Pieter Bevelander
email: pieter.bevelander@mah.se

Jonas Otterbeck
email: jonas.otterbeck@mah.se

Keywords: Islamophobia, Attitudes, Racism, Youth, Culturalization, Ethnic Minorities Islamophobia, Attitudes, Racism, Youth, Culturalization, Ethnic Minorities

With the use of multiple regression technique, the principal objective of this study is to clarify and examine young people's attitudes towards Muslims, and the relationships between these attitudes and a large number of background factors. We use a representative sample of 9,498 non-Muslim youths between 15-19 years of age. The main results show that when controlling for several background variables simultaneously, the country of birth, socio-economic background and school/program factors all have an effect on the attitude towards Muslims. Moreover, socio-psychological factors, the relationship to friends and the perceptions of gender role patterns are found to be important. In addition, local factors like high levels of unemployment, high shares of immigrants in a local environment also have an effect. No differences in the attitudes of boys and girls were found. Further, the study establishes a correlation between negative attitudes and right-wing populist seats in local government.

Introduction

The Swedish Muslim population increased substantially during the last quarter of the 20 th century. Although Sweden has no statistical records by religion, it is estimated that the number of individuals with a Muslim background has increased from a couple of families in the 1950s, via approximately 100,000 at the end of 1980s, to approximately 400,000 individuals in 2007. 1 The majority has come to Sweden as refugees or as family to refugees, only a small part as labour migrants. There is also an increasing Swedish born Muslim population. Approximately one third of the Muslim population is of school age or younger (Anwar, Blaschke and Sander 2004).

To become integrated into another society, economically, socially, politically and culturally takes time. To evaluate and translate prior educational credentials and labour market experience can be a long process. For some, economic integration has gone better than for others. Bosnians, generally having a Muslim background, is one of the immigrant groups in Sweden with highest labour market attachment despite a relatively short stay in the country. For immigrants from Iraq, mainly Muslims, on the contrary, we find low employment rates (Bevelander and Lundh 2007). It is obvious that Muslims are not a homogeneous group in Sweden. Rather, the Muslim population have diverse backgrounds when it comes to ethnicity, citizenship, educational history, class, etc, but Muslims are often ethnified, i.e. turned into an ethnic group and ascribed a homogeneous culture (Roy 2004). Strong evidence suggests that especially Muslims are perceived as a religiously distinct group by non-Muslims in Sweden. To be categorised as religiously different can create barriers and aggravate daily life and can lead to lower chances in the housing-and labour market [START_REF] Carlsson | Evidence of ethnic discrimination in the Swedish labour market using experimental data[END_REF]. Sometimes structures in laws, (Otterbeck 2004), for example regarding religious rules on slaughter of animals or religious education. At the same time the Swedish society slowly adapt to the demographic changes in an ongoing process (Otterbeck and Bevelander 2006).

Due to this new demographic situation and to the rising discussions about racism and Islamophobia, the Living History Forum and the Crime Preventing Board in Sweden conducted a major questionnaire resulting in a report (Intolerans 2004). The empirical material was rich and complex and it was decided that a second wave of analyses was to be conducted. This article is one of the results of that effort.

The main aim of this article is to study the attitudes of non-Muslim youth in Sweden on Muslims. Furthermore, since few studies have been conducted in a more explorative way, this study will explore to what extend these attitudes could be explained

Theory and earlier research

A number of theoretical propositions have been brought forward to explain the mechanisms behind negative or positive attitudes towards others and more extreme variations of this like xenophobia, racism and Islamophobia. Below, some crucial theoretical concepts which stem from the individual level, the group level or the societal level is given, followed by an account of some studies with focus on attitudes towards Muslims. One of the most well known studies focusing on individual prerequisites and characteristics is [START_REF] Adorno | The Authoritarian Personality[END_REF]. This study connects the so called authoritarian personality to anti-democratic behaviour combined with anti-Semitism, ethnocentrism, etc. A more recent variation of this theory was proposed by Tajfel who developed the so called social identity theory (Tajfel 1982). It presents the idea that ethnocentrism, negative attitudes and discrimination is based on the tendency individuals have to categorize themselves in so called 'in ' and 'out' groups. This in turn depends on a deeper need to get or uphold status which can be achieved by comparing in-and out-groups. The more an individual identifies with his/her in-group, the stronger negative attitude he/she will have to an out-group. However, this theory does not explain divergence in attitudes between different out-groups (for example different immigrant or ethnic groups). Neither does it explain why certain individuals systematically have a higher negative attitude than others.

Studies of youth active in right wing movements or, at least, circles, tend to stress that these youths long to identify with a strong in-group excluding out-groups members in harsh ways. These youths tend to have a long history of failure in school, have parents with lower education than average, tend to feel alienated by the middle class ideals governing schools and tend to object to these ideals in a countercultural way (Intolerans 2004).

Group and societal level

A more sociological explanatory concept is the so called realistic conflict theory which stresses real conflicts of interests between groups and competition for scarce resources like education, employment and housing (Sherif 1966). A development of this theory is the so called power-threat-hypothesis. According to this, a negative attitude towards certain groups is due to that these groups are seen as economic competitors and challenge the social and political power of another [START_REF] Blalock | Toward a Theory of Minority-Group Relations[END_REF]. A more socio-ecological variation emphasizes the environment individuals live in and is more or less a variation of the power-threat-hypothesis. A feeling of threat increases with immigration of new groups. These groups become more visible which diminishes the social distance to the majority. When the symbolic dominance is felt to be threatened, racism and negative attitudes flourish. For example, visibly religious otherness might be perceived as a threat (McLaren 2003).

A variant of the above is called defended neighbourhoods theory which states that a fear of losing ones identity increases with a faster pace of change in neighbourhood composition (Dustmann, Fabbri and Preston 2004). Finally, and in contrast to the rather 2004), according to Allport's contact hypothesis attitudes towards other groups are more positive when contacts between groups increase, especially when individuals have the same socio-economic background and try to obtain the same goals [START_REF] Allport | JOCHEN and ÅKE SANDER 2004 State Policies Towards Muslim Minorities: Sweden, Great Britain and Germany, Berlin: Edition Parabolis BALIBAR, ÉTIENNE 2002 'Finns det en "nyrasism[END_REF]. This theory has generated much discussion and suggestions about the kind and the quality of the contact needed if a positive result is to be gained. Researchers tend to agree that especially having friends among the ones who are constructed as the other, tend to be strongly associated with positive attitudes (McLaren 2003).

Structural level

Another set of theories is based on a more structural understanding of prejudices and racism. The theories attempt to uncover how economic, political and social power over states and institutions (re)produce discursive orders, benefits and resources along ethnic, racial, cultural, religious or other lines, securing the power position of a presumed elite (see for example Integrationens svarta bok 2006). These theories often focus on how cultures (and religions) are essentialised, seen as separate from each other, and finally are ordered in hierarchies (Fredrickson 2002). A common trait is that theories on racism today often stress the focus put on culture, rather than race, and how culture is made the functional equivalent of race in the sense that it becomes inherent in the individual classified as belonging to a specific culture (Balibar 2002;Solomos and Back 1999).

These orders, at times invisible but always present, saturate public discourse and are manifested in stereotypes, jokes, popular culture but also in laws, politics, and discrimination on the labour and housing market. The orders often have long histories and are in the West European and North American case more often than not connected with the colonial period. Thus, while the studies above focus on personal characteristics or interpersonal relations, these theories focus on well spread discourses and power relations with a long history.

Attitudes to Islam and Muslims

Earlier quantitative research on attitudes towards Islam and Muslims in Sweden is primarily on the adult population. The first study was done in 1990 by Hvitfelt (1991).

He found that almost 65 per cent of the population was fairly to very negative towards Islam. 88 per cent was of the opinion that the Islamic religion was incompatible with the democratic system and 62 per cent had the view that the religion led to female repression.

Finally, 53 per cent were of the opinion that the immigration of Muslims should be reduced. Hvitfelt's study makes use of bivariate analysis but refrains from theoretical explanations apart from vague references to negative stereotypes in media and studies on prejudice. The conclusion is that higher education, female sex and younger age generally leads to a higher degree of positive attitudes of Islam, but that even the more positive were rather negative. However, this study was performed in connection with a period, the late 1980s, in which the non-European immigration had increased dramatically which affected the discussion about Muslims. For example, certain members of the new right wing populist political party, New Democrats (Ny Demokrati), claimed the increased number of Muslims were a threat against Swedish culture and prosperity.

Later studies are mainly commissioned by the Swedish Integration Board (Integrationsverket). The Integration Barometer (2005 and[START_REF] Cattacin | Monitoring misanthrophy and rightwing extremist attitudes in Switzerland, an explorative study[END_REF], studied the attitudes of This study also measured an age effect: the younger the respondents, the more positive towards Muslims and Islam. One question is similar to Hvitfelt's study. In The Integration Barometer 39 per cent (2005) and 37 per cent (2006) of the respondents think that Muslim immigration should be restricted, compared to 53 in Hvitfelt's. Otherwise, most questions in The Integration Barometer are about Muslims rather than about Islam as in Hvitfelt's. This seems to have the effect that the attitudes are not as harsh. It is also possible that the population has grown more accustomed to Muslims during the 15 years that has passed between the questionnaires and that this might have had an effect. The results of the Swedish studies on attitudes are largely in line with those found in Germany and Switzerland. The theoretical base of The Integration Barometer primarily stems from Wilhelm Heitmeyer's research, Deutsche Zustände (2002, 2003, 2004 and 2005). These studies operate with ideas on social dominance similar to the meso-level theories mentioned above and also with theories on authoritarian personalities. Heitmeyer found that men had a less positive attitude towards Muslims than women. Furthermore, a more negative attitude was measured with increased age and a more positive with increased education. Political affiliation showed that individuals more to the right had less positive attitude than those more to the left, who were more positive. Higher levels of unemployment and a larger share of immigrants living in the different states were correlated with a less positive attitude towards Muslims. In the latest 9 study a difference between 'east' and 'west' Germany is observed, with a more negative attitude towards Muslims by people living in 'west'. In addition, it shows that individuals that are more affected by social dominance, e.g. the feeling that one's existence is becoming less secure by the settlement of others, are less positive to Muslims. Finally, individuals with authoritarian perceptions also held slightly more negative attitudes to Muslims than others. For Switzerland, [START_REF] Cattacin | Monitoring misanthrophy and rightwing extremist attitudes in Switzerland, an explorative study[END_REF] found that approximately 30 per cent of the population had Islamophobic attitudes, which is slightly higher than for Germany (20-25 per cent). Moreover, Cattacin's study found little correlation between Islamophobia and racism, xenophobia and anti-Semitism.

To our knowledge only one study for the Netherlands focussing on youth and attitudes towards Muslims and Islam is conducted (Dekker, van der Noll and Capelos 2007). In this study, 581 students in the age of 14-16 were asked about their opinions about Islam and Muslims, but also about individuals of Turkish and Moroccan descent. 10 study showed that young people generally had rather positive attitudes. Only 5 per cent had negative attitudes, out of which 1.7 per cent was extremely negative. When it comes to attitudes specifically towards Muslims, 8 per cent had negative attitudes. Moreover, this study also tried to link a number of background factors with a so called intolerance measure. Cross tabulations showed that individuals with more negative attitudes towards Muslims were for example: boys, youth having parents with lower socio-economic background, youngsters that are enrolled in lower level educational programs, young people living in the country side and those born in Sweden. Like earlier studies this study did not make use of more sophisticated statistical methods. The design of the questionnaire is however thoroughly based in micro and meso-level theories on attitudes with clear references to Heitmeyer's study and to Scandinavian studies on racist and prejudiced attitudes of youth.

Other studies have discussed the representation of Islam. According to a number of research reports, youth in Sweden live in a media climate that is not particular sympathetic towards Islam. For example, the news, popular culture and textbooks are often being accused of superficial portrayals of Islam (Berg 1998;Hvitfelt 1998;Otterbeck 2005;Kamali 2006). In brief, when Islam is seen as something negative (which is not always the case) it is presented as a threat, uniform, undemocratic, patriarchal and different.

The above discussed societal factors, an increasing population with a Muslim background and the relatively slow economic integration process of some Muslim groups, a relatively negative media climate on Muslims and Islam, as well as the fact that

Data, model and method

The data used is based on classroom questionnaire performed during the month of December 2003 among pupils in the two highest levels of primary school and the three following levels at upper secondary schools. 2 The individuals that answered the questionnaire are pupils between the ages 15-19. Cluster sampling on the total population in these ages was used to have an equal number of primary and secondary schools as well as having schools from different parts of the country. The total sample consists of 230 schools, 762 classes and 13,898 individuals. Classes that would not be in the study as well as internal drop out left us with a basic material that comprises a representative sample of 10,599 individuals. This is approximately 2 per cent of the total population in these age categories in Sweden. Of these, 565 individuals have indicated that they are Muslims and are therefore excluded from the analyses. An internal reduction of 536 individuals who have not answered all questions used in this analysis, does that the material for our analysis comprises 9,498 individuals, 5,680 girls and 4,818 boys. 3 The dependent variable is a constructed attitudinal scale or index based on eight separate statements indicating a more positive or negative attitude towards Muslims. In appendix I these separate statements are given as well as the means, percentages for the five answering alternatives and standard deviations for girls and boys. The answering alternatives on these statements were: yes, this is correct; this is relatively correct; unsure/doesn't know; this is rather incorrect; no, this is incorrect. Since a large 12 correlation in the answers between the statements could be measured, an attitude index is made. 4 The index is constructed so that an increasing level indicates a more positive attitude towards Muslims.

The independent variables 5 are based on the questions asked in the questionnaire and to a large extent formulated in line with the earlier discussed theoretical propositions at the individual, group and societal level. Some of these questions are dealing with demographic characteristics like age, gender and country of birth, whereas others are connected to the socio-economic background of the respondents. In this case the socioeconomic status of the parents, split in eight categories, was used, if the individual lives in a single-parent family or not and if one or both parents were unemployed were used as indicators for socioeconomic background. According to earlier studies and the above mentioned theories, we expect that increased age, being a girl, being born outside Sweden and having a higher socio-economic background is correlated with a more positive attitude towards Muslims. If one or both parents are unemployed and if the adolescent lives in a single parent household should lead to economic stress in the family and is expected to have a negative effect on the attitude towards Muslims. Local and regional factors are primarily based on which municipality an individual lives in.

Moreover, this variable is categorized in various ways to 'catch' different aspects assumed to be connected to attitudes towards Muslims. This variable is categorized in type of municipality 6 , level of unemployment in municipality, share of foreign born population in municipality, the relative share of the manufacturing sector in the municipality and finally a dummy variable constructed on the basis of if a municipality had right wing populist mandates in local parliament or not. 7 The local and regional indicators are assumed to measure differences in regional and local context of the individual. Economic stress factors at this level and a more negative regional/local attitude towards immigrants in general is expected to be measured by these included variables. In other words, we expect a correlation between increased negative attitudes towards Muslims and the higher the unemployment rate is, the higher relative share of the manufacturing sector in the municipality is, as well as the higher the percentage of immigrants living in the municipality is. Individuals living in municipalities with a right wing mandate in local parliament are expected to be more negative towards Muslims.

School factors like how comfortable the pupil is at school and the respondent's grade level are included as index variables. The kind of program the respondent is following, categorized in four levels, is also integrated in the model. This variable is assumed to catch the effect of socioeconomic background on the level of attitudes towards Muslims.

Results of Multivariate analysis

In the following table (table 1) the results of three regressions are presented which include all background variables. The first regression shows the results for both girls and boys. Given that earlier studies showed a difference in attitudes towards Muslims by sex the second and third regression is for girls and boys separately. The results indicate that some variables have no statistical significant effect on the attitude towards Muslims by young people, whereas other variables show either positive or negative effects. In the following we discuss the results by variable group.

(Table 1 about here) Demographic factors: When it comes to age/grade the results of the regression for both girls and boys show few differences in effect of age/grade on the attitude towards Muslims. With the exception of those who attend the highest grade of secondary schooling (consequently also age) no significant effect could be measured on the attitude towards Muslims, which is in line with the means shown in the earlier section. However, the regressions for girls and boys separately show that for boys attending the second year of secondary schooling, a significant positive effect is measured. Girls attending the highest level of primary schooling have also a significant positive attitude towards

Socioeconomic factors:

While we assume a more stepwise, 'the higher, the more positive', connection between attitudes and socioeconomic background, the regressions presented in the table show that only pupils with parents having academic occupations have a more positive attitude towards Muslims. For all other occupations we find no statistically significant effect. Boys living in single parent families have a more negative attitude towards Muslims than those who live with both parents. For girls no significant effect of this variable could be measured.

Local and regional factors:

In earlier reports it is indicated that the more urban environment a person is living in, the more positive one is towards Muslims. As described in an earlier section, this study uses a different geographical division for region However, economic factors at the local level have a certain importance for young peoples' attitudes towards Muslims. Boys who live in municipalities with a relatively larger manufacturing sector, a higher level of unemployment and a higher share of immigrants living in the municipality, have a more negative attitude towards Muslims than boys who live in municipalities with the opposite conditions. One possible explanation for this result could be that a relative larger manufacturing sector exposed for competition is related to larger business cycle variation and fluctuations in unemployment. One interpretation could be that some boys in these municipalities blame this situation on immigration in general and Muslims in particular. For girls we do not find significant results for these variables.

Finally, our categorization of municipalities into a binary variable wherein either a municipality has right wing populist political seats in local government or not, show that young people that live in municipalities where these parties have seats have more negative attitudes towards Muslims than young people living in municipalities without such seats. A possible explanation could be that the attitude towards Muslims by young Social psychological factors: Social psychological factors like restlessness and aggressiveness also affect the attitude towards Muslims of both girls and boys. This is in line with earlier research that has indicated that so called intolerant youth are more restless. It is most likely that these young people also have negative attitudes towards Muslims. A hypothetical explanation for the result that was found for 'increasing nervousness' and increasing positive attitude could be that this is a proxy for emotional sensitiveness and a more nuanced concept of reality, which in turn could lead to more positive attitudes towards those who are perceived as different.

Family factors: In the model also questions where included that measured the effect of degree of confidential communication with parents, parent knowledge about the recreational activities of their child and the reaction of parents on problematic behaviour of their children, on the attitude towards Muslims. According to the analysis, pupils with parents who reacted strongly on their problematic behaviour have a more positive attitude towards Muslims. Surprisingly we found the opposite signs for the other measurements. towards Muslims relative to if they have lees good relationships. This relation was not found for boys. One explanation for this could be that among boys 'good relationships' can be related to having company of 'intolerant groups of friends' (Intolerans 2004) which statistically is less likely for girls.

Feelings of exclusion from society:

The question on feelings of exclusion from society is based on the idea that attitudes to immigrants and minorities varies with the degree of trust to other human beings and is asked with the aim to measure to what extent pupils feel in-or excluded from society on a general level. The analysis shows that this variable has a significant effect on the attitude towards Muslims for both boys and girls.

The higher the feeling of exclusion, the more the negative attitude is measured.

Gender role patterns: Finally an index measuring gender roll patterns among

pupils is included in the model. The idea behind this inclusion is that the attitude towards Muslims could be influenced by 'gender role ideals' by both girls and boys. The results show that both boys and girls with more stereotypical, inflexible gender roll perceptions have a more negative attitude towards Muslims relative to those who have other perceptions about gender roles.

Summary and discussion

Earlier Swedish and international statistical studies on attitudes towards Muslims have This was an expected result in line with the analysis in the intolerance report ( 2004), theories on attitudes of right wing youth but also socio-psychological theories like Tajfel's (1982). Moreover, our analysis shows that individuals holding stereotypical understandings of gender and a negative perception of society have more negative attitudes to Muslims. Interestingly, and in contrast to bivariate analyses, no difference between girls and boys was measured. Robinson et al. (2001) suggested that attitudes were interconnected with socialization and parental practices, but also with successive maturity. In the present study, the socio-economic background of parents affected the attitude of youths. If the result from earlier studies of the adult population is taken into account -parents with less education and lower socio-economic statues are more likely to hold negative attitudes towards Muslims -it is to be expected that these youths' attitudes are in line with their parents' and that the prejudices are likely to be part of their socialization. The opposite situation also holds. The children of the ones with a higher socio-economic status and higher education generally have more positive attitudes. The age hypothesis is more difficult to confirm. We can not observe a successive increase in positive attitudes; rather, 21 no significant difference between the ones between the 8 th grade (about 14 years old) to the 2 nd grade of the gymnasium (17 years) can be measured. But in fact, the oldest respondents, the ones in 3 rd grade, have the most positive attitudes.

An interesting, significant result is that both girls and boys born outside of Sweden, and especially outside of Europe, have more positive attitudes to Muslims. The likeliness of knowing a Muslim increases if you live in immigrant dense areas. It's also possible that the joint experience of feeling excluded from the category 'Swedish' and being labeled immigrant can lead to solidarity and positive, inclusive attitudes. These interpretations are in line with the contact hypothesis stressing both general contact and common goals and experiences.

When analysing the results solely on an individual level, attitudes primarily depend on the social situation of the individual, his or hers psychic well-being and possibly on age. The results of our analysis further indicate a clear support for the contact hypothesis which is based on the idea that increased contact with the other induces more positive attitudes towards others. Taken all together, negative attitudes would then be caused by the life situation of the individual rather then by a specific Islamophobia. However, we argue for a need to take other possibilities into account for a more complex understanding.

At the group and societal level, measuring the general friend factors, we find a more ambiguous result. For girls, friend factors have a significant positive effect on the attitude towards Muslims. For boys we do not find an effect of this factor. This difference between the sexes could be due to that boys are more involved in so called intolerant groups of friends. Besides, we found that economic, political demographic factors are 22 important factors to explain the attitude towards Muslims, especially for boys. Increased number of immigrants and higher unemployment level correlates with a more negative attitude towards Muslims by boys and can be seen as threats to the status quo and increased competition for scarce economic resources in the area where one lives. This result supports the theoretical propositions of the power-threat hypothesis. We also find support for the idea that factors at the regional level, in this case right wing political ideas that have been translated into actual political parties and seats in the local government, correlate with young individuals attitudes towards Muslims. Also this is in line with the power-threat-hypothesis but more on a political level.

While the immediate reaction might be that these analyses are sufficient when explaining the attitudes, those who propose a structural analysis prefer to make additions to be able to answer questions like why specifically Muslims are targeted. There is a claim that negative discourses on Islam and Muslims are especially strong and that there is a widespread Islamophobia in Sweden reproduced in for example different kinds of media and popular culture. Why is this not visible in our study -or is it? The previous study on the same statistical material shows that the attitudes to Jews, homosexuals, Immigrants and Muslims are similar, albeit marginally harsher against Muslims (Intolerans 2004). In our analysis it is clear that it is the well adjusted children of the well educated and employed who are the most positive to Muslims. Could it be that they also hold a competence for expressing positive attitudes in questionnaires, thus concealing other forms of othering? According to Olivier Roy (2004) one of the principal misconceptions of Muslims is that Muslims are perceived as a group not a mere population with diverse interests. Ètienne Balibar (2002) further claims that a dominating

  other societal sectors cause religious minorities to get into difficult situations

  by a number of background factors (a) demographic factors, (b) socio-economic factors, (c) local/regional factors, (d) school factors, (e) psychosocial factors, (f) parental factors, (g) friend factors, (h) exclusion factors and (i) gender factors.

  Other theories concentrate on the development of attitudes in adolescence and concentrate on the personal development of the individual. Robinson et al. (2001) stress socialization and especially parental practices (not only verbal tolerance) and education for the development of a 'tolerant' mind. Further, young adolescents seem to be more negative towards those holding opposing beliefs than older adolescents who tend to be more open and understanding. At the same time individuals do not either hold positive or negative attitudes according to Robinson et al (2001), both attitudes coexist in all individuals. Rather, attitudes are situational.

  Dustmann et al. (

  with the use of a couple of indicators. These studies show that the ones who have a more positive attitude towards Muslims and Islam are women more than men, individuals living in large cities more than those living in smaller cities or the country side, and those with higher educated more than the ones with lower educated.

  54 per cent were negative towards Muslims. Lack of positive, direct contacts with Muslims was seen as the most important factor for this result. Other factors explaining the result were if the individuals held negative stereotypical ideas about Muslims, got negative messages by family and friends about Muslims, or had the conviction that Muslims and Islam were a threat to security. The only study for Sweden that has focused on attitudes on Muslims by young people is the already mention report Intolerance (Intolerans 2004). Using the same questionnaire as the present article, the Intolerance report tried to measure the attitudes of young people in Sweden towards Muslims, Jews, homosexuals and immigrants. Contrary to earlier studies and certainly compared to the study performed in 1990 by Hvitfelt, this

  have been undertaken on this subject, makes studies on the attitudes of the majority on the Muslim minority of great importance.

  According to earlier studies, these variables certainly have a strong connection to the socioeconomic background of the parents(Lange and Westin 1981). Moreover, social psychosocial indicators are all index questions and constitute the following: aggressiveness, restlessness, risk preference and nervousness. These factors are assumed to measure the individual psychosocial behaviour of the adolescents. The expectation is that the more aggressive, restless, risk preferable and nervous the individual is, a more negative attitude towards Muslims should be measured. Other indexes included in the model deal with parental factors which is assumed to measure contact between parents and adolescents. Here it is expected that a 'better' parent contact of the adolescent is connected to a more positive attitude towards Muslims. Friend factors are assumed to measure the influence of friends on behaviour. We measure general friend relations with this factor is assumed to measure the effect of friends on the attitude towards Muslims. Better friend relations in general are expected to be connected to a more positive attitude towards Muslims. Moreover, we also measure if the individuals know a Muslim (or Muslims) personally. This variable is assumed to measure a better knowledge about individuals having Islam as religion and we expect that those who know a Muslim are more positive towards Muslims than those who do not know a Muslim. To know (in Swedish 'att känna') is a broader category than to have as a friend. Still it is a neutral to positive expression when you state that you know someone, which is less likely to say of someone you dislike. Societal belonging at a general level is measured by inclusion of the question if the respondent has feelings of exclusion from society. It is expected that a higher belonging is correlated with a more positive attitude towards Muslims. Finally, gender role patterns are included and assumed to measure if attitudes towards gender role patterns are congruent with attitudes towards Muslims. It is expected that more traditional gender role patterns is connected to more negative attitudes towards Muslims if the attitude is based on a general xenophobia. But if it is rather based on specific stereotypes about Muslims and Islam generally including the idea of Muslim men and Islam as utterly misogynic and Muslim women as oppressed one ought to find a correlation between progressive attitudes to gender roles and a negative attitude toMuslims. 8 Many questions in the questionnaire that are included in the model are on an ordinal level and recoded to scales with the use of factor analysis. With the use of multiple regression technique, OLS, we estimate the effect of the various variables on the constructed index of attitudes towards Muslims. Variables based on constructed indexes The model presented in the analysis includes all variables presented earlier as well as a separate analysis for girls and boys.

  Sweden have a more positive attitude towards Muslims relative to boys born in Sweden. We also found that girls born outside of Europe have a more positive attitude towards Muslims than those born in Europe. Moreover, youth who knows a Muslim has a significantly more positive attitude towards Muslims relative to somebody who does not know a Muslim. Also, individuals born outside Sweden and especially those born in southern Europe and outside Europe know a Muslim far more often than individuals born in Sweden. A possible explanation for these results could be that young people from outside Europe to a larger extent are living in areas and attend schools with relatively more Muslims.Interestingly, the results indicate no difference in attitude towards Muslims between boys and girls. This is different from what was measured in the earlier discussed descriptive section. This result is mainly due to the inclusion of the variable stereotypical gender role ideas in the model.

  finds for boys no statistically significant difference in attitude towards Muslims by region of living. For girls however, we find an interesting difference with the cities Gothenburg and Malmoe on one side, and all other regions (including Stockholm), on the other. Girls in Gothenburg have a somewhat less positive attitude towards Muslims, while girls in Malmoe clearly have a more positive attitude. For the other regions, no statistical significant difference could be measured relative the reference category Stockholm.

  affected by other negative attitudes on immigrants and Muslims in the local community. School factors: School-and program factors are important explanatory factors for the attitude towards Muslims by the pupils. An increased individual grade is correlated with a more positive attitude towards Muslims. Pupils who attend the individual program (lowest), have a more negative attitude towards Muslims relative the other secondary programs. In line with earlier studies we also find a strong correlation between the occupational distribution of the parents and school performance of pupils.

  If girls have good relationships they have a more positive attitude

  included relatively few explanatory variables and used only basic statistical tools to measure variation in attitudes towards Muslims. The present study shows, with the use of multiple regression technique, that many variables have a significant, either positive or young people's attitude towards Muslims. Returning to the earlier studies and the theoretical considerations described initially, various propositions in these are supported by the results of the study. We have divided this discussion into three levels well aware of them overlapping each other.Starting at the individual level, we find that individual characteristics have important influence on the attitude towards others, in this case Muslims. Sociopsychological factors like aggressiveness and restlessness clearly influence held attitudes.

  racism is when cultural identity is ascribed to individuals and when group categories are closed, not allowing hybridity and transformation. Thus the mere fact that the questionnaire groups Muslims together as 'Muslims' helps the middle class to avoid exposing the foundation of their cultural assumptions, i.e. that Muslims are primarily different. Positive attitudes towards the other are a norm, but it helps to conceal the fact that at the bottom of that norm lays a political act of othering. This line of reasoning can not be tested with the help of our material but it would be interesting to design questionnaires taking these theoretical ideas into account.Concluding, our analysis shed some light on what factors seem to be relevant explaining the attitude towards Muslims by young people. Since these results are highly contextual and difficult to generalise we are careful in stating that the measured effects will last in different environments. Our recommendation is therefore increased future research, both comparative and longitudinal, that could confirm or refute our results. andVAN DER NOLL, JOLANDA and CAPELOS, TEREZA 2007 Islamofobie onder jongeren en de achtergronden daarvan, Mimeo, Universiteit Leiden, Departement Politieke Wetenschap DUSTMANN, C. and FABBRI, F. and PRESTON, I. 2004 Ethnic Concentration, Prejudice and Racial Harassment Towards Minorities in the UK FREDRICKSON, GEORGE M. 2002 Racism: A Short History, Princeton: Princeton UP HEITMEYER, WILHELM (ed.) 2002 Deutsche Zustände, Folge 1, Frankfurt am Main: Suhrkamp --(ed.) 2003 Deutsche Zustände, Folge 2, Frankfurt am Main: Suhrkamp --(ed.) 2005 Deutsche Zustände, Folge 3, Frankfurt am Main: Suhrkamp HEITMEYER, WILHELM and ZICK, ANDREAS 2004 'Anti-Semitism, Islamophobia and group-focused enmity in Germany' Research note at Institute for Interdisciplinary Research on conflict and Violence, University of Bielefeld HVITFELT, HÅKAN 1991 'Svenska attityder till islam' in S. Holmberg and L. Weibull (ed.) Politiska opinioner, SOM-undersökningen 1990, SOM-rapport 6, Gothenburg University --1998 'Den muslimska faran -om mediabilden av islam' in Y. Brune (ed.) Mörk magi i vita medier: svensk nyhetsjournalistik om invandrare, flyktingar och rasism, Stockholm: Carlssons Integrationens svarta bok: agenda för jämlikhet och social sammanhållning, En rapport om allmänhetens inställning till integration, mångfald och diskriminering 2003 och 2004, 2005. Integrationsverkets skriftserie V. Norrköping: Integrationsverket Integrationsbarometer 2005: En rapport om allmänhetens attityder, erfarenheter och kunskaper inom områdena integration, mångfald och diskriminering, 2006. Integrationsverkets rapportserie 2006:05. Norrköping: Integrationsverket Intolerans: Antisemitiska, homofobiska, islamofobiska och invandrarfientliga tendenser bland unga, 2004. Stockholm: Forum för Levande Historia and Brottsförebyggande Rådet KAMALI, MASOUD 2006 'Skolböcker och kognitiv andrafiering' in L. Sawyer and M. Kamali (eds) Utbildningens dilemma: Demokratiska ideal och andrefierande praxis, SOU 2006:40, Stockholm: Fritzes LANGE, ANDERS and WESTIN, CHARLES 1981 Etnisk diskriminering och social identitet: Forskningsöversikt och teoretisk analys, Stockholm: Liber/Publica MCLAREN, LAUREN 2003 'Anti-immigrant prejudice in Europe: contact, threat perception, and preferences for the exclusion of migrants' in Social Forces, vol. 81, no. 3, March OTTERBECK, JONAS 2004 'The legal status of Islamic minorities in Sweden' in R. Aluffi B.-P and G. Zincone (eds) The Legal Treatment of Islamic Minorities in Europe, Leuven: Peeters --2005 'What is reasonable to demand? Islam in Swedish textbooks' in Journal of Ethnic and Migration Studies, vol. 31, no. 4and BEVELANDER, PIETER 2006 Islamofobi: en studie av begreppet, ungdomars attityder och unga muslimer utsatthet, Stockholm: Forum för Levande Historia ROBINSON, JULIE and WITENBERG, RITVKA and SANSON, ANN 2001 'The socialisation of tolerance' in M. Augoustinos (ed.) Understanding Prejudice, Racism, and Social Conflict, London: Sage ROY, OLIVIER, 2004 Globalised Islam: The Search for a New Ummah, London: Hurst SHERIF, MUZAFER 1966 Group Conflict and Co-operation: Their Social Psychology, London: Routledge and Paul Kegan SOLOMOS, JOHN and BACK, LES 1999 Theories of Race & Racism: Reader, Florence, KY, USA: Routledge TAJFEL, HENRI 1982 'Social identity of inter-group relations', Annual Review of Psychology,

Page 11 of 35 URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk Ethnic and Racial Studies

	F o
	r
	P
	e e r
	R e v i e w
	O n
	l y

Table 1 : Adolescent attitudes towards Muslims. Multivariate regression.

 1 Reference categories for dummy variables in regression are girls, grade 8, Swedish born, unskilled worker and Stockholm.

	All	Girls	Boys

URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk

Adolescent attitudes towards young Muslims, Mean of index, Standard Deviation, and the percentage by answering category

  The answering alternatives on these statements were: yes, this is correct; this is relatively correct; unsure/doesn't know; this is rather incorrect; no, this is incorrect. For some statements we change the order For all statements hold, a higher mean, close to 4, implicate a more positive attitude towards Muslims.

	of answering. Page 31 of 35 Page 33 of 35 Page 35 of 35	Malmoe	Ethnic and Racial Studies Ethnic and Racial Studies Ethnic and Racial Studies				Page 30 of 35
		Other larger cities
		Medium sized cities
	Girls	Large municipalities
	Statement	Smaller municipalities	Mean St. Dev.	4	3	2	1	0
	Most Muslims are decent people… Country site	3,00	0.980		36,8 35,4 21,2 4,1	2,4
	It would be entirely okay to have a steady Muslim Unemployment level continuous	3,57	0.841		72,8 17,0 6,6	1,7	1,9
	(municipality) as a neighbour… Muslims in Sweden should have the right to build Mosques … There are far too many Muslims in Sweden… F o F o F o Share foreign born (municipality) continuous Size manufacturing sector continuous F o F o r r r (municipality) r r	2,56 2,54	1.352 1.286		33,6 21,2 25,2 7,4 12,7 32,9 16,5 31,5 10,0 9,1
	You can not trust a Muslim… It should be forbidden for Muslims to vote in P P P Right wing populist mandate in municipality No, Yes P P	3,02 3,37	1.090 1.031		46,9 18,4 27,0 4,6 66,9 11,5 16,3 2,3	2,9 3,1
	elections… Most immigrated Muslims are very likely law-abiding… Most Muslims only want to live on social e e r e e r e e r e e r e e r	2,67 2,41	1.074 1.158		29,2 34,2 25,3 7,1 23,2 20,6 36,4 13,9 6,0 4,2
	security… Boys Statement Most Muslims are decent people… It would be entirely okay to have a steady Muslim as a neighbour… Muslims in Sweden should have the right to build Mosques … R Mean St. Dev. 2,68 1.110 3,28 1.087 2,24 1.469 e v i e w R e v i e w R e v i e w R e v i e w R e v i e w	4 25,8 35,3 25,4 7,9 3 2 1 58,9 22,5 10,9 2,7 27,9 18,5 24,2 8,7 20,7 0 5,7 5,0
	There are far too many Muslims in Sweden… You can not trust a Muslim… It should be forbidden for Muslims to vote in	2,12 2,69 3,08	1.354 1.206 1.257	22,4 14,9 31,1 15,4 16,2 35,0 20,0 30,3 8,5 6,2 57,3 12,5 18,8 4,0 7,4 O n O n O n O n O n
	elections… Most immigrated Muslims are very likely law-	2,38	1.260		22,3 28,1 26,0 12,7 10,8 l y l y l y l y l y
	abiding…
	Most Muslims only want to live on social	2,03	1.294		17,7 16,8 31,5 18,7 15,3
	security…
									31 33 35

URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk

Ethnic and Racial Studies

URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk Ethnic and Racial Studies URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk

Ethnic and Racial Studies

Appendix II: Independent variables

2 The Swedish school system has 9 obligatory grades followed by a 3 year upper secondary school where students can choose between different programs.

3 The reduction of responses is higher with increased age and a possible explanation for this is that in higher grades students have less classroom lectures and more apprenticeship hours. Since increased age induced higher positive attitudes towards Muslims we probably slightly underestimate the positive attitude towards Muslims by the population. See also Intolerans (2004) for more on the initial questionnaire, method of selection, reduction of responses, etc. 4 The internal correlation is 0.90 measured as the Cronbach alfa coefficient which is on a satisfactory level.

Since some of the statements where stated in the opposite direction, we reversed the coding for all statements in the same direction.

5 See appendix II for overview. For construction of all indexes and the questions asked, these are available from the author upon request.

6 Available from author upon request. 8 Test for multicollinearity of both the variables feelings of social exclusion from society and gender role patterns gave a correlation of 0.23 and 0.44 respectively.


Tony Bourdier

Horatiu Cirstea

Mathieu Jaume

Hélène Kirchner

Formal Specification and Validation of Security Policies

We propose a formal framework for the specification and validation of security policies. To model a secured system, the evolution of security information in the system is described by transitions triggered by authorization requests and the policy is given by a set of rules describing the way the corresponding decisions are taken. Policy rules are constrained rewrite rules whose constraints are first-order formulas on finite domains, which provides enhanced expressive power compared to classical security policy specification approaches like the ones using Datalog, for example. Our specifications have an operational semantics based on transition and rewriting systems and are thus executable. This framework also provides a common formalism to define, compare and compose security systems and policies. We define transformations over secured systems in order to perform validation of classical security properties.

Introduction

When addressing the field of security policies in computer science, we are faced to multiple definitions of this concept, most often based on their purpose rather than on their behavior. For instance, in a very generic way, one can say that the purpose of a security policy is to define what it means to be secure for a system, an organization or another entity. With this point of view, security policies can be seen as special procedures that deliver authorizations to perform specific actions: for instance, they decide whether or not an access is granted, whether or not a transaction may be approved, possibly taking into account the history of transactions (e.g., on a bank account, the total amount of cash withdrawal during the month should not exceed a fixed amount), or priority considerations (e.g., an emergency call is always given priority).

The additional specificity of security policies is their reactive behaviour with respect to their execution environment: on one hand, a target system may query the policy for an authorization before performing specific accesses or transactions; on the other hand, the answers of the policy not only determine the way the corresponding action is handled in the system but can also modify the (security) information of the system and consequently subsequent executions. For example, a negative authorization from an ATM machine security policy due to an incorrect PIN not only prevents immediate money withdrawal but can also induce a (bad PIN) counter incrementation and lead to a permanent blocking of the corresponding account after a certain number of unsuccessful attempts. So, the security information could be seen as part of the target system but it is also intrinsic to the corresponding policy whose decisions strongly depend on it.

Our first contribution is to provide a framework which can be used to formalise separately the security system that manipulates all the security information used for producing the authorization decisions and the policy rules that compute the decisions. This separation is relevant not only for a conceptually clear specification and design, but also for the verification, comparison and composition of policies. In particular, this allows one to analyse separately properties related to the management of the security information (expressed as invariants of the security system) and properties related to the policy rules (consistency or completeness for example). A security system is formalised as a transition system whose states are generated by syntactic environments, and whose transitions are described by transition rules on environments. Each transition is triggered by an event which corresponds to an authorization given by the security policy. The policy is given as a set of rules describing the way the decisions are taken. Policy rules are constrained rewrite rules, whose constraints are first-order formulas solved in the current state of the transition system. According to the authorization, the transition rule may or may not apply. So, conceptually, the security policy restricts the possible transitions of the security system. Such specifications of security systems and policies have a well-understood operational semantics based on transition and rewriting systems and are thus executable.

Our second contribution is a transformation based approach which can be used to check generic security properties for security systems which have been independently designed. A security policy is often expected to fulfill a certain security property expressed on some entities, while it is dealing with a different set of entities. A typical example is given by access control policies designed for ensuring flow properties: such policies do not deal with information flow but only with objects containing information to be traced. Indeed, access control policies allow to grant or to revoke the rights for actives entities (the subjects) to access some passive entities (the objects), but cannot always control how the information is used once it has been accessed (there is no control on its propagation). Intuitively, a link is needed between "what you do" (the policy) and "what you want" (the goal for which the policy is designed). We formalize this link through a transformation of environments, whose aim is to translate an environment into another one dealing with the entities we are interested in. We can use, for example, such a link to define a flow-based interpretation of access control policies. This kind of transformations allow thus the validation of a property over a sys-tem even if the property is expressed in a different specification. In practice, this approach provides a way to reuse the same specification of a security property in order to analyse or to verify several policies and systems, thus showing the benefits of a library of generic security properties, dedicated to particular domains (like information flows) and that can be considered in several contexts. For example, it becomes possible to check the same information flow property expressed by a specification for several access control policies.

We first introduce some useful notions and notations in Section 2. Section 3 presents the different components of our specification framework: security signatures, environments, transition rules as well as security systems, policy rules, and secured systems. Section 4 addresses the validation point of view by defining environment transformations and illustrating the verification of security properties. In Section 5, we compare our approach with other works. Conclusion and future work are presented in Section 6.

Preliminaries

We assume the reader familiar with the standard notions of term rewriting, first order logic and Datalog. This section briefly recalls basic notions used in this paper; more details can be found in [START_REF] Hinman | Fundamentals of mathematical logic[END_REF] for logic considerations, in [START_REF] Baader | Term Rewriting and All That[END_REF] for rewriting considerations and in [START_REF] Ullman | Database and Knowledge -Base Systems[END_REF] for Datalog related notions.

A many-sorted signature Σ = (S, F, P) is given by a set of sorts S, a set of function symbols F and a set of predicate symbols P. A function symbol f with arity s 1 , . . . , s n ∈ S and co-arity s is written f :s 1 , . . . , s n → s. A predicate symbol p with arity s 1 , . . . , s n ∈ S is written p:s 1 , . . . , s n . Variables are also sorted and the notation x:s specifies that the variable x has sort s. We assume in this paper that all variables are ranging over finite sets. This condition can be relaxed under some conditions [START_REF] Ullman | Database and Knowledge -Base Systems[END_REF], especially for allowing built-in sorts such as integers. Given a set ζ extending a set of variables X (possibly empty) with constants sorted by S, the set of Σ-terms over ζ denoted by T s Σ,ζ is the smallest set containing elements of ζ of sort s and all the f (t 1 , . . . , t n ) such that f :s 1 , . . . ,

s n → s ∈ Σ and t i ∈ T s i Σ,ζ for i ∈ [1..n]. We write T s Σ instead of T s
Σ,∅ and the sort is omitted when not important in the context. We also consider a partial ordering < on the set S of sorts of a signature Σ and we write

s 1 < s 2 if T s 1 Σ,ζ ⊆ T s 2 Σ,ζ
. Pos(t) denotes the set of positions of a term t, t |ω denotes the subterm of t at position ω, and t [u] ω the term t with the subterm at position ω replaced by u. The set of variables occurring in a term t is denoted by Var(t). If Var(t) is empty, t is called a ground term. All the following definitions are given w.r.t. to a set ζ whose subset of variables is denoted by X . A substitution is a mapping from X to T Σ,ζ which is the identity except over a finite set of variables called domain of σ and denoted by Dom(σ). σ naturally extends to an endomorphism of T Σ,ζ . If any variable in the domain is mapped to a ground term then, the corresponding substitution is called ground. A Σ-atom is of the form p(t 1 , . . . , t n ) or t 1 = t 2 with p ∈ P and t 1 , . . . , t n ∈ T Σ,ζ . A Σ-literal is either a Σ-atom or a negated (with ¬) Σ-atom and the set of Σ-formulae built out of Σ-literals is denoted by For Σ,ζ . The set of free variables of a formula φ (i.e. variables not in the scope of a quantifier) is denoted by FVar(φ). A logical rule over Σ, denoted by a ← l 1 ∧ . . . ∧ l n , consists of a conjunction of Σ-literals l i called the body and a Σ-atom a called the goal.

A constrained rewrite rule over a signature Σ is a 3-tuple (l, ϕ, r) ∈ T Σ,X × For Σ,X × T Σ,X , denoted by l ϕ -→ r, such that Var(r) ⊆ Var(l) ∪ FVar(ϕ). A constrained term rewrite system (CTRS) R is a set of constrained rewrite rules. We say that t ∈ T Σ rewrites into a term t ′ ∈ T Σ with respect to R and a Σ-theory ϑ, which is denoted by t → ϑ R t ′ iff there exist a position p ∈ Pos(t), a rewrite rule l ϕ -→ r ∈ R, and a ground substitution σ with Dom(σ) = Var(l)∪FVar(ϕ)

such that ϑ |= {t |p = σ(l) ; t ′ = t [σ(r)] p ; σ(ϕ)}.

Secured systems

A security policy responds to the authorization requests of a system according to a certain number of rules and to the configuration of the system at the moment of the request. We consider thus that a system constrained by a security policy consists of two parts: on one hand, the set of rules describing the way the decisions are taken and on the other hand, the information used by the rules and the way these evolve in the system. We call the former the policy rules and the latter the security system. In our framework all objects manipulated by the security system and the policy rules are described as first order terms over a common signature called the security signature. We define the security system using transition rules and the policy rules as a constrained rewrite system.

Security signature

A transition of the security system is triggered when an authorization request occurs and the result of the respective transition depends on the corresponding decision. We thus call events the pairs consisting of an authorization request and the associated decision and the security signature always defines the sorts Query and Decision corresponding to the sorts of the first and respectively second element of such a pair. Definition 1. A security signature is a signature Σ Sys ∪ Σ Ev such that Σ Ev contains two sorts Query and Decision with Decision < Query and a set of function symbols whose co-arity belongs to S Ev . Example 1. Along the lines of this paper, we consider an access control system on which we define a confidentiality policy (which can be viewed as a variant of the mandatory part of the Bell and LaPadula policy [START_REF] Bell | Secure Computer Systems: a Mathematical Model[END_REF]). This policy constrains accesses done by subjects (S) over objects (O) according to access modes (A) by considering levels of security belonging to a finite lattice (L, ) associated with subjects and objects. Hence, we introduce the security signature Σ Sys ∪ Σ Ev as follows. First, Σ Sys = (S Sys , F Sys , P Sys ) consists of S Sys = {S, O, A, L} and

P Sys =        :L, L m:S, O, A sudo:S redlist, blacklist:S        F Sys =        read: → A , f s : S →L write: → A , f o : O →L erase: → A , root: →S topSecret: → L       
The functions f s and f o describe security levels associated with subjects and objects; root (resp. topSecret) is a particular subject (resp. security level). The predicate m describes current accesses over objects by subjects: m(s, o, a) means that the subject s performs an access of type a over an object o. The predicate sudo describes "sudoers", i.e. users with root privileges. redlist and blacklist respectively indicate if a subject has requested one or more successive denied accesses. The signature Σ Ev is based on the following function symbols:

F Ev = ask:S, O, A → Query, release:S, O, A → Query, deny: → Decision, permit: → Decision ask(s, o, a) (resp. release(s, o, a)
) means that the subject s asks to get (resp. to release) an access over an object o according to the access mode a.

Environments and transition rules

A security system is a transition system that describes the way security information evolve. The states of the system are defined intensionally by a set of kernel information (that can be modified by the transition rules of the system) and an immutable set of closure rules used to compute the complete security information. The result of such a computation represents the extensional description of the corresponding state. Safety and stratification of logical rules are well-known notions [START_REF] Ullman | Database and Knowledge -Base Systems[END_REF] imposing that (i) any variable occurring in a rule has a bounded domain and (ii) negations wrapped inside recursion are forbidden.

The base of equalities gives the interpretation into the domain of the environment for any term of the signature. We denote by t↓ η the interpretation of the term

t in | η |, i.e. f (t 1 , . . . , t n )↓ η = u iff f (u 1 , . . . , u n ) = u ∈ E η and u i = t i ↓ η for all i ∈ [1, n]. If t = t↓ η we say that t is η-normalized.
B η = L 1 Secret, L 2 Secret, P ublic L 1 , P ublic L 2 ,
Secret topSecret, sudo(Charlie) The base of equalities E η provides a definition for the security levels associated with the subjects defined in the domain:

E η = f s (root) = topSecret, f s (Alice) = L 2 , f s (Charlie) = P ublic, f o (P wdF ile) = Secret,
The set of closure rules completes the definition of :

R η = x x ← ; x z ← x y ∧ y z
Due to the restrictions imposed on the domain and on the formulas, we have:

Proposition 1.
For any environment η over Σ, there exists a unique and computable least fixpoint of the logic program consisting of B η , E η and R η . This fixpoint is denoted by η and is called the semantics of η.

Since | η | is finite, the validity of any first-order formula in η is decidable.

The transition rules of a security system describe the evolution of environments. Several approaches like, for example, action languages [START_REF] Gelfond | Action languages[END_REF] or updating rules [START_REF] Alferes | LUPS -A language for updating logic programs[END_REF], have been already used for the specification of logical models change. We follow in this paper the main ideas of the latter approach. Definition 3. An update u over Σ = (S, F, P) is a logical rule (goal ← body) of one of the following form:

(i) p(x 1 , . . . , x n ) ← ϕ or (ii) ¬p(x 1 , . . . , x n ) ← ϕ or (iii) f (x 1 , . . . , x n ) = y ← ϕ ∧ y = t
where x i and y are variables, p ∈ P, f ∈ F and ϕ is a formula. u is applicable iff (in the case (iii)) Var(t) ⊆ {x 1 , . . . , x n }. In this case, the application of u over the environment η is the environment η ′ = η ⊕ u such that:

case (i) B η ′ = B η ∪ η |=µ(ϕ) p(µ(x 1 ), . . . , µ(x n )) case (ii) B η ′ = B η \ η |=µ(ϕ) p(µ(x 1 ), . . . , µ(x n )) case (iii) E η ′ = E η \ {f (µ(x 1 ), . . . , µ(x n )) = t ′ ∈ η | η |= µ(ϕ ∧ y = t)} ∪ {f (µ(x 1 ), . . . , µ(x n )) = µ(y) | η |= µ(ϕ ∧ y = t)} where µ are maps from {x 1 , . . . , x n , y} to | η |.
The result of applying a sequence of updates

U = (u 1 , . . . , u n ) over η is the environment η ⊕ U = (. . . (e ⊕ u 1 ) ⊕ u 2 ) . . .) ⊕ u n ).
Applying an (applicable) update over an environment consists thus in adding (or removing) the fact or changing the equality corresponding to its goal for any substitution making its body true in the environment.

The transitions of the security system describing the evolution of the states are sequences of updates labelled by the events that trigger them:

Definition 4. A Σ-transition rule is a pair of terms event ∈ T Query Σ,X ×T Decision Σ,X
whose subterms are constants or variables of Σ Sys together with a sequence of updates U over Σ such that σ(U ) 4 is applicable for any ground substitution σ of domain Var(event). A transition rule is usually written (event) : U . For any transition rule r = (event) :

U , η evt -→ r η ′ iff evt = σ(event) and η ′ = η ⊕ σ(U ).
   blacklist(s) ← redlist(s) ¬m(s, o ′ , a ′ ) ← blacklist(s) ∧ m(s, o ′ , a ′ ) redlist(s) ← (iii) (release(s, o, a), permit) : ¬m(s, o, a) ←
The rules (i) and (iii) indicate that when an access request is permitted, the corresponding fact is added and when the respective access is released, the fact is removed. The rule (ii) expresses that a subject is registered on a red-list when it attempts a denied access and that it is black-listed when it attempts twice in a row. When it is black-listed, all its current accesses are removed.

The expressive power of the formalism goes well beyond the updates of Example 3. For instance, if we consider a predicate delegate, the following rule indicates how user s can give his rights to user s ′ ; if s is root then s ′ becomes a sudoer unless it had been red-or black-listed:

(delegate(s, s ′ ), permit) : f s (s ′ ) = l ← l = f s (s) sudo(s ′ ) ← s = root ∧ ¬redlist(s ′ ) ∧ ¬blacklist(s ′ )
Provided the rules events are not unifiable, we get: Proposition 2. For any set δ of disjoint transition rules (i.e such that rules events do not overlap), the relation → δ is deterministic.

Security systems, policy rules and secured systems

A security system is defined by a set of transition rules and an initial environment.

Definition 5. Given a security signature Σ = Σ Sys ∪ Σ Ev , a security system, is the labelled transition system S whose states are environments over Σ Sys , with an initial state η init and whose transitions are

η evt -→ δ η ′ for some evt ∈ T Query Σ,| η | × T Decision Σ,| η | .
Example 4. The security system S over the security signature Σ defined in Example 1 consists of the initial environment η defined in Example 2 and the set δ of transition rules defined in Example 3. Definition 6. A set of policy rules over a security signature Σ = Σ Sys ∪ Σ Ev is an ordered constrained term rewrite system ℜ over Σ with all the rules of the form l ϕ -→r with l, r terms sorted by sorts in S Ev and ϕ a Σ Sys -formula.

We write q → η ℜ d when q is rewritten in one step w.r.t. the policy rules ℜ and the environment η into d and we write q * -→ η ℜ d for multiple-step rewriting.

Example 5. The following ordered CTRS

                           ask(s, o, a) blacklist(s) -------→ deny ask(s, o, a) sudo(s) ∧ s =root ----------→ ask(root, o, a) ask(s, o, read) fo(o) fs(s) ∧ (∀o ′ .m(s,o ′ ,write)⇒fo(o) fo(o ′ )) ------------------------------→ permit ask(s, o, write) ∀o ′ .m(s,o ′ ,read)⇒fo(o ′ ) fo(o) -------------------→ permit ask(s, o, erase) fo(o) fs(s) -------→ permit ask(s, o, a) - → deny release(s, o, a) - → permit                           
defines a policy specifying that:

• a black-listed subject is denied any access;

• a sudoer has the same access rights as root;

• a subject can read an object whose level of security is smaller than its level of security if it is not writing an object of a lower security level; • a subject can write an object if it is not reading an object of a higher level; • a subject can erase an object whose security level is smaller than its level; • a subject can release any of its accesses;

• in all other cases, the request is denied. Notice that since the rules are ordered, the constraints do not need to impose explicitly the negation of the constraints of previous overlapping rules and, in particular, no constraint is needed for the "default" rules. Definition 7. A set of policy rules ℜ over a security signature Σ = Σ Sys ∪ Σ Ev is η-consistent (resp. η-complete) for an environment η over Σ Sys iff for any query q ∈ T Query Σ,| η | , there exists at most (resp. at least) one decision

d ∈ T Decision Σ,| η | such that q * -→ η ℜ d.
These properties can be proved for a large class of policy rules.

Proposition 3. A set ℜ of policy rules is η-consistent if (1) for each rule, its left-hand side contains only one occurrence of each variable and its constraint

does not involve terms of sort Query; (2) for any two rules l ϕ -→ r and l ′ ϕ ′ -→ r ′ there exists no position ω and no substitution σ such that η |= {σ(l |ω ) = σ(l ′ ) ∧ σ(ϕ) ∧ σ(ϕ ′ )}.

Proof. The proof is obtained by adapting the proof for orthogonal TRS [START_REF] Baader | Term Rewriting and All That[END_REF]. Proposition 4. A set ℜ of policy rules over a security signature Σ = Σ Sys ∪ Σ Ev is η-complete if (1) the reduction * -→ η ℜ terminates, (2) for any symbol f :s 1 , . . . , s n → s ∈ F Ev with s > Decision there exists a default rule for f , i.e. a rule containing no constraint and whose left-hand side is a term f (x 1 , . . . , x n ) with x i ∈ X , (3) each rule of ℜ is sort-preserving or sort-decreasing (i.e. the sort of its left-hand side is equal or greater than the sort of its right-hand side).

Proof. We prove that q ∈ T Query Σ,| η | has a normal form of sort Decision by induction on the well-founded rewrite relation induced by ℜ. If q is of sort Decision then its normal form is necessarily of the same sort by (3). If not, then q is reducible by ℜ (because of the default rule) into a ground term q ′ which, by induction hypothesis, has a normal form of sort Decision.

The classical methods for proving termination of TRS can be adapted for CTRS. For example, the policy rules introduced in Example 5 can be shown terminating using an obvious polynomial interpretation [START_REF] Baader | Term Rewriting and All That[END_REF] connected to the corresponding constraints. There is also a default rule for each symbol of sort Query and the rules are sort-preserving or sort-decreasing. Consequently, the corresponding normal forms are clearly in this case permit or deny. The policy rules obviously satisfy condition (1) of Proposition 3 and, because of the order, condition (2) as well. The policy rules of Example 5 are thus η-complete and η-consistent for any environment η. Definition 8. Given a security signature Σ = Σ Sys ∪ Σ Ev , a security system S over Σ and a set ℜ of policy rules over Σ η-complete and η-consistent for any environment η over Σ Sys , a secured system is the labelled transition system ℘ whose states are environments over Σ Sys , whose initial state is the initial state of S and whose transitions are η

q,d ---→ ℘ η ′ for some q, d ∈ T Query Σ,| η | × T Decision Σ,| η | such that η q,d -→ δ η ′ and q * -→ η ℜ d.
Since the set of security rules of a secured system is η-complete and ηconsistent for any environment η, the corresponding relation is computable. Moreover, the underlying relation of the security system is computable by construction and thus, so is the underlying relation of the corresponding secured system. Proposition 5. The relation -→ ℘ is computable for any secured system ℘.

Checking security properties

In this section we propose a methodology based on environment transformations for the validation of security properties enforced by a policy over a system. This is particularly relevant when the security property is expressed on some entities like, for instance, when considering information flow properties, while the policy is an access control policy that can only manipulate objects containing the information to be traced. To solve this problem, we introduce a transformation whose aim is to translate an environment into another one dealing with the entities we are interested in. Such a transformation is defined below by a signature morphism that allows the translation of the domain and of the base of equalities and by a set of transformation rules on the base of facts.

Definition 9. A signature morphism θ from (S 1 , F 1 , P 1 ) to (S 2 , F 2 , P 2 ) is a pair (θ S , θ F ) such that θ S :S 1 → S 2 and θ F :F 1 → F 2 are (partial or total) func- tions such that ∀f :s 1 , . . . , s n → s ∈ Dom(θ F ) where s 1 , . . . , s n , s ∈ Dom(θ S ), θ F (f ):θ S (s 1 ), . . . , θ S (s n ) → θ S (s) ∈ F 2 .
We extend θ to a morphism θ (which is simply denoted by θ) over terms as follows:

• ∀x:s ∈ X , θ(x:s) = x:θ S (s) • ∀f ∈ Dom(θ F ), θ(f (t 1 , . . . , t n ):s) = θ F (f )( θ(t 1 ), . . . , θ(t n ))
Definition 10. Given two signatures Σ 1 = (S 1 , F 1 , P 1 ) and Σ 2 = (S 2 , F 2 , P 2 ), an environment transformation Θ is a tuple (θ, δ, R) where:

• θ is a signature morphism from Σ 1 to Σ 2 ;

• δ is a set of pairs condition, conclusion with condition a Σ 1 -formula and conclusion a conjunction of Σ 2 -atoms such that x:s ∈ FVar(condition) iff θ(x:s) ∈ FVar(conclusion); thus, variables of FVar(conclusion) (resp. FVar(conclusion)) are sorted by Dom(θ S ) (resp. Im(θ S )); • R is a set of safe and stratified logical rules over Σ 2 . Applying Θ on an environment η over Σ 1 produces an environment Θ(η) over Σ 2 defined as follows:

• | Θ(η) | = {c:θ(s) | c:s ∈ | η | ∧ s ∈ Dom(θ)}; • E Θ(η) contains an equality θ(f (t 1 , • • • , t n )) = θ(t) for each f (t 1 , • • • , t n ) =
t in E η whose image by θ is defined; • B Θ(η) contains all the Σ 2 -atoms p(µ(t 1 ), . . . , µ(t m ))↓ Θ(η) for which there exists a pair condition, conclusion ∈ δ where p(t 1 , • • • , t n ) occurs in conclusion, and a mapping µ from Var(condition

) to | η | such that η |= µ(condition); • R Θ(η) = R.
We say that η is transformed by Θ into Θ(η).

Any environment transformation Θ = (θ, δ, R) from Σ 1 to Σ 2 induces a total mapping η → Θ(η) from Σ 1 -environments into Σ 2 -environments; this operational view justifies to call Θ a transformation operator. We can use this notion of environment transformation to check a security property expressed as a Σ 2 -formula ψ over reachable environments of a secured system ℘ over Σ 1 . Indeed, this amounts to check that for every reachable environment η of ℘, we have Θ(η) |= ψ, which is decidable for any ψ, as a consequence of Proposition 1 and the computability of Θ(η) for any η. Example 6. We consider now environment transformations that can be used to deal with information flow properties of access control policies. We introduce the "generic" signature Σ FLOW = ({Actor, Inf ormation}, F FLOW , P FLOW ) where P FLOW is:    Get : Actor, Inf ormation;

MoveTo : Inf ormation, Inf ormation; Put : Actor, Inf ormation;

Trustworthy : Actor, Inf ormation; Eligible : Actor, Inf ormation; Gflow : Inf ormation, Inf ormation    and where FFLOW is an arbitrary set of function symbols. Get(a, i) means that the actor a knows the information i, Put(a, i) means that the actor a modifies the information i (by using the information it knows), MoveTo(i 1 , i 2 ) means that the information i 2 is enriched with information i 1 , Eligible(a, i) means that the actor a is granted to know the information i, Trustworthy(a, i) means that the actor a is granted to modify the information i and Gflow (i 1 , i 2 ) means that the information i 1 is authorized to flow into i 2 . The predicates Get, Put and MoveTo are useful for describing existing flows while the predicates Eligible, Trustworthy, and Gflow are used to specify flow policies (respectively a confidentiality policy, an integrity policy and a confinment policy). Now, it is possible to define, in a generic way, confidentiality, integrity and confinment security properties as follows:

Confidentiality

ψ conf ∀a, i. Get(a, i) ⇒ Eligible(a, i) Integrity ψ int ∀a, i. Put(a, i) ⇒ Trustworthy(a, i) Confinment ψ inf o ∀i, i ′ . MoveTo(i, i ′ ) ⇒ Gflow (i, i ′ )
Let us consider the environment transformation defined from the signature Σ Sys of Example 1 and the signature Σ FLOW and consisting of the partial function θ S : S Sys → S FLOW such that Dom(θ S ) = {S, O} with θ S (S) = Actor and θ S (O) = Inf ormation together with the identity function θ F , the following logical rules over

Σ FLOW R FLOW =            MoveTo(i, i) ← MoveTo(i, i ′ ) ← Get(a, i) ∧ Put(a, i ′ ) Get(a, i) ← MoveTo(i, i ′ ) ∧ Get(a, i ′ ) Put(a, i ′ ) ← MoveTo(i, i ′ ) ∧ Put(a, i) MoveTo(i, i ′′ ) ← MoveTo(i, i ′ ) ∧ MoveTo(i ′ , i ′′ )
and δ defined by m(x, y, read) ∧ ∀x ′ .¬m(x ′ , y, erase) Get(x, y)

f o (y) f s (x)
Eligible(x, y) m(x, y, write) ∧ ∀x ′ .¬m(x ′ , y, erase)

Put(x, y)

f o (y) f o (y ′ ) Gflow (y, y ′ )
The rules introducing Get and Put allow the translation of the accesses expressed in the source environment using the predicate m into accesses expressed in the target environment using the predicates Get and Put. The rules introducing Eligible and Gflow can be viewed as the definition of the flow interpretation of a (security level-based) access control policy. Note that this transformation allows to handle transitive information flows generated by accesses performed simultaneously in a given environment but does not take into account the past (accesses) of the system. Indirect flows can be nevertheless dealt with, by adding a new predicate which keeps track, in the source environments, of the origins of the information contained into each object of the system (for example, see [START_REF] George | Blare tools: A policy-based intrusion detection system automatically set by the security policy[END_REF][START_REF] Jaume | Contrôle d'accès versus contrôle de flots[END_REF] for an intrusion detection based approach dealing with indirect information flows).

The above environment transformation provides the means for checking that our policy ensures confinment. This can be done by checking that each reachable environment η of the secured system ℘ is such that Θ(η) |= ψ inf o . However, the existence of sudoers may generate reachable environments that do not satisfy the confidentiality property w.r.t. Θ, i.e. it is possible to obtain a reachable environment in ℘ which is transformed into an environment which does not satisfy ψ conf . This is for example the case for the environment obtained by considering the initial environment introduced in Example 2 and a transition labelled by the event ask(Charlie, P wdF ile, read). Indeed, since Charlie is a sudoer, the policy defined in Example 5 allows Charlie to have a read access over P wdF ile even if its security level is not greater than Secret and hence, we have Get(Charlie, P wdF ile). However, the meaning of Eligible specified by δ does not take into account sudoers and we have thus ¬Eligible(Charlie, P wdF ile).

Of course, when adding the rule sudo(s) Eligible(s, o)

to δ and give thus a different semantics to the confidentiality property, one can check that any reachable environment η of the system ℘ is such that Θ(η) |= ψ inf o ∧ ψ conf . Note also that if we add the possibility for a user to assign its security level to another user (as illustrated on page 8) then the security level of a user can decrease and thus, only the property ψ inf o is preserved. By constraining the delegation mechanism with the following policy rules:

   delegate(s, s ′ ) fs(s ′ ) fs(s) -------→ permit delegate(s, s ′ ) ¬(fs(s ′ ) fs(s))
---------→ deny    to ensure that security levels of subjects can only increase, the property ψ conf can be preserved.

The transformation approach can be also useful when one wants to enforce policies by directly using the desired security properties to constrain the transitions of a security system. Indeed, suppose we want to constrain a security system S = (η init , δ) over a signature Σ 1 in order to ensure a security property expressed as a formula ϕ over a different signature Σ 2 . The corresponding secured system can be obtained by using an environment transformation Θ = (θ, δ Θ , R 2 ) from Σ 1 to Σ 2 and by considering the transition relation → δϕ

such that η evt -→ δϕ η ′ iff η evt -→ δ η ′ ∧ Θ(η ′ ) |= ϕ.
Of course, such an approach leads to a system whose reachable states satisfy ϕ iff Θ(η init ) |= ϕ. The notion of environment transformation makes thus possible the application of a security policy expressed as a (required) property to several systems.

Related work

Among a rich literature on security policies (see for instance [START_REF] Damianou | A survey of policy specification approaches[END_REF] for policy specification languages, and [START_REF] Jaume | Security rules versus security properties[END_REF] for the rule-based and property-based approaches to define policies), our approach is in the line of logic-based languages providing a well-understood formalism, which is amenable to analysis and verification.

Our formalism borrows inspiration from various sources. Horn clause logic has been used extensively for RBAC models [START_REF] Sandhu | Role-based access control models[END_REF]. Since negation and recursion are often needed, the concept of stratified theories has been used for instance in the authorization specification language ASL [START_REF] Jajodia | A unified framework for enforcing multiple access control policies[END_REF] for access control. Integrity rules specify application dependent conditions that limit the range of acceptable policies. Stratified logic for RBAC policies is also developed in [START_REF] Barker | Access control for deductive databases by logic programming[END_REF]. In our work, we use similar concepts but do not restrict to RBAC models.

Constraint logic programming for designing RBAC and temporal RBAC policies is considered in [START_REF] Barker | Flexible access control policy specification with constraint logic programming[END_REF]. Their constraints are conjunctions of equational constraints over sets of constants, and arithmetic constraints over non-negative integers. While keeping a declarative approach, CLP adds the expressive power and efficiency of constraint solving and database querying. A security administrator has then analysis capability thanks to the computation of sets of constraints as answers. Formalisation of security analysis in an abstract setting is done in [START_REF] Li | Security analysis in role-based access control[END_REF] and exemplified for RBAC. In comparison, we allow a different class of constraints that we keep decidable by restricting to safe theories, and we use constraints in a rewriting context. Note that it is also possible to apply constraint narrowing to get analysis power as in [START_REF] Kirchner | Analysis of rewrite-based access control policies[END_REF].

Whereas most existing works on reasoning about security policies model the environment only lightly, if at all, there are some exceptions. One of the closest works is [START_REF] Dougherty | Specifying and reasoning about dynamic access-control policies[END_REF] who represents the behavior of access control policies in a dynamic environment. Policies are written in Datalog and can refer to facts in the authorization state. Events, such as access requests, can change the authorization state, and the changes are specified as a state machine whose transition labels are guarded by the policy. Security properties can then be analyzed by model checking formulas in first-order temporal logic. In [START_REF] Becker | A logic for state-modifying authorization policies[END_REF], the authors introduce a logic for specifying policies where access requests can have effects on the authorization state. The effects are explicitly specified in the language, an extension of Datalog backed on transaction logic. They also propose a proof system for reasoning about sequences of user actions. In comparison, thanks to constraint rewriting, we provide a more expressive formalism, while keeping it operational and decidable. The full expressive power of constraint rewriting is explored in [START_REF] Bourdier | Constrained rewriting in recognizable theories[END_REF].

Comparing the expressive power of access control models is a fundamental problem in computer security, already addressed in several works. In [START_REF] Bertino | A logical framework for reasoning about access control model[END_REF], different access control models are represented in C-Datalog (an object-oriented extension of Datalog) and compared using results from logic programming. In [START_REF] Tripunitara | A theory for comparing the expressive power of access control models[END_REF], the authors express access control systems as state transitions systems as we do and introduce security-preserving mappings, called reductions, to compare security analysis based on accessibility relations in two different models. In [START_REF] Chander | A state-transition model of trust management and access control[END_REF][START_REF] Habib | Formal definition and comparison of access control models[END_REF], the comparison mechanism is based on a notion of simulation. Thanks to the no-tion of environment transformation, we address this problem with an operational transition rules based approach.

Conclusion and future work

We proposed a framework which provides a common formalism for defining security signatures, environments, systems, and policy rules. We have shown that secured systems specified in this formalism have an operational semantics based on transition and rewriting systems and are thus executable.

Such a formalism can be viewed as the definition of a mechanism allowing to constrain the executions of a transition system by applying a policy. As shown by our examples, this can be useful in the context of security, but such a mechanism can also be considered when supervising a system for other purposes. Our framework also allows the definition of transformations of security signatures and environments and consequently, of secured systems. We defined a transformation operator and showed how it can be used to check security properties over the reachable environments of a secured system. This approach based on a transformation operator allows us to check some properties over a system even if these properties are expressed on a different signature (and/or specification). Our framework facilitates thus the reusability since the same specification of a security property can be used to check several policies and systems. It encourages also the specification of generic security properties dedicated to particular domains like, for example, information flows, and that can be used in different contexts. The operational nature of our formalism should lead to relatively direct implementations using rewrite based tools like Maude [START_REF] Clavel | All About Maude -A High-Performance Logical Framework, How to Specify, Program and Verify Systems in Reriting Logic[END_REF] for example. The rule engine of Maude can than be used to simulate secured systems and their transformations and the integrated model-checker could be used to verify the corresponding properties.

As future work, we aim to focus on the extension of the proposed transformation in order to define policies and systems in a completely independent way and to provide thus an enhanced modularity in formal developments. We also want to study how the transformation operators could be used for comparing and composing security policies and systems. Indeed, the comparison between two policies expressed as policy rules ℜ 1 and ℜ 2 , respectively based on the signatures Σ 1 and Σ 2 , is often based on an embedding of Σ 1 -formulas into Σ 2 -formulas. Such an approach can also be considered for systems, using transformations between environments to define a comparison mechanism. Similarly, for composition, transformation operators could be used to translate policies and systems into policies and systems sharing the same security signature and specification, thus easing the definition of a composition relation.

Definition 2 .

 2 An environment η over a signature Σ = S, F, P consists of: (i) a domain: a finite set | η | of sorted constants which contains all the constants of Σ; (ii) a base of facts: a finite set B η of atoms of the form p(t 1 , . . . , t n ) with p ∈ P, n > 0 and t 1 , . . . , t n ∈ | η |. (iii) a base of equalities: a finite set E η of equalities of the form f (t 1 , . . . , t n ) = t with f ∈ F, n > 0 and t 1 , . . . , t n , t ∈ | η | which does not contain two equalities with the same left-hand side; (iv) closure rules: a set R η of safe and stratified logical rules over Σ.

Example 2 .

 2 If we consider the security signature Σ introduced in Example 1, we can define the environment η as follows. The domain | η | contains the constants Alice and Charlie of sort S, the constant P wdF ile of sort O, and the constants Secret, L 1 , L 2 , P ublic, of sort L. The base of facts B η (partially) defines the partial order and states that Charlie is a sudoer:

  Moreover, for any set of rules δ, η evt --→ δ η ′ iff there is a rule r ∈ δ such that η evt --→ r η ′ . Example 3. If we consider the security signature Σ introduced in Example 1, we can define the following set δ of (i) (ask(s, o, a), permit) :    m(s, o, a) ← ¬redlist(s) ← ¬blacklist(s) ← (ii) (ask(s, o, a), deny) :

For any substitution σ, σ(U ) is the update sequence obtained by replacing in the goal and body of all its updates any x ∈ Dom(σ) by σ(x).