A generic Priv instance that works for all Labels and confers no downgrading privileges.

Returns the current value of the thread's label.

If the current label is oldLabel and the current clearance is clearance, this function allows code to raise the label to any value newLabel such that oldLabel `leq` newLabel && newLabel `leq` clearance. Note that there is no setLabel variant without the ...P because the taint function provides essentially the same functionality that setLabel would.

Returns the current value of the thread's clearance.

Reduce the current clearance. One cannot raise the current label or create object with labels higher than the current clearance.

Raise the current clearance (undoing the effects of lowerClr). This requires privileges.

Lowers the clearance of a computation, then restores the clearance to its previous value. Useful to wrap around a computation if you want to be sure you can catch exceptions thrown by it. Also useful to wrap around toLabeled to ensure that the computation does not access data exceeding a particular label. If withClearance is given a label that can't flow to the current clearance, then the clearance is lowered to the greatest lower bound of the label supplied and the current clearance.

Note that if the computation inside withClearance acquires any Privs, it may still be able to raise its clearance above the supplied argument using lowerClrP.

Use taint l in trusted code before observing an object labeled l. This will raise the current label to a value l' such that l `leq` l', or throw LerrClearance if l' would have to be higher than the current clearance.

Like taint, but use privileges to reduce the amount of taint required. Note that unlike setLabelP, taintP will never lower the current label. It simply uses privileges to avoid raising the label as high as taint would raise it.

Use wguard l in trusted code before modifying an object labeled l. If l' is the current label, then this function ensures that l' `leq` l before doing the same thing as taint l. Throws LerrHigh if the current label l' is too high.

Like wguard, but takes privilege argument to be more permissive.

Ensures the label argument is between the current IO label and current IO clearance. Use this function in code that allocates objects--untrusted code shouldn't be able to create an object labeled l unless aguard l does not throw an exception.

Like aguardP, but takes privilege argument to be more permissive.

Labeled is a type representing labeled data.

Function to construct an Labeled from a label and pure value. If the current label is lcurrent and the current clearance is ccurrent, then the label l specified must satisfy lcurrent `leq` l && l `leq` ccurrent.

Constructs an Labeled using privilege to allow the Labeled's label to be below the current label. If the current label is lcurrent and the current clearance is ccurrent, then the privilege p and label l specified must satisfy (leqp p lcurrent l) && l `leq` ccurrent. Note that privilege is not used to bypass the clearance. You must use lowerClrP to raise the clearance first if you wish to create an Labeled at a higher label than the current clearance.

Within the LIO monad, this function takes an Labeled and returns the value. Thus, in the LIO monad one can say:

 x <- unlabel (xv :: Labeled SomeLabelType Int)

And now it is possible to use the value of x, which is the pure value of what was stored in xv. Of course, unlabel also raises the current label. If raising the label would exceed the current clearance, then unlabel throws LerrClearance. However, you can use labelOf to check if unlabel will suceed without throwing an exception.

Extracts the value of an Labeled just like unlabel, but takes a privilege argument to minimize the amount the current label must be raised. Will still throw LerrClearance under the same circumstances as unlabel.

toLabeled is the dual of unlabel. It allows one to invoke computations that would raise the current label, but without actually raising the label. Instead, the result of the computation is packaged into a Labeled with a supplied label. Thus, to get at the result of the computation one will have to call unlabel and raise the label, but this can be postponed, or done inside some other call to toLabeled. This suggestst that the provided label must be above the current label and below the current clearance.

Note that toLabeled always restores the clearance to whatever it was when it was invoked, regardless of what occured in the computation producing the value of the Labeled. This higlights one main use of clearance: to ensure that a Labeled computed does not exceed a particular label.

Executes a computation that would raise the current label, but discards the result so as to keep the label the same. Used when one only cares about the side effects of a computation. For instance, if log_handle is an LHandle with a high label, one can execute

   discard ltop $ hputStrLn log_handle "Log message"

to create a log message without affecting the current label. (Of course, if log_handle is closed and this throws an exception, it may not be possible to catch the exception within the LIO monad without sufficient privileges--see catchP.)

Returns label of a Label type.

Raises the label of a Labeled to the lub of it's current label and the value supplied. The label supplied must be less than the current clarance, though the resulting label may not be if the Labeled is already above the current thread's clearance.

MonadCatch is the class used to generalize the standard IO catch and throwIO functions to methods that can be defined in multiple monads.

Catches an exception, so long as the label at the point where the exception was thrown can flow to the label at which catchP is invoked, modulo the privileges specified. Note that the handler receives an an extra first argument (before the exception), which is the label when the exception was thrown.

Version of catchP with arguments swapped.

onException cannot run its handler if the label was raised in the computation that threw the exception. This variant allows privileges to be supplied, so as to catch exceptions thrown with a raised label.

Like standard bracket, but with privileges to downgrade exception.

Evaluate in LIO.

Produces an IO computation that will execute a particular LIO computation. Because untrusted code cannot execute IO computations, this function should only be useful within trusted code. No harm is done from exposing the evalLIO symbol to untrusted code. (In general, untrusted code is free to produce IO computations--it just can't execute them without access to ioTCB.)

Execute an LIO action.

It would be a security issue to make certain objects a member of the Show class, but nonetheless it is useful to be able to examine such objects from within the debugger. The showTCB method can be used to examine such objects.

It is useful to have the dual of ShowTCB, ReadTCB, that allows for the reading of Labeleds that were written using showTCB. Only readTCB (corresponding to read) and readsPrecTCB (corresponding to readsPrec) are implemented.

PrivTCB is a method-less class whose only purpose is to be unavailable to unprivileged code. Since (PrivTCB t) => is in the context of class Priv and unprivileged code cannot create new instances of the PrivTCB class, this ensures unprivileged code cannot create new instances of the Priv class either, even though the symbol Priv is exported by LIO.Base and visible to untrusted code.

Extracts the value from an Labeled, discarding the label and any protection.

Set the current label to anything, with no security check.

Set the current clearance to anything, with no security check.

Returns label-specific state of the LIO monad. This is the data specified as the second argument of evalLIO, whose type is s in the monad LIO l s.

Sets the label-specific state of the LIO monad. See getTCB.

Lifts an IO computation into the LIO monad. Note that exceptions thrown within the IO computation cannot directly be caught within the LIO computation. Thus, if you are not inside a rethrowTCB block, you will generally want to use rtioTCB instead of ioTCB.

Lifts an IO computation into the LIO monad. If the IO computation throws an exception, it labels the exception with the current label so that the exception can be caught with catch or catchP. This function's name stands for "re-throw io", because the functionality is a combination of rethrowTCB and ioTCB. Effectively

   rtioTCB = rethrowTCB . ioTCB

Privileged code that does IO operations may cause exceptions that should be caught by untrusted code in the LIO monad. Such operations should be wrapped by rethrowTCB (or rtioTCB, which uses rethrowTCB) to ensure the exception is labeled. Note that it is very important that the computation executed inside rethrowTCB not in any way change the label, as otherwise rethrowTCB would put the wrong label on the exception.

For privileged code that needs to catch all exceptions in some cleanup function. Note that for the LIO monad, these methods do not call rethrowTCB to label the exceptions. It is assumed that you will use rtioTCB instead of ioTCB for IO within the computation arguments of these methods.

Generate a fresh state to pass runLIO when invoking it for the first time.

Execute an LIO action.