrace
)
:
l
.
canFlow
secret
tr
source
def
DY
.
Label
.
join
[
ExecTraceTypes
]
(
l1
l2
:
Label
)
:
Label
Equations
l1
.
join
l2
=
{
isCorrupt
:=
fun (
tr
:
DY.ExecTrace
) =>
l1
.
isCorrupt
tr
∨
l2
.
isCorrupt
tr
,
isCorruptLater
:=
⋯
}
Instances For
source
@[simp]
theorem
DY
.
Label
.
joinIsCorrupt
[
ExecTraceTypes
]
(
l1
l2
:
Label
)
(
tr
:
ExecTrace
)
:
(
l1
.
join
l2
)
.
isCorrupt
tr
=
(
l1
.
isCorrupt
tr
∨
l2
.
isCorrupt
tr
)
source
def
DY
.
Label
.
meet
[
ExecTraceTypes
]
(
l1
l2
:
Label
)
:
Label
Equations
l1
.
meet
l2
=
{
isCorrupt
:=
fun (
tr
:
DY.ExecTrace
) =>
l1
.
isCorrupt
tr
∧
l2
.
isCorrupt
tr
,
isCorruptLater
:=
⋯
}
Instances For
source
@[simp]
theorem
DY
.
Label
.
meetIsCorrupt
[
ExecTraceTypes
]
(
l1
l2
:
Label
)
(
tr
:
ExecTrace
)
:
(
l1
.
meet
l2
)
.
isCorrupt
tr
=
(
l1
.
isCorrupt
tr
∧
l2
.
isCorrupt
tr
)
source
theorem
DY
.
Label
.
meetEq
[
ExecTraceTypes
]
(
l1
l2
l3
:
Label
)
(
tr
:
ExecTrace
)
:
(
l1
.
meet
l2
)
.
canFlow
l3
tr
=
(
l1
.
canFlow
l3
tr
∧
l2
.
canFlow
l3
tr
)
source
theorem
DY
.
Label
.
joinEq
[
ExecTraceTypes
]
(
l1
l2
l3
:
Label
)
(
tr
:
ExecTrace
)
:
l1
.
canFlow
(
l2
.
join
l3
)
tr
=
(
l1
.
canFlow
l2
tr
∧
l1
.
canFlow
l3
tr
)
source
theorem
DY
.
Label
.
joinCanFlowLeft
[
ExecTraceTypes
]
(
l1
l2
:
Label
)
(
tr
:
ExecTrace
)
:
(
l1
.
join
l2
)
.
canFlow
l1
tr
source
theorem
DY
.
Label
.
joinCanFlowRight
[
ExecTraceTypes
]
(
l1
l2
:
Label
)
(
tr
:
ExecTrace
)
:
(
l1
.
join
l2
)
.
canFlow
l2
tr
source
theorem
DY
.
Label
.
join_pub_left
[
ExecTraceTypes
]
(
l
:
Label
)
:
pub
.
join
l
=
pub
source
theorem
DY
.
Label
.
join_pub_right
[
ExecTraceTypes
]
(
l
:
Label
)
:
l
.
join
pub
=
pub
source
theorem
DY
.
Label
.
join_commutes
[
ExecTraceTypes
]
(
l1
l2
:
Label
)
:
l1
.
join
l2
=
l2
.
join
l1