Example of a formal flow violation
Jonathan K. Millen · 2005
The confinement problem is how to constrain untrusted software in such a way that information made available to it is not passed along to unauthorized indi viduals. One type of attack on this problem is to have the supervisor or operating system control all memory accesses according to a suitable policy. The security kernel is that part of an operating system or supervisor whose correctness is supposed to be sufficient for the desired protection.