(*SUBJECT, Property and TransFunc*)
Ltac OpDontChangeStPSS :=
  intros s t Sub SS TF; inversion TF;
   match goal with
   | id:(s = t) |- _ => rewrite <- id; auto
   end.Ltac OpDontChangeStPSP :=
  intros s t Sub SP TF;  (* SUBJECT, Property and TransFunc *)
   inversion TF; match goal with
                 | id:(s = t) |- _ => rewrite <- id; auto
                 end.Ltac StartPSS := intros s t Sub SS TF; inversion TF.Ltac BreakSS :=
  match goal with
  | SS:(SecureState _) |- _ =>
      unfold SecureState in SS; elim SS; intros DAC MAC
  end.Ltac StartPSP := intros s t Sub SP TF; inversion TF.

(* Specifications: *)
Lemma ReadWriteImpRead : forall s : SFSstate, DACSecureState s -> forall (u : SUBJECT) (o : OBJECT), match fsecmat (secmat s) o with | Some y => set_In u (ActReaders y) -> PreDACRead s u o | None => True end.
Lemma ReadWriteImpWrite : forall s : SFSstate, DACSecureState s -> forall (u : SUBJECT) (o : OBJECT), match fsecmat (secmat s) o with | Some y => set_In u (ActWriters y) -> PreDACWrite s u o | None => True end.
Lemma TwoImpLeft : forall (s : SFSstate) (u : SUBJECT), (forall rw : ReadersWriters, set_In rw (ransecmat (secmat s)) -> ~ set_In u (ActReaders rw) /\ ~ set_In u (ActWriters rw)) -> forall rw : ReadersWriters, set_In rw (ransecmat (secmat s)) -> ~ set_In u (ActReaders rw).
Lemma TwoImpRight : forall (s : SFSstate) (u : SUBJECT), (forall rw : ReadersWriters, set_In rw (ransecmat (secmat s)) -> ~ set_In u (ActReaders rw) /\ ~ set_In u (ActWriters rw)) -> forall rw : ReadersWriters, set_In rw (ransecmat (secmat s)) -> ~ set_In u (ActWriters rw).
Lemma UniqNames : forall (s : SFSstate) (o : OBJECT), FuncPre1 s -> ~ set_In (ObjName o, File) (domf (files s)) -> ~ set_In (ObjName o, Directory) (domd (directories s)) -> ~ set_In o (DOM OBJeq_dec (acl s)).
Lemma eq_scIMPLYle_sc : forall a b : SecClass, eq_sc a b -> le_sc a b.
Lemma NotInDOMIsUndef2 : forall (s : SFSstate) (o1 o2 : OBJECT), ~ set_In o1 (domsecmat (secmat s)) -> o1 = o2 -> None = fsecmat (secmat s) o2.
Lemma NotInDOMIsUndef3 : forall (s : SFSstate) (p : OBJNAME) (o : OBJECT), FuncPre1 s -> FuncPre3 s -> ~ set_In (p, File) (domf (files s)) -> ~ set_In (p, Directory) (domd (directories s)) -> p = ObjName o -> None = fsecmat (secmat s) o.
Lemma EqfOSC6 : forall (s : SFSstate) (o1 o2 : OBJECT) (sc : SecClass), o1 <> o2 -> fOSC (objectSC s) o2 = fOSC (chobjsc_SC s o1 sc) o2.
Lemma EqfOSC5 : forall (s : SFSstate) (o : OBJECT) (p : OBJNAME), FuncPre1 s -> FuncPre2 s -> ~ set_In (p, File) (domf (files s)) -> ~ set_In (p, Directory) (domd (directories s)) -> p = ObjName o -> None = fOSC (objectSC s) o.
Lemma EqfOSC1 : forall (s : SFSstate) (o : OBJECT) (p : OBJNAME) (u : SUBJECT), p <> ObjName o -> fOSC (objectSC s) o = fOSC (create_oSC s u p) o.
Lemma EqfOSC2 : forall (s : SFSstate) (o : OBJECT) (p : OBJNAME) (u : SUBJECT), p <> ObjName o -> fOSC (objectSC s) o = fOSC (mkdir_oSC s u p) o.
Lemma EqfOSC3 : forall (s : SFSstate) (o1 o2 : OBJECT), o1 <> o2 -> fOSC (objectSC s) o2 = fOSC (unlink_oSC s o1) o2.
Lemma Eqfacl1 : forall (s : SFSstate) (o : OBJECT) (p : OBJNAME) (u : SUBJECT) (perms : PERMS), p <> ObjName o -> facl (acl s) o = facl (create_acl s u p perms) o.
Lemma Eqfacl2 : forall (s : SFSstate) (o : OBJECT) (p : OBJNAME) (u : SUBJECT) (perms : PERMS), p <> ObjName o -> facl (acl s) o = facl (mkdir_acl s u p perms) o.
Lemma Eqfacl3 : forall (s : SFSstate) (o1 o2 : OBJECT), o1 <> o2 -> facl (acl s) o2 = facl (unlink_acl s o1) o2.
Lemma Eqfacl4 : forall (s : SFSstate) (o : OBJECT) (y z : AccessCtrlListData), FuncPre4 s -> facl (acl s) o = Some y -> facl (rmdir_acl s o) o = Some z -> False.
Lemma Eqfacl5 : forall (s : SFSstate) (o : OBJECT) (y z : AccessCtrlListData), FuncPre4 s -> facl (acl s) o = Some y -> facl (unlink_acl s o) o = Some z -> False.
Lemma EqfOSC4 : forall (s : SFSstate) (o : OBJECT) (y z : SecClass), FuncPre6 s -> fOSC (objectSC s) o = Some y -> fOSC (rmdir_oSC s o) o = Some z -> False.
Lemma EqfOSC7 : forall (s : SFSstate) (o : OBJECT) (y z : SecClass), FuncPre6 s -> fOSC (objectSC s) o = Some y -> fOSC (unlink_oSC s o) o = Some z -> False.
Lemma NoDACChange : forall (s : SFSstate) (o : OBJECT) (SSC : set (SUBJECT * SecClass)) (OSC : set (OBJECT * SecClass)) (FILES : set (OBJECT * FILECONT)) (DIRECTS : set (OBJECT * DIRCONT)) (SM : set (OBJECT * ReadersWriters)), ~ DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) SSC (AllGrp s) (RootGrp s) (SecAdmGrp s) OSC (acl s) SM FILES DIRECTS) o.
Lemma NoDACChange2 : forall (s : SFSstate) (o : OBJECT), ~ DACCtrlAttrHaveChanged s s o.
Lemma NoMACObjChange : forall (s : SFSstate) (o : OBJECT) (FILES : set (OBJECT * FILECONT)) (DIRECTS : set (OBJECT * DIRCONT)) (ACL : set (OBJECT * AccessCtrlListData)) (SSC : set (SUBJECT * SecClass)) (SM : set (OBJECT * ReadersWriters)), ~ MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) SSC (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) ACL SM FILES DIRECTS) o.
Lemma NoMACObjChange2 : forall (s : SFSstate) (o : OBJECT), ~ MACObjCtrlAttrHaveChanged s s o.
Lemma NoMACSubChange : forall (s : SFSstate) (u : SUBJECT) (ACL : set (OBJECT * AccessCtrlListData)) (OSC : set (OBJECT * SecClass)) (FILES : set (OBJECT * FILECONT)) (DIRECTS : set (OBJECT * DIRCONT)) (SM : set (OBJECT * ReadersWriters)), ~ MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) OSC ACL SM FILES DIRECTS) u.
Lemma NoMACSubChange2 : forall (s : SFSstate) (u : SUBJECT), ~ MACSubCtrlAttrHaveChanged s s u.
Lemma eq_scSym : forall a b : SecClass, eq_sc a b -> eq_sc b a.
Lemma ChsubscPSS1 : forall (s : SFSstate) (u : SUBJECT) (y : ReadersWriters), (forall rw : ReadersWriters, ~ set_In u (ActReaders rw) /\ ~ set_In u (ActWriters rw)) -> ~ (set_In u (ActReaders y) \/ set_In u (ActWriters y)).
Lemma EqfSSC1 : forall (s : SFSstate) (u u0 : SUBJECT) (sc : SecClass), u <> u0 -> fSSC (subjectSC s) u0 = fSSC (chsubsc_SC s u sc) u0.
Lemma Close_smCorr : forall (s : SFSstate) (Sub : SUBJECT) (o : OBJECT), FuncPre5 s -> match fsecmat (secmat s) o with | Some y => set_In Sub (set_union SUBeq_dec (ActReaders y) (ActWriters y)) | None => False end -> match fsecmat (close_sm s Sub o) o with | None => True | Some y => ~ set_In Sub (ActReaders y) /\ ~ set_In Sub (ActWriters y) end.
Lemma Close_smCorr2 : forall (s : SFSstate) (Sub u0 : SUBJECT) (o : OBJECT), FuncPre5 s -> match fsecmat (secmat s) o with | Some y => set_In Sub (set_union SUBeq_dec (ActReaders y) (ActWriters y)) | None => False end -> match fsecmat (close_sm s Sub o) o, fsecmat (secmat s) o with | _, None => False | None, Some z => True | Some y, Some z => (set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)) /\ (set_In u0 (ActWriters y) -> set_In u0 (ActWriters z)) end.
Lemma Eqfsecmat1 : forall (s : SFSstate) (o1 o2 : OBJECT) (u : SUBJECT), o1 <> o2 -> fsecmat (secmat s) o2 = fsecmat (close_sm s u o1) o2.
Lemma Close_smCorr3 : forall (s : SFSstate) (Sub : SUBJECT) (o : OBJECT), fsecmat (secmat s) o = None -> fsecmat (close_sm s Sub o) o = None.
Lemma OwnerClose_smCorr2 : forall (s : SFSstate) (Sub u0 : SUBJECT) (o : OBJECT), FuncPre5 s -> match fsecmat (secmat s) o with | Some y => set_In Sub (set_union SUBeq_dec (ActReaders y) (ActWriters y)) | None => False end -> match fsecmat (ownerclose_sm s Sub o) o, fsecmat (secmat s) o with | _, None => False | None, Some z => True | Some y, Some z => (set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)) /\ (set_In u0 (ActWriters y) -> set_In u0 (ActWriters z)) end.
Lemma Eqfsecmat2 : forall (s : SFSstate) (o1 o2 : OBJECT) (u : SUBJECT), o1 <> o2 -> fsecmat (secmat s) o2 = fsecmat (ownerclose_sm s u o1) o2.
Lemma OwnerClose_smCorr3 : forall (s : SFSstate) (Sub : SUBJECT) (o : OBJECT), fsecmat (secmat s) o = None -> fsecmat (ownerclose_sm s Sub o) o = None.
Lemma Open_smCorr3 : forall (s : SFSstate) (Sub : SUBJECT) (o : OBJECT) (m : MODE), FuncPre5 s -> fsecmat (open_sm s Sub o m) o = None -> fsecmat (secmat s) o = None.
Lemma Open_smCorr21 : forall (s : SFSstate) (Sub u0 : SUBJECT) (o : OBJECT) (m : MODE), Sub <> u0 -> FuncPre5 s -> match fsecmat (open_sm s Sub o READ) o, fsecmat (secmat s) o with | Some y, None => ActReaders y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\ ActWriters y = empty_set SUBJECT | None, _ => False | Some y, Some z => (set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)) /\ (set_In u0 (ActWriters y) -> set_In u0 (ActWriters z)) end.
Lemma Open_smCorr22 : forall (s : SFSstate) (Sub u0 : SUBJECT) (o : OBJECT) (m : MODE), Sub <> u0 -> FuncPre5 s -> match fsecmat (open_sm s Sub o WRITE) o, fsecmat (secmat s) o with | Some y, None => ActWriters y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\ ActReaders y = empty_set SUBJECT | None, _ => False | Some y, Some z => (set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)) /\ (set_In u0 (ActWriters y) -> set_In u0 (ActWriters z)) end.
Lemma Eqfsecmat3 : forall (s : SFSstate) (o1 o2 : OBJECT) (u : SUBJECT) (m : MODE), o1 <> o2 -> fsecmat (secmat s) o2 = fsecmat (open_sm s u o1 m) o2.
Lemma Chobjsc_Corr : forall (s : SFSstate) (o : OBJECT) (sc : SecClass), FuncPre6 s -> (fOSC (objectSC s) o = None <-> fOSC (chobjsc_SC s o sc) o = None).
Lemma Aux1 : forall y : SecClass, ~ (Some y = None <-> None = None :>option SecClass).
Lemma Chsubsc_Corr : forall (s : SFSstate) (u : SUBJECT) (sc : SecClass), FuncPre7 s -> (fSSC (subjectSC s) u = None <-> fSSC (chsubsc_SC s u sc) u = None).
Lemma Open_smCorr31 : forall (s : SFSstate) (Sub u0 : SUBJECT) (o : OBJECT) (m : MODE), FuncPre5 s -> match fsecmat (open_sm s Sub o READ) o, fsecmat (secmat s) o with | Some y, None => ActReaders y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\ ActWriters y = empty_set SUBJECT | None, _ => False | Some y, Some z => set_In u0 (ActWriters y) -> set_In u0 (ActWriters z) end.
Lemma Open_smCorr32 : forall (s : SFSstate) (Sub u0 : SUBJECT) (o : OBJECT) (m : MODE), FuncPre5 s -> match fsecmat (open_sm s Sub o WRITE) o, fsecmat (secmat s) o with | Some y, None => ActWriters y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\ ActReaders y = empty_set SUBJECT | None, _ => False | Some y, Some z => set_In u0 (ActReaders y) -> set_In u0 (ActReaders z) end.