battleship

Safe HaskellTrustworthy

Sys

Contents

Description

This trusted module is Trustworthy, and so may be used by Safe modules. It defines the type DCMVar of labeled, mutable variables whose labels come from DCLabel. It also defined the type of labeled IO/TCP handles, Handle. It defines wrappers for a number of IO functions. It defines functions for issuing fatal error messages and exception handling. And it defines functions for testing if LIO guards would succeed.

Synopsis

Types

type DCMVar a = LMVar DCLabel a

LMVar specialized to DCLabel.

type Handle = LObj DCLabel Handle

The LIO version of a IO/TCP handle: a labeled object whose value has type Handle.

Wrappers for IO Functions

hPutChar :: Handle -> Char -> DC ()

The LIO analogue of hPutChar. Will raise the current label to the handle's label; raises an exception if this isn't possible.

hPutCharP :: DCPriv -> Handle -> Char -> DC ()

The version of hPutChar that uses a privilege to limit the raising of the current label: the goal is for the current label and the handle's label to be equal, modulo the privilege.

hPutStr :: Handle -> String -> DC ()

The LIO analogue of hPutStr. Will raise the current label to the handle's label; raises an exception if this isn't possible.

hPutStrP :: DCPriv -> Handle -> String -> DC ()

The version of hPutStr that uses a privilege to limit the raising of the current label: the goal is for the current label and the handle's label to be equal, modulo the privilege.

hPutStrLn :: Handle -> String -> DC ()

The LIO analogue of hPutStrLn. Will raise the current label to the handle's label; raises an exception if this isn't possible.

hPutStrLnP :: DCPriv -> Handle -> String -> DC ()

The version of hPutStrLn that uses a privilege to limit the raising of the current label: the goal is for the current label and the handle's label to be equal, modulo the privilege.

hGetChar :: Handle -> DC Char

The LIO analogue of hGetChar. Will raise the current label to the handle's label; raises an exception if this isn't possible.

hGetCharP :: DCPriv -> Handle -> DC Char

The version of hGetChar that uses a privilege to limit the raising of the current label: the goal is for the current label and the handle's label to be equal, modulo the privilege.

hGetLine :: Handle -> DC String

The LIO analogue of hGetLine. Will raise the current label to the handle's label; raises an exception if this isn't possible.

hGetLineP :: DCPriv -> Handle -> DC String

The version of hGetLine that uses a privilege to limit the raising of the current label: the goal is for the current label and the handle's label to be equal, modulo the privilege.

hSetBuffering :: Handle -> BufferMode -> DC ()

The LIO analogue of hSetBuffering. Will raise the current label to the handle's label; raises an exception if this isn't possible.

hSetBufferingP :: DCPriv -> Handle -> BufferMode -> DC ()

The version of hSetBuffering that uses a privilege to limit the raising of the current label: the goal is for the current label and the handle's label to be equal, modulo the privilege.

hClose :: Handle -> DC ()

The LIO analogue of hClose. Will raise the current label to the handle's label; raises an exception if this isn't possible.

hCloseP :: DCPriv -> Handle -> DC ()

The version of hClose that uses a privilege to limit the raising of the current label: the goal is for the current label and the handle's label to be equal, modulo the privilege.

Fatal Error Messages and Exception Handling

fatal :: String -> String -> DC a

fatal comp msg returns a DC action that, when run, issues the error message msg, attributed to program component comp, on the standard output, and then causes the program to exit with failure status.

catchFatal :: String -> String -> String -> DC a -> DC a

catchFatal comp msgEx msgLab m returns a DC action that, when run, saves the current label and clearance, and then runs m. If running m raises an exception, then the DC action issues the error message msgEx, attributed to program component comp, on the standard output, and then causes the program to exit with failure status. Otherwise, if running m changed the current label or clearance, then the DC action issues the error message msgLab, attributed to program component comp, on the standard output, and then causes the program to exit with failure status. Otherwise, the DC action returns the value returned by m.

Functions for Testing if LIO Guards Would Succeed

guardAlloc_Check :: DCLabel -> DC Bool

guardAlloc_Check lab returns a DC action that tests whether guardAlloc lab would succeed, were it run.

guardWrite_Check :: DCLabel -> DC Bool

guardWrite_Check lab returns a DC action that tests whether guardWrite lab would succeed, were it run.

guardAllocP_Check :: DCPriv -> DCLabel -> DC Bool

guardAllocP_Check priv lab returns a DC action that tests whether guardAllocP priv lab would succeed, were it run.

guardWriteP_Check :: DCPriv -> DCLabel -> DC Bool

guardWriteP_Check priv lab returns a DC action that tests whether guardWriteP priv lab would succeed, were it run.