Coccinelle: Tool support for automated CERT C Secure Coding Standard certification

Mads Chr. Olesen 1 René Rydhof Hansen 1 Julia L. Lawall 2 Nicolas Palix 3
2 Whisper - Well Honed Infrastructure Software for Programming Environments and Runtimes
LIP6 - Laboratoire d'Informatique de Paris 6, Inria Paris-Rocquencourt
3 Erods
LIG - Laboratoire d'Informatique de Grenoble, UJF - Université Joseph Fourier - Grenoble 1
Abstract : Writing correct C programs is well-known to be hard, not least due to the many low-level language features intrinsic to C. Writing secure C programs is even harder and, at times, seemingly impossible. To improve this situation the US CERT has developed and published a set of coding standards, the “CERT C Secure Coding Standard”, that (currently) enumerates 122 rules and 180 recommendations, with the aim of making C programs (more) secure. The large number of rules and recommendations makes automated tool support essential for certifying that a given system complies with the standard.In this paper, we report on ongoing work on adapting the Coccinelle bug-finder and program transformation tool, into a tool for analysing and certifying C programs according to, e.g., the CERT C Secure Coding Standard or the MISRA (the Motor Industry Software Reliability Association) C standard. We argue that such a tool must be highly adaptable and customisable to each software project as well as to the certification rules required by a given standard.Furthermore, we present current work on integrating Clang (the LLVM C front-end) as a program analysis component into Coccinelle. Program analysis information, e.g., from data-flow or pointer analysis, is necessary both for more precise compliance checking, i.e., with fewer false positives, and also for enabling more complete checking, i.e., with fewer false negatives, e.g., resulting from pointer aliasing.
Type de document :
Article dans une revue
Science of Computer Programming, Elsevier, 2014, Special Issue on Selected Contributions from the Open Source Software Certification (OpenCert) Workshops, 91 (B), pp.141-160. 〈http://www.sciencedirect.com/science/article/pii/S0167642312002031?np=y〉
Liste complète des métadonnées

https://hal.inria.fr/hal-01096185
Contributeur : Julia Lawall <>
Soumis le : mardi 16 décembre 2014 - 23:01:34
Dernière modification le : jeudi 11 janvier 2018 - 06:27:08

Identifiants

  • HAL Id : hal-01096185, version 1

Collections

Citation

Mads Chr. Olesen, René Rydhof Hansen, Julia L. Lawall, Nicolas Palix. Coccinelle: Tool support for automated CERT C Secure Coding Standard certification. Science of Computer Programming, Elsevier, 2014, Special Issue on Selected Contributions from the Open Source Software Certification (OpenCert) Workshops, 91 (B), pp.141-160. 〈http://www.sciencedirect.com/science/article/pii/S0167642312002031?np=y〉. 〈hal-01096185〉

Partager

Métriques

Consultations de la notice

204