Proofcraft has completed the security proofs for seL4 on AArch64, providing a formal mathematical proof that the kernel enforces confidentiality, integrity, and functional correctness [1]. This milestone ensures that the kernel prevents an application running on top of seL4 from learning information without authorization, modifying data without permission, and guarantees the correctness of the kernel's behavior [2]. The completion of these proofs is a significant step towards reducing the reliance on verification experts for new platform ports and expanding the set of supported configuration parameters [3]. The seL4 proofs target strong properties, such as functional correctness and explicit security theorems, which are unrivaled in the industry [4].
With this achievement, seL4 provides strong security guarantees for applications running on AArch64, making it an attractive option for systems requiring high security and reliability. The security theorem statements provide requirements on how the system must be set up, such as isolated components not being given write access to each other, and confidentiality holding between security domains of seL4's domain scheduler [5]. The seL4 proof stack has been continuously maintained and grown, providing a high degree of strong evidence for security and correct functionality [6]. However, as with all proofs, there are still assumptions that must be met, and there may still be user expectations on kernel behavior that are not captured by the properties proved so far [7].
Sources
- Proofcraft News - 2026: seL4 security proofs now complete on AArch64
- seL4 Proofs | seL4: System initialisation
- Development Roadmap | seL4: Verification of AArch64 port
- seL4 Proofs | seL4: How Strong are the Proofs?
- seL4 Proofs | seL4: System initialisation
- seL4 Proofs | seL4: How Strong are the Proofs?
- seL4 Proofs | seL4: How Strong are the Proofs?
