Mind the Heap: Preventing Capability Leakage Across CHERI Compartments

CAPability Warding by Automatically Restricting Dereference. Artifact for Mind the Heap: Preventing Capability Propagation Across CHERI Compartments. CHERI's library compartmentalization isolates code, but not the heap: a pointer handed across a compartment boundary remains a fully dereferenceable capability, so a compromised compartment can read and write any object it has ever been given. CAPWARD closes that gap automatically. It analyses a program's LLVM IR to find every struct type shared across a compartment boundary, decides which of them the non-owning compartment never actually dereferences, and rewrites the IR to seal those pointers with CHERI hardware seal/unseal operations at the boundary. A sealed capability can be stored and passed around but not dereferenced, so a pointer that leaks into a compromised compartment is inert there. The repository contains the analysis and instrumentation toolchain, the orchestration needed to apply it to real applications, the Rocq formalization, and the measurements reported in the paper.