(*SUBJECT, Property and TransFunc*)
Ltac OpDontChangeStPSS :=
intros s t Sub SS TF; inversion TF;
match goal with
| id:(s = t) |- _ => rewrite <- id; auto
end.
Ltac OpDontChangeStPSP :=
intros s t Sub SP TF;  (* SUBJECT, Property and TransFunc *)
inversion TF; match goal with
| id:(s = t) |- _ => rewrite <- id; auto
end.
Ltac StartPSS := intros s t Sub SS TF; inversion TF.
Ltac BreakSS :=
match goal with
| SS:(SecureState _) |- _ =>
unfold SecureState in SS; elim SS; intros DAC MAC
end.
Ltac StartPSP := intros s t Sub SP TF; inversion TF.
unfold DACSecureState in |- *.
intros.
cut
match fsecmat (secmat s) o with
| Some y =>
(set_In u (ActReaders y) -> PreDACRead s u o) /\
(set_In u (ActWriters y) -> PreDACWrite s u o)
| None => True
end.
elim (fsecmat (secmat s) o).
intros.
elim H0; intros.
auto.
auto.
apply H.
Qed.
unfold DACSecureState in |- *.
intros.
cut
match fsecmat (secmat s) o with
| Some y =>
(set_In u (ActReaders y) -> PreDACRead s u o) /\
(set_In u (ActWriters y) -> PreDACWrite s u o)
| None => True
end.
elim (fsecmat (secmat s) o).
intros.
elim H0; intros.
auto.
auto.
apply H.
Qed.
intros.
cut (~ set_In u (ActReaders rw) /\ ~ set_In u (ActWriters rw)).
tauto.
auto.
Qed.
intros.
cut (~ set_In u (ActReaders rw) /\ ~ set_In u (ActWriters rw)).
tauto.
auto.
Qed.
intro; intro; unfold FuncPre1 in |- *; elim o; simpl in |- *; intros.
cut
((forall o : OBJECT,
set_In o (DOM OBJeq_dec (directories s)) -> ObjType o = Directory) /\
(forall o : OBJECT, set_In o (DOM OBJeq_dec (files s)) -> ObjType o = File) /\
DOM OBJeq_dec (acl s) =
set_union OBJeq_dec (DOM OBJeq_dec (files s))
(DOM OBJeq_dec (directories s))).
intro CUT; elim CUT; intros.
elim H3; intros.
rewrite H5; intro.
cut
(set_In (a, File) (domf (files s)) \/
set_In (a, Directory) (domd (directories s))).
intro H7; elim H7; intro.
auto.
auto.
generalize H6; elim b; intro.
left; cut (~ set_In (a, File) (DOM OBJeq_dec (directories s))).
intro; unfold domf in |- *.
cut
(set_In (a, File)
(set_union OBJeq_dec (DOM OBJeq_dec (directories s))
(DOM OBJeq_dec (files s)))).
intro; eauto.
auto.
intro; absurd (ObjType (a, File) = Directory).
simpl in |- *.
intro H11; discriminate H11.
auto.
auto.
right.
cut (~ set_In (a, Directory) (DOM OBJeq_dec (files s))).
intro; unfold domd in |- *; eauto.
intro; absurd (ObjType (a, Directory) = File).
simpl in |- *.
intro H11; discriminate H11.
auto.
auto.
Qed.
Hint Resolve UniqNames.
unfold eq_sc, le_sc in |- *; intros.
elim H; intros.
rewrite H0; rewrite H1.
auto.
Qed.
intros.
symmetry  in |- *.
rewrite H0 in H.
unfold fsecmat in |- *; apply NotInDOMIsUndef; auto.
Qed.
intros until o; elim o; simpl in |- *.
intros until b; elim b; intros.
rewrite <- H3.
symmetry  in |- *; unfold fsecmat in |- *; apply NotInDOMIsUndef.
cut (~ set_In (p, File) (DOM OBJeq_dec (acl s))).
unfold FuncPre3, Included in H3.
unfold FuncPre3, Included in H0.
auto.
apply UniqNames; auto.
rewrite <- H3.
symmetry  in |- *; unfold fsecmat in |- *; apply NotInDOMIsUndef.
cut (~ set_In (p, Directory) (DOM OBJeq_dec (acl s))).
unfold FuncPre3, Included in H3.
unfold FuncPre3, Included in H0.
auto.
apply UniqNames; auto.
Qed.
intros; unfold fOSC, chobjsc_SC in |- *.
elim (fOSC (objectSC s) o1).
intro; apply AddRemEq; auto.
auto.
Qed.
intros.
symmetry  in |- *; unfold fOSC in |- *; apply NotInDOMIsUndef.
replace (DOM OBJeq_dec (objectSC s)) with (DOM OBJeq_dec (acl s)).
rewrite H3 in H1; rewrite H3 in H2.
auto.
Qed.
intros.
unfold create_oSC in |- *.
elim (fSSC (subjectSC s) u); elim (fsecmat (secmat s) (MyDir p)).
intros; unfold fOSC in |- *; apply AddEq.
intro; apply H.
rewrite H0; simpl in |- *; auto.
auto.
auto.
auto.
Qed.
intros.
unfold mkdir_oSC in |- *.
elim (fSSC (subjectSC s) u); elim (fsecmat (secmat s) (MyDir p)).
intros; unfold fOSC in |- *; apply AddEq.
intro; apply H.
rewrite H0; simpl in |- *; auto.
auto.
auto.
auto.
Qed.
intros.
unfold unlink_oSC in |- *.
elim (fOSC (objectSC s) o1).
intro; unfold fOSC in |- *; apply RemEq.
auto.
auto.
Qed.
intros.
unfold create_acl in |- *.
elim (fSSC (subjectSC s) u); elim (fsecmat (secmat s) (MyDir p)).
intros; unfold facl in |- *; apply AddEq.
intro y1; apply H; rewrite y1; simpl in |- *; auto.
auto.
auto.
auto.
Qed.
intros.
unfold mkdir_acl in |- *.
elim (fSSC (subjectSC s) u); elim (fsecmat (secmat s) (MyDir p)).
intros; unfold facl in |- *; apply AddEq.
intro y1; apply H; rewrite y1; simpl in |- *; auto.
auto.
auto.
auto.
Qed.
intros.
unfold unlink_acl in |- *.
elim (facl (acl s) o1).
intros; unfold facl in |- *; apply RemEq.
auto.
auto.
Qed.
unfold facl in |- *.
intros until z.
cut
match PARTFUNC OBJeq_dec (acl s) o with
| Some y => set_In (o, y) (acl s)
| None => ~ set_In o (DOM OBJeq_dec (acl s))
end.
unfold rmdir_acl in |- *.
unfold facl in |- *.
elim (PARTFUNC OBJeq_dec (acl s) o).
intros.
cut (PARTFUNC OBJeq_dec (set_remove ACLeq_dec (o, a) (acl s)) o = None).
rewrite H2.
intro.
discriminate H3.
auto.
intros.
discriminate H1.
apply DOMFuncRel4.
Qed.
unfold facl in |- *.
intros until z.
cut
match PARTFUNC OBJeq_dec (acl s) o with
| Some y => set_In (o, y) (acl s)
| None => ~ set_In o (DOM OBJeq_dec (acl s))
end.
unfold unlink_acl in |- *.
unfold facl in |- *.
elim (PARTFUNC OBJeq_dec (acl s) o).
intros.
cut (PARTFUNC OBJeq_dec (set_remove ACLeq_dec (o, a) (acl s)) o = None).
rewrite H2.
intro.
discriminate H3.
auto.
intros.
discriminate H1.
apply DOMFuncRel4.
Qed.
unfold fOSC in |- *.
intros until z.
cut
match PARTFUNC OBJeq_dec (objectSC s) o with
| Some y => set_In (o, y) (objectSC s)
| None => ~ set_In o (DOM OBJeq_dec (objectSC s))
end.
unfold rmdir_oSC in |- *.
unfold fOSC in |- *.
elim (PARTFUNC OBJeq_dec (objectSC s) o).
intros.
cut (PARTFUNC OBJeq_dec (set_remove OSCeq_dec (o, a) (objectSC s)) o = None).
rewrite H2.
intro.
discriminate H3.
auto.
intros.
discriminate H1.
apply DOMFuncRel4.
Qed.
unfold fOSC in |- *.
intros until z.
cut
match PARTFUNC OBJeq_dec (objectSC s) o with
| Some y => set_In (o, y) (objectSC s)
| None => ~ set_In o (DOM OBJeq_dec (objectSC s))
end.
unfold unlink_oSC in |- *.
unfold fOSC in |- *.
elim (PARTFUNC OBJeq_dec (objectSC s) o).
intros.
cut (PARTFUNC OBJeq_dec (set_remove OSCeq_dec (o, a) (objectSC s)) o = None).
rewrite H2.
intro.
discriminate H3.
auto.
intros.
discriminate H1.
apply DOMFuncRel4.
Qed.

Lemma NoDACChange :
forall (s : SFSstate) (o : OBJECT) (SSC : set (SUBJECT * SecClass))
(OSC : set (OBJECT * SecClass)) (FILES : set (OBJECT * FILECONT))
(DIRECTS : set (OBJECT * DIRCONT)) (SM : set (OBJECT * ReadersWriters)),
~
DACCtrlAttrHaveChanged s
(mkSFS (groups s) (primaryGrp s) SSC (AllGrp s)
(RootGrp s) (SecAdmGrp s) OSC (acl s) SM FILES DIRECTS) o.