(*MyDir(o): parent directory of object o*)

Parameter MyDir : OBJNAME -> OBJECT.Definition ObjName (o : OBJECT) : OBJNAME := fst o.Definition ObjType (o : OBJECT) : OBJTYPE := snd o.(*********************************************************************) 
(*                  Security Policy Objects                          *) 
(*********************************************************************) 
 
(*
(allowedTo a b):
 if a pattern-matches (PM) true, then read access is allowed; otherwise it isn'
 if b PM true, then write access is allowed; otherwise it isn't
*)
 
Record RIGHTS : Set := allowedTo {read_right : bool; write_right : bool}.(*********************************************************************) 
(*                  Security Policy Objects                          *) 
(*********************************************************************) 
 
(*
(allowedTo a b):
 if a pattern-matches (PM) true, then read access is allowed; otherwise it isn'
 if b PM true, then write access is allowed; otherwise it isn't
*)
 
Record RIGHTS : Set := allowedTo {read_right : bool; write_right : bool}.(*********************************************************************) 
(*                  Security Policy Objects                          *) 
(*********************************************************************) 
 
(*
(allowedTo a b):
 if a pattern-matches (PM) true, then read access is allowed; otherwise it isn'
 if b PM true, then write access is allowed; otherwise it isn't
*)
 
Record RIGHTS : Set := allowedTo {read_right : bool; write_right : bool}.(*********************************************************************) 
(*                  Security Policy Objects                          *) 
(*********************************************************************) 
 
(*
(allowedTo a b):
 if a pattern-matches (PM) true, then read access is allowed; otherwise it isn'
 if b PM true, then write access is allowed; otherwise it isn't
*)
 
Record RIGHTS : Set := allowedTo {read_right : bool; write_right : bool}.(*
(rwx o g a):
 if o PM (allowedTo x y) then the owner has or has't read and/or write access;
 if g PM (allowedTo x y) then group g has or has't read and/or write access;
 if a PM (allowedTo x y) then all the system subjects has or has't read and/or write access
*)
 
Record PERMS : Set := rwx {ownerp : RIGHTS; groupp : RIGHTS; otherp : RIGHTS}.(*
(rwx o g a):
 if o PM (allowedTo x y) then the owner has or has't read and/or write access;
 if g PM (allowedTo x y) then group g has or has't read and/or write access;
 if a PM (allowedTo x y) then all the system subjects has or has't read and/or write access
*)
 
Record PERMS : Set := rwx {ownerp : RIGHTS; groupp : RIGHTS; otherp : RIGHTS}.(*
(rwx o g a):
 if o PM (allowedTo x y) then the owner has or has't read and/or write access;
 if g PM (allowedTo x y) then group g has or has't read and/or write access;
 if a PM (allowedTo x y) then all the system subjects has or has't read and/or write access
*)
 
Record PERMS : Set := rwx {ownerp : RIGHTS; groupp : RIGHTS; otherp : RIGHTS}.(*
(rwx o g a):
 if o PM (allowedTo x y) then the owner has or has't read and/or write access;
 if g PM (allowedTo x y) then group g has or has't read and/or write access;
 if a PM (allowedTo x y) then all the system subjects has or has't read and/or write access
*)
 
Record PERMS : Set := rwx {ownerp : RIGHTS; groupp : RIGHTS; otherp : RIGHTS}.(*
(rwx o g a):
 if o PM (allowedTo x y) then the owner has or has't read and/or write access;
 if g PM (allowedTo x y) then group g has or has't read and/or write access;
 if a PM (allowedTo x y) then all the system subjects has or has't read and/or write access
*)
 
Record PERMS : Set := rwx {ownerp : RIGHTS; groupp : RIGHTS; otherp : RIGHTS}.(*Designated below*)
Record AccessCtrlListData : Set := acldata
  {owner : SUBJECT;
   group : GRPNAME;
   UsersReaders : set SUBJECT;
   GroupReaders : set GRPNAME;
   UsersWriters : set SUBJECT;
   GroupWriters : set GRPNAME;
   UsersOwners : set SUBJECT;
   GroupOwners : set GRPNAME}.(*Designated below*)
Record AccessCtrlListData : Set := acldata
  {owner : SUBJECT;
   group : GRPNAME;
   UsersReaders : set SUBJECT;
   GroupReaders : set GRPNAME;
   UsersWriters : set SUBJECT;
   GroupWriters : set GRPNAME;
   UsersOwners : set SUBJECT;
   GroupOwners : set GRPNAME}.(*Designated below*)
Record AccessCtrlListData : Set := acldata
  {owner : SUBJECT;
   group : GRPNAME;
   UsersReaders : set SUBJECT;
   GroupReaders : set GRPNAME;
   UsersWriters : set SUBJECT;
   GroupWriters : set GRPNAME;
   UsersOwners : set SUBJECT;
   GroupOwners : set GRPNAME}.(*Designated below*)
Record AccessCtrlListData : Set := acldata
  {owner : SUBJECT;
   group : GRPNAME;
   UsersReaders : set SUBJECT;
   GroupReaders : set GRPNAME;
   UsersWriters : set SUBJECT;
   GroupWriters : set GRPNAME;
   UsersOwners : set SUBJECT;
   GroupOwners : set GRPNAME}.(*Designated below*)
Record AccessCtrlListData : Set := acldata
  {owner : SUBJECT;
   group : GRPNAME;
   UsersReaders : set SUBJECT;
   GroupReaders : set GRPNAME;
   UsersWriters : set SUBJECT;
   GroupWriters : set GRPNAME;
   UsersOwners : set SUBJECT;
   GroupOwners : set GRPNAME}.(*Designated below*)
Record AccessCtrlListData : Set := acldata
  {owner : SUBJECT;
   group : GRPNAME;
   UsersReaders : set SUBJECT;
   GroupReaders : set GRPNAME;
   UsersWriters : set SUBJECT;
   GroupWriters : set GRPNAME;
   UsersOwners : set SUBJECT;
   GroupOwners : set GRPNAME}.(*Designated below*)
Record AccessCtrlListData : Set := acldata
  {owner : SUBJECT;
   group : GRPNAME;
   UsersReaders : set SUBJECT;
   GroupReaders : set GRPNAME;
   UsersWriters : set SUBJECT;
   GroupWriters : set GRPNAME;
   UsersOwners : set SUBJECT;
   GroupOwners : set GRPNAME}.(*Designated below*)
Record AccessCtrlListData : Set := acldata
  {owner : SUBJECT;
   group : GRPNAME;
   UsersReaders : set SUBJECT;
   GroupReaders : set GRPNAME;
   UsersWriters : set SUBJECT;
   GroupWriters : set GRPNAME;
   UsersOwners : set SUBJECT;
   GroupOwners : set GRPNAME}.(*Designated below*)
Record AccessCtrlListData : Set := acldata
  {owner : SUBJECT;
   group : GRPNAME;
   UsersReaders : set SUBJECT;
   GroupReaders : set GRPNAME;
   UsersWriters : set SUBJECT;
   GroupWriters : set GRPNAME;
   UsersOwners : set SUBJECT;
   GroupOwners : set GRPNAME}.(*Designated below*)
Record AccessCtrlListData : Set := acldata
  {owner : SUBJECT;
   group : GRPNAME;
   UsersReaders : set SUBJECT;
   GroupReaders : set GRPNAME;
   UsersWriters : set SUBJECT;
   GroupWriters : set GRPNAME;
   UsersOwners : set SUBJECT;
   GroupOwners : set GRPNAME}.(*Designated below*)
Record ReadersWriters : Set := mkRW
  {ActReaders : set SUBJECT; ActWriters : set SUBJECT}.(*Designated below*)
Record ReadersWriters : Set := mkRW
  {ActReaders : set SUBJECT; ActWriters : set SUBJECT}.(*Designated below*)
Record ReadersWriters : Set := mkRW
  {ActReaders : set SUBJECT; ActWriters : set SUBJECT}.(*Designated below*)
Record ReadersWriters : Set := mkRW
  {ActReaders : set SUBJECT; ActWriters : set SUBJECT}.Axiom RWeq_dec : forall x1 x2 : ReadersWriters, {x1 = x2} + {x1 <> x2}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*********************************************************************) 
(*                     Secured FileSystem                            *) 
(*********************************************************************) 
 
(*This record represents the state of the filesystem from the security point of view. Designations for each field:

(groups g): all the subjects which belong to group g

(primaryGrp s): the (UNIX) primary group of subject s

(set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s

AllGrp: group containing all the system subjects

SecAdmGrp: group of the security administrators in charge of MAC attributes

RootGrp: group of all subjects with the same access of subject root

(set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s

(set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)):
  iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case:
   o is the UNIX owner of o,
   g is the UNIX group of o,
   ur is a set of subjects with read access to o,
   gr is a set of groups with read access to o,
   uw is a set of subjects with write access to o,
   gw is a set of groups with write access to o,
   uo is a set of subjects which are owners of o,
   go is a set of groups wich are owners of o.

(set_In (o, (mkRW ar aw)) (secmat s): 
 iff (mkRW ar aw) are the subjects accessing object o in state s, in that case:
  ar: subjects reading from o
  aw: subjects writing into o

(set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s

(set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s.
*)

Record SFSstate : Set := mkSFS
  {groups : GRPNAME -> set SUBJECT;
   primaryGrp : SUBJECT -> GRPNAME;
   subjectSC : set (SUBJECT * SecClass);
   AllGrp : GRPNAME;
   RootGrp : GRPNAME;
   SecAdmGrp : GRPNAME;
   objectSC : set (OBJECT * SecClass);
   acl : set (OBJECT * AccessCtrlListData);
   secmat : set (OBJECT * ReadersWriters);
   files : set (OBJECT * FILECONT);
   directories : set (OBJECT * DIRCONT)}.(*Axioms needed for decidability                                     *) 
Axiom SSCeq_dec : forall x1 x2 : SUBJECT * SecClass, {x1 = x2} + {x1 <> x2}.Axiom OSCeq_dec : forall x1 x2 : OBJECT * SecClass, {x1 = x2} + {x1 <> x2}.Axiom
  ACLeq_dec :
    forall x1 x2 : OBJECT * AccessCtrlListData, {x1 = x2} + {x1 <> x2}.Axiom
  SECMATeq_dec :
    forall x1 x2 : OBJECT * ReadersWriters, {x1 = x2} + {x1 <> x2}.Axiom OBJFeq_dec : forall x1 x2 : OBJECT * FILECONT, {x1 = x2} + {x1 <> x2}.Axiom OBJDeq_dec : forall x1 x2 : OBJECT * DIRCONT, {x1 = x2} + {x1 <> x2}.(*Domain of a FPF*)
Fixpoint DOM (f : set (X * Y)) : set X :=
  match f with
  | nil => nil (A:=X)
  | (x, y) :: g => set_add Xeq_dec x (DOM g)
  end.(*Range of a FPF*)
Fixpoint RAN (f : set (X * Y)) : set Y :=
  match f with
  | nil => nil (A:=Y)
  | (x, y) :: g => set_add Yeq_dec y (RAN g)
  end.(*Application of a FPF*)
Fixpoint PARTFUNC (f : set (X * Y)) : X -> Exc Y :=
  fun x : X =>
  match f with
  | nil => None (A:=Y)
  | (x1, y) :: g =>
      match Xeq_dec x x1 with
      | left _ => Some y
      | right _ => PARTFUNC g x
      end
  end.(*Test to decide whether a set of pairs is a FPF or not*)
Fixpoint IsPARTFUNC (f : set (X * Y)) : Prop :=
  match f with
  | nil => True
  | a :: l =>
      match set_In_dec Xeq_dec (fst a) (DOM l) with
      | left _ => False
      | right _ => IsPARTFUNC l
      end
  end.

Lemma UndefWhenRem : forall (x : X) (y : Y) (f : set (X * Y)), IsPARTFUNC f -> set_In (x, y) f -> PARTFUNC (set_remove XYeq_dec (x, y) f) x = None.