Before revision: Rules for these two events are defined as follows: Assignment: Γ(x) = τ1, Γ ⊢ a : τ2 Γ ⊢ x := a : τ1 cmd , where the following condition must hold: τ2 ⊑ τ1 Conditional test: Γ ⊢ t : τ, Γ ⊢ S1 : τ1 cmd, Γ ⊢ S2 : τ2 cmd Γ ⊢ if t then S1 else S2: τ1 ⊓ τ2 cmd , where the following condition must hold: τ ⊑ τ1, τ2 Applying this to the simple program we introduced above yields: 3 Γ(y) = {A} Γ(x) = {A,B} cmd, Γ ⊢ 0 : {A,B} Γ(x) = {A,B} cmd, Γ ⊢ 1 : {A,B} 2 Γ ⊢ y = 1 : {A} Γ ⊢ x := 0 : {A,B} cmd Γ ⊢ x := 1 : {A,B} cmd 1 Γ ⊢ if y = 1 then x := 0 else x := 1 : Not typeable The type system detects the policy violation in line 2, where a read operation of security class {A} is performed, followed by two write operations of a less strict security class {A,B}.
After revision: Rules for these two events are defined as follows: Assignment: Γ(x) = τ1, Γ ⊢ a : τ2 Γ ⊢ x := a : τ1 cmd , where the following condition must hold: τ2 ⊑ τ1 Conditional test: Γ ⊢ t : τ, Γ ⊢ S1 : τ1 cmd, Γ ⊢ S2 : τ2 cmd Γ ⊢ if t then S1 else S2: τ1 ⊓ τ2 cmd , where the following condition must hold: τ ⊑ τ1, τ2 Applying this to the simple program introduced above yields: 3 Γ(y) = {A} Γ(x) = {A,B} cmd, Γ ⊢ 0 : {A,B} Γ(x) = {A,B} cmd, Γ ⊢ 1 : {A,B} 2 Γ ⊢ y = 1 : {A} Γ ⊢ x := 0 : {A,B} cmd Γ ⊢ x := 1 : {A,B} cmd 1 Γ ⊢ if y = 1 then x := 0 else x := 1 : Not typeable The type system detects the policy violation in line 2, where a read operation of security class {A} is performed, followed by two write operations of a less strict security class {A,B}.