(*SUBJECT, Property and TransFunc*)
Ltac OpDontChangeStPSS :=
intros s t Sub SS TF; inversion TF;
match goal with
| id:(s = t) |- _ => rewrite <- id; auto
end.
Ltac OpDontChangeStPSP :=
intros s t Sub SP TF;  (* SUBJECT, Property and TransFunc *)
inversion TF; match goal with
| id:(s = t) |- _ => rewrite <- id; auto
end.
Ltac StartPSS := intros s t Sub SS TF; inversion TF.
Ltac BreakSS :=
match goal with
| SS:(SecureState _) |- _ =>
unfold SecureState in SS; elim SS; intros DAC MAC
end.
Ltac StartPSP := intros s t Sub SP TF; inversion TF.
unfold DACSecureState in |- *.
intros.
cut
match fsecmat (secmat s) o with
| Some y =>
(set_In u (ActReaders y) -> PreDACRead s u o) /\
(set_In u (ActWriters y) -> PreDACWrite s u o)
| None => True
end.
elim (fsecmat (secmat s) o).
intros.
elim H0; intros.
auto.
auto.
apply H.
Qed.
unfold DACSecureState in |- *.
intros.
cut
match fsecmat (secmat s) o with
| Some y =>
(set_In u (ActReaders y) -> PreDACRead s u o) /\
(set_In u (ActWriters y) -> PreDACWrite s u o)
| None => True
end.
elim (fsecmat (secmat s) o).
intros.
elim H0; intros.
auto.
auto.
apply H.
Qed.
intros.
cut (~ set_In u (ActReaders rw) /\ ~ set_In u (ActWriters rw)).
tauto.
auto.
Qed.
intros.
cut (~ set_In u (ActReaders rw) /\ ~ set_In u (ActWriters rw)).
tauto.
auto.
Qed.
intro; intro; unfold FuncPre1 in |- *; elim o; simpl in |- *; intros.
cut
((forall o : OBJECT,
set_In o (DOM OBJeq_dec (directories s)) -> ObjType o = Directory) /\
(forall o : OBJECT, set_In o (DOM OBJeq_dec (files s)) -> ObjType o = File) /\
DOM OBJeq_dec (acl s) =
set_union OBJeq_dec (DOM OBJeq_dec (files s))
(DOM OBJeq_dec (directories s))).
intro CUT; elim CUT; intros.
elim H3; intros.
rewrite H5; intro.
cut
(set_In (a, File) (domf (files s)) \/
set_In (a, Directory) (domd (directories s))).
intro H7; elim H7; intro.
auto.
auto.
generalize H6; elim b; intro.
left; cut (~ set_In (a, File) (DOM OBJeq_dec (directories s))).
intro; unfold domf in |- *.
cut
(set_In (a, File)
(set_union OBJeq_dec (DOM OBJeq_dec (directories s))
(DOM OBJeq_dec (files s)))).
intro; eauto.
auto.
intro; absurd (ObjType (a, File) = Directory).
simpl in |- *.
intro H11; discriminate H11.
auto.
auto.
right.
cut (~ set_In (a, Directory) (DOM OBJeq_dec (files s))).
intro; unfold domd in |- *; eauto.
intro; absurd (ObjType (a, Directory) = File).
simpl in |- *.
intro H11; discriminate H11.
auto.
auto.
Qed.
Hint Resolve UniqNames.
unfold eq_sc, le_sc in |- *; intros.
elim H; intros.
rewrite H0; rewrite H1.
auto.
Qed.
intros.
symmetry  in |- *.
rewrite H0 in H.
unfold fsecmat in |- *; apply NotInDOMIsUndef; auto.
Qed.
intros until o; elim o; simpl in |- *.
intros until b; elim b; intros.
rewrite <- H3.
symmetry  in |- *; unfold fsecmat in |- *; apply NotInDOMIsUndef.
cut (~ set_In (p, File) (DOM OBJeq_dec (acl s))).
unfold FuncPre3, Included in H3.
unfold FuncPre3, Included in H0.
auto.
apply UniqNames; auto.
rewrite <- H3.
symmetry  in |- *; unfold fsecmat in |- *; apply NotInDOMIsUndef.
cut (~ set_In (p, Directory) (DOM OBJeq_dec (acl s))).
unfold FuncPre3, Included in H3.
unfold FuncPre3, Included in H0.
auto.
apply UniqNames; auto.
Qed.
intros; unfold fOSC, chobjsc_SC in |- *.
elim (fOSC (objectSC s) o1).
intro; apply AddRemEq; auto.
auto.
Qed.
intros.
symmetry  in |- *; unfold fOSC in |- *; apply NotInDOMIsUndef.
replace (DOM OBJeq_dec (objectSC s)) with (DOM OBJeq_dec (acl s)).
rewrite H3 in H1; rewrite H3 in H2.
auto.
Qed.
intros.
unfold create_oSC in |- *.
elim (fSSC (subjectSC s) u); elim (fsecmat (secmat s) (MyDir p)).
intros; unfold fOSC in |- *; apply AddEq.
intro; apply H.
rewrite H0; simpl in |- *; auto.
auto.
auto.
auto.
Qed.
intros.
unfold mkdir_oSC in |- *.
elim (fSSC (subjectSC s) u); elim (fsecmat (secmat s) (MyDir p)).
intros; unfold fOSC in |- *; apply AddEq.
intro; apply H.
rewrite H0; simpl in |- *; auto.
auto.
auto.
auto.
Qed.
intros.
unfold unlink_oSC in |- *.
elim (fOSC (objectSC s) o1).
intro; unfold fOSC in |- *; apply RemEq.
auto.
auto.
Qed.
intros.
unfold create_acl in |- *.
elim (fSSC (subjectSC s) u); elim (fsecmat (secmat s) (MyDir p)).
intros; unfold facl in |- *; apply AddEq.
intro y1; apply H; rewrite y1; simpl in |- *; auto.
auto.
auto.
auto.
Qed.
intros.
unfold mkdir_acl in |- *.
elim (fSSC (subjectSC s) u); elim (fsecmat (secmat s) (MyDir p)).
intros; unfold facl in |- *; apply AddEq.
intro y1; apply H; rewrite y1; simpl in |- *; auto.
auto.
auto.
auto.
Qed.
intros.
unfold unlink_acl in |- *.
elim (facl (acl s) o1).
intros; unfold facl in |- *; apply RemEq.
auto.
auto.
Qed.
unfold facl in |- *.
intros until z.
cut
match PARTFUNC OBJeq_dec (acl s) o with
| Some y => set_In (o, y) (acl s)
| None => ~ set_In o (DOM OBJeq_dec (acl s))
end.
unfold rmdir_acl in |- *.
unfold facl in |- *.
elim (PARTFUNC OBJeq_dec (acl s) o).
intros.
cut (PARTFUNC OBJeq_dec (set_remove ACLeq_dec (o, a) (acl s)) o = None).
rewrite H2.
intro.
discriminate H3.
auto.
intros.
discriminate H1.
apply DOMFuncRel4.
Qed.
unfold facl in |- *.
intros until z.
cut
match PARTFUNC OBJeq_dec (acl s) o with
| Some y => set_In (o, y) (acl s)
| None => ~ set_In o (DOM OBJeq_dec (acl s))
end.
unfold unlink_acl in |- *.
unfold facl in |- *.
elim (PARTFUNC OBJeq_dec (acl s) o).
intros.
cut (PARTFUNC OBJeq_dec (set_remove ACLeq_dec (o, a) (acl s)) o = None).
rewrite H2.
intro.
discriminate H3.
auto.
intros.
discriminate H1.
apply DOMFuncRel4.
Qed.
unfold fOSC in |- *.
intros until z.
cut
match PARTFUNC OBJeq_dec (objectSC s) o with
| Some y => set_In (o, y) (objectSC s)
| None => ~ set_In o (DOM OBJeq_dec (objectSC s))
end.
unfold rmdir_oSC in |- *.
unfold fOSC in |- *.
elim (PARTFUNC OBJeq_dec (objectSC s) o).
intros.
cut (PARTFUNC OBJeq_dec (set_remove OSCeq_dec (o, a) (objectSC s)) o = None).
rewrite H2.
intro.
discriminate H3.
auto.
intros.
discriminate H1.
apply DOMFuncRel4.
Qed.
unfold fOSC in |- *.
intros until z.
cut
match PARTFUNC OBJeq_dec (objectSC s) o with
| Some y => set_In (o, y) (objectSC s)
| None => ~ set_In o (DOM OBJeq_dec (objectSC s))
end.
unfold unlink_oSC in |- *.
unfold fOSC in |- *.
elim (PARTFUNC OBJeq_dec (objectSC s) o).
intros.
cut (PARTFUNC OBJeq_dec (set_remove OSCeq_dec (o, a) (objectSC s)) o = None).
rewrite H2.
intro.
discriminate H3.
auto.
intros.
discriminate H1.
apply DOMFuncRel4.
Qed.
intros.
intro.
inversion H; simpl in H1; cut (y = z).
intro EQ; rewrite EQ in H2; inversion H2; auto.
rewrite H0 in H1; injection H1; auto.
intro EQ; rewrite EQ in H2; inversion H2; auto.
rewrite H0 in H1; injection H1; auto.
Qed.
intros; intro;
eapply
(NoDACChange s o (subjectSC s) (objectSC s) (files s)
(directories s) (secmat s)).
generalize H; elim s; simpl in |- *; auto.
Qed.
intros; intro.
inversion H; simpl in H1.
cut (x = y).
intro EQ; rewrite EQ in H2; inversion H2; auto.
rewrite H0 in H1; injection H1; auto.
Qed.
intros; intro;
eapply
(NoMACObjChange s o (files s) (directories s) (acl s)
(subjectSC s) (secmat s)).
generalize H; elim s; simpl in |- *; auto.
Qed.
intros; intro; inversion H.
simpl in H1.
cut (x = y).
intro EQ; rewrite EQ in H2; inversion H2; auto.
rewrite H0 in H1; injection H1; auto.
Qed.
intros; intro;
eapply
(NoMACSubChange s u (acl s) (objectSC s) (files s)
(directories s) (secmat s)).
generalize H; elim s; simpl in |- *; auto.
Qed.
unfold eq_sc in |- *; intros.
elim H; intros.
rewrite H0; rewrite H1.
auto.
Qed.
intros.
cut (~ set_In u (ActReaders y) /\ ~ set_In u (ActWriters y)).
tauto.
auto.
Qed.
intros; unfold chsubsc_SC in |- *.
elim (fSSC (subjectSC s) u).
intros; unfold fSSC in |- *; apply AddRemEq; auto.
auto.
Qed.
intros until o.
cut
match fsecmat (secmat s) o with
| Some y => set_In (o, y) (secmat s)
| None => ~ set_In o (DOM OBJeq_dec (secmat s))
end.
unfold close_sm in |- *.
elim (fsecmat (secmat s) o); intros.
elim (set_remove SUBeq_dec Sub (ActReaders a));
elim (set_remove SUBeq_dec Sub (ActWriters a)).
replace (fsecmat (set_remove SECMATeq_dec (o, a) (secmat s)) o) with
(None (A:=ReadersWriters)).
auto.
symmetry  in |- *; unfold fsecmat in |- *; unfold FuncPre5 in H0; auto.
intros.
replace
(fsecmat
(set_add SECMATeq_dec (o, NEWRW Sub o a)
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (NEWRW Sub o a)).
unfold NEWRW in |- *; simpl in |- *; split; apply Set_remove1.
unfold fsecmat in |- *; apply AddEq1.
auto.
intros;
replace
(fsecmat
(set_add SECMATeq_dec (o, NEWRW Sub o a)
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (NEWRW Sub o a)).
unfold NEWRW in |- *; simpl in |- *; split; apply Set_remove1.
unfold fsecmat in |- *; apply AddEq1.
auto.
intros;
replace
(fsecmat
(set_add SECMATeq_dec (o, NEWRW Sub o a)
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (NEWRW Sub o a)).
unfold NEWRW in |- *; simpl in |- *; split; apply Set_remove1.
unfold fsecmat in |- *; apply AddEq1.
auto.
tauto.
unfold fsecmat in |- *; apply DOMFuncRel4.
Qed.
intros until o.
cut
match fsecmat (secmat s) o with
| Some y => set_In (o, y) (secmat s)
| None => ~ set_In o (DOM OBJeq_dec (secmat s))
end.
unfold close_sm in |- *.
elim (fsecmat (secmat s) o); intros.
elim (set_remove SUBeq_dec Sub (ActReaders a));
elim (set_remove SUBeq_dec Sub (ActWriters a)).
replace (fsecmat (set_remove SECMATeq_dec (o, a) (secmat s)) o) with
(None (A:=ReadersWriters)).
auto.
symmetry  in |- *; unfold fsecmat in |- *; unfold FuncPre5 in H; auto.
intros.
replace
(fsecmat
(set_add SECMATeq_dec (o, NEWRW Sub o a)
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (NEWRW Sub o a)).
unfold NEWRW in |- *; simpl in |- *.
split;
[ intro;
eapply
(Set_remove2 (A:=SUBJECT) (Aeq_dec:=SUBeq_dec) (B:=
ActReaders a) (x:=u0) (y:=Sub)); auto
| intro;
eapply
(Set_remove2 (A:=SUBJECT) (Aeq_dec:=SUBeq_dec) (B:=
ActWriters a) (x:=u0) (y:=Sub)); auto ].
unfold fsecmat in |- *; apply AddEq1.
auto.
intros.
replace
(fsecmat
(set_add SECMATeq_dec (o, NEWRW Sub o a)
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (NEWRW Sub o a)).
unfold NEWRW in |- *; simpl in |- *.
split;
[ intro;
eapply
(Set_remove2 (A:=SUBJECT) (Aeq_dec:=SUBeq_dec) (B:=
ActReaders a) (x:=u0) (y:=Sub)); auto
| intro;
eapply
(Set_remove2 (A:=SUBJECT) (Aeq_dec:=SUBeq_dec) (B:=
ActWriters a) (x:=u0) (y:=Sub)); auto ].
unfold fsecmat in |- *; apply AddEq1.
auto.
intros.
replace
(fsecmat
(set_add SECMATeq_dec (o, NEWRW Sub o a)
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (NEWRW Sub o a)).
unfold NEWRW in |- *; simpl in |- *.
split;
[ intro;
eapply
(Set_remove2 (A:=SUBJECT) (Aeq_dec:=SUBeq_dec) (B:=
ActReaders a) (x:=u0) (y:=Sub)); auto
| intro;
eapply
(Set_remove2 (A:=SUBJECT) (Aeq_dec:=SUBeq_dec) (B:=
ActWriters a) (x:=u0) (y:=Sub)); auto ].
unfold fsecmat in |- *; apply AddEq1.
auto.
tauto.
unfold fsecmat in |- *; apply DOMFuncRel4.
Qed.
unfold close_sm, fsecmat in |- *; intros;
elim (PARTFUNC OBJeq_dec (secmat s) o1).
intro; elim (set_remove SUBeq_dec u (ActReaders a));
elim (set_remove SUBeq_dec u (ActWriters a)).
auto.
auto.
auto.
auto.
auto.
Qed.
intros until o; unfold close_sm in |- *.
intro.
generalize H.
elim (fsecmat (secmat s) o).
intros y H0; discriminate H0.
auto.
Qed.
intros until o.
cut
match fsecmat (secmat s) o with
| Some y => set_In (o, y) (secmat s)
| None => ~ set_In o (DOM OBJeq_dec (secmat s))
end.
unfold ownerclose_sm in |- *.
elim (fsecmat (secmat s) o); intros.
elim (set_remove SUBeq_dec Sub (ActReaders a));
elim (set_remove SUBeq_dec Sub (ActWriters a)).
replace (fsecmat (set_remove SECMATeq_dec (o, a) (secmat s)) o) with
(None (A:=ReadersWriters)).
auto.
symmetry  in |- *; unfold fsecmat in |- *; unfold FuncPre5 in H0; auto.
intros.
replace
(fsecmat
(set_add SECMATeq_dec (o, NEWRWOC Sub o a)
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (NEWRWOC Sub o a)).
unfold NEWRWOC in |- *; simpl in |- *.
split;
[ intro;
eapply
(Set_remove2 (A:=SUBJECT) (Aeq_dec:=SUBeq_dec) (B:=
ActReaders a) (x:=u0) (y:=Sub)); auto
| intro;
eapply
(Set_remove2 (A:=SUBJECT) (Aeq_dec:=SUBeq_dec) (B:=
ActWriters a) (x:=u0) (y:=Sub)); auto ].
unfold fsecmat in |- *; apply AddEq1.
auto.
intros.
replace
(fsecmat
(set_add SECMATeq_dec (o, NEWRWOC Sub o a)
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (NEWRWOC Sub o a)).
unfold NEWRWOC in |- *; simpl in |- *.
split;
[ intro;
eapply
(Set_remove2 (A:=SUBJECT) (Aeq_dec:=SUBeq_dec) (B:=
ActReaders a) (x:=u0) (y:=Sub)); auto
| intro;
eapply
(Set_remove2 (A:=SUBJECT) (Aeq_dec:=SUBeq_dec) (B:=
ActWriters a) (x:=u0) (y:=Sub)); auto ].
unfold fsecmat in |- *; apply AddEq1.
auto.
intros.
replace
(fsecmat
(set_add SECMATeq_dec (o, NEWRWOC Sub o a)
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (NEWRWOC Sub o a)).
unfold NEWRWOC in |- *; simpl in |- *.
split;
[ intro;
eapply
(Set_remove2 (A:=SUBJECT) (Aeq_dec:=SUBeq_dec) (B:=
ActReaders a) (x:=u0) (y:=Sub)); auto
| intro;
eapply
(Set_remove2 (A:=SUBJECT) (Aeq_dec:=SUBeq_dec) (B:=
ActWriters a) (x:=u0) (y:=Sub)); auto ].
unfold fsecmat in |- *; apply AddEq1.
auto.
tauto.
unfold fsecmat in |- *; apply DOMFuncRel4.
Qed.
unfold ownerclose_sm, fsecmat in |- *; intros;
elim (PARTFUNC OBJeq_dec (secmat s) o1).
intro; elim (set_remove SUBeq_dec u (ActReaders a));
elim (set_remove SUBeq_dec u (ActWriters a)).
auto.
auto.
auto.
auto.
auto.
Qed.
intros until o; unfold ownerclose_sm in |- *.
intro.
generalize H.
elim (fsecmat (secmat s) o).
intros y H0; discriminate H0.
auto.
Qed.
intros until m; intro; unfold open_sm in |- *.
cut
match fsecmat (secmat s) o with
| Some y => set_In (o, y) (secmat s)
| None => ~ set_In o (DOM OBJeq_dec (secmat s))
end.
elim m; elim (fsecmat (secmat s) o).
intro; intro;
replace
(fsecmat
(set_add SECMATeq_dec
(o, mkRW (set_add SUBeq_dec Sub (ActReaders a)) (ActWriters a))
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (mkRW (set_add SUBeq_dec Sub (ActReaders a)) (ActWriters a))).
intros H2; discriminate H2.
unfold fsecmat in |- *; apply AddEq1; auto.
intro;
replace
(fsecmat
(set_add SECMATeq_dec
(o,
mkRW (set_add SUBeq_dec Sub (empty_set SUBJECT)) (empty_set SUBJECT))
(secmat s)) o) with
(Some
(mkRW (set_add SUBeq_dec Sub (empty_set SUBJECT)) (empty_set SUBJECT))).
intro H2; discriminate H2.
unfold fsecmat in |- *; apply AddEq1; auto.
intro; intro;
replace
(fsecmat
(set_add SECMATeq_dec
(o, mkRW (ActReaders a) (set_add SUBeq_dec Sub (ActWriters a)))
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (mkRW (ActReaders a) (set_add SUBeq_dec Sub (ActWriters a)))).
intro H2; discriminate H2.
unfold fsecmat in |- *; apply AddEq1; auto.
intro;
replace
(fsecmat
(set_add SECMATeq_dec
(o,
mkRW (empty_set SUBJECT) (set_add SUBeq_dec Sub (empty_set SUBJECT)))
(secmat s)) o) with
(Some
(mkRW (empty_set SUBJECT) (set_add SUBeq_dec Sub (empty_set SUBJECT)))).
intro H2; discriminate H2.
unfold fsecmat in |- *; apply AddEq1; auto.
unfold fsecmat in |- *; apply DOMFuncRel4.
Qed.
intros.
cut
match fsecmat (secmat s) o with
| Some y => set_In (o, y) (secmat s)
| None => ~ set_In o (DOM OBJeq_dec (secmat s))
end.
unfold open_sm in |- *.
elim (fsecmat (secmat s) o).
intros;
replace
(fsecmat
(set_add SECMATeq_dec
(o, mkRW (set_add SUBeq_dec Sub (ActReaders a)) (ActWriters a))
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (mkRW (set_add SUBeq_dec Sub (ActReaders a)) (ActWriters a))).
simpl in |- *.
split; (intros; eauto).
unfold fsecmat in |- *; apply AddEq1; auto.
intros;
replace
(fsecmat
(set_add SECMATeq_dec
(o,
mkRW (set_add SUBeq_dec Sub (empty_set SUBJECT)) (empty_set SUBJECT))
(secmat s)) o) with
(Some
(mkRW (set_add SUBeq_dec Sub (empty_set SUBJECT)) (empty_set SUBJECT))).
auto.
unfold fsecmat in |- *; apply AddEq1; auto.
unfold fsecmat in |- *; apply DOMFuncRel4.
Qed.
intros.
cut
match fsecmat (secmat s) o with
| Some y => set_In (o, y) (secmat s)
| None => ~ set_In o (DOM OBJeq_dec (secmat s))
end.
unfold open_sm in |- *.
elim (fsecmat (secmat s) o).
intros;
replace
(fsecmat
(set_add SECMATeq_dec
(o, mkRW (ActReaders a) (set_add SUBeq_dec Sub (ActWriters a)))
(set_remove SECMATeq_dec (o, a) (secmat s))) o) with
(Some (mkRW (ActReaders a) (set_add SUBeq_dec Sub (ActWriters a)))).
simpl in |- *.
split; (intro; eauto).
unfold fsecmat in |- *; apply AddEq1; auto.
intros;
replace
(fsecmat
(set_add SECMATeq_dec
(o,
mkRW (empty_set SUBJECT) (set_add SUBeq_dec Sub (empty_set SUBJECT)))
(secmat s)) o) with
(Some
(mkRW (empty_set SUBJECT) (set_add SUBeq_dec Sub (empty_set SUBJECT)))).
auto.
unfold fsecmat in |- *; apply AddEq1; auto.
unfold fsecmat in |- *; apply DOMFuncRel4.
Qed.

Lemma Eqfsecmat3 :
forall (s : SFSstate) (o1 o2 : OBJECT) (u : SUBJECT) (m : MODE),
o1 <> o2 -> fsecmat (secmat s) o2 = fsecmat (open_sm s u o1 m) o2.