Require Export ListFunctions.
Set Implicit Arguments.
Unset Strict Implicit.
(*Definition of security class, and its standard partial order.      *)
(* SECLEV: security levels CATEGORY: categories, departments or need-to-know *)
Definition SECLEV := nat.
Parameter CATEGORY : Set.
(*SecClass: security class or access class*)
Record SecClass : Set := sclass {level : SECLEV; categs : set CATEGORY}.
Definition eq_sc (a b : SecClass) : Prop :=
level a = level b /\ categs a = categs b.
Definition le_sc (a b : SecClass) : Prop :=
level a <= level b /\ Included (categs a) (categs b).
Hint Unfold eq_sc le_sc.
(*********************************************************************)
(*                  Security Policy Subjects                         *)
(*********************************************************************)
(*This are global parameters introducing the basic sets of the model.*)
(* SUBJECT: all the subjects of the system GRPNAME: all the group names of the system root: UNIX superuser secofr: security officer, in charge of MAC attributes *)
Parameter SUBJECT GRPNAME : Set.
Parameter root secofr : SUBJECT.
(*These axioms are needed by functions of ListSet.                   *)
Hint Resolve SUBeq_dec GRPeq_dec.
(*********************************************************************)
(*                         The Filesystem                            *)
(*********************************************************************)
(* OBJNAME: all the possible absolute path names for files and directories BYTE: elements that can be stored in a file *)
Parameter OBJNAME BYTE : Set.
Hint Resolve OBJNAMEeq_dec BYTEeq_dec.
(*OBJTYPE: used to distinguish between files and directories*)
Inductive OBJTYPE : Set :=
| File : OBJTYPE
| Directory : OBJTYPE.
intros.
elim x; elim y.
left; auto.
right; intro; discriminate H.
right; intro; discriminate H.
left; auto.
Qed.
Hint Resolve OBJTYPEeq_dec.
(*FILECONT: all the possible contents of files*)
Definition FILECONT := list BYTE.
unfold FILECONT in |- *; intros; apply Listeq_dec.
auto.
Qed.
Hint Resolve FILECONTeq_dec.
(*DIRCONT: all the possible contents of directories*)
Definition DIRCONT := list OBJNAME.
unfold DIRCONT in |- *; intros; apply Listeq_dec.
auto.
Qed.
Hint Resolve DIRCONTeq_dec.
Definition OBJECT := (OBJNAME * OBJTYPE)%type.
unfold OBJECT in |- *.
intros.
apply Prodeq_dec; auto.
Qed.
(*MyDir(o): parent directory of object o*)
Parameter MyDir : OBJNAME -> OBJECT.
Definition ObjName (o : OBJECT) : OBJNAME := fst o.
Definition ObjType (o : OBJECT) : OBJTYPE := snd o.
(*********************************************************************)
(*                  Security Policy Objects                          *)
(*********************************************************************)
(* (allowedTo a b): if a pattern-matches (PM) true, then read access is allowed; otherwise it isn' if b PM true, then write access is allowed; otherwise it isn't *)
Record RIGHTS : Set := allowedTo {read_right : bool; write_right : bool}.
(* (rwx o g a): if o PM (allowedTo x y) then the owner has or has't read and/or write access; if g PM (allowedTo x y) then group g has or has't read and/or write access; if a PM (allowedTo x y) then all the system subjects has or has't read and/or write access *)
Record PERMS : Set := rwx {ownerp : RIGHTS; groupp : RIGHTS; otherp : RIGHTS}.
(*Designated below*)
Record AccessCtrlListData : Set := acldata
{owner : SUBJECT;
group : GRPNAME;
UsersReaders : set SUBJECT;
GroupReaders : set GRPNAME;
UsersWriters : set SUBJECT;
GroupWriters : set GRPNAME;
UsersOwners : set SUBJECT;
GroupOwners : set GRPNAME}.
(*Designated below*)
Record ReadersWriters : Set := mkRW
{ActReaders : set SUBJECT; ActWriters : set SUBJECT}.
(*********************************************************************)
(*                     Secured FileSystem                            *)
(*********************************************************************)
(*This record represents the state of the filesystem from the security point of view. Designations for each field:  (groups g): all the subjects which belong to group g  (primaryGrp s): the (UNIX) primary group of subject s  (set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s  AllGrp: group containing all the system subjects  SecAdmGrp: group of the security administrators in charge of MAC attributes  RootGrp: group of all subjects with the same access of subject root  (set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s  (set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)): iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case: o is the UNIX owner of o, g is the UNIX group of o, ur is a set of subjects with read access to o, gr is a set of groups with read access to o, uw is a set of subjects with write access to o, gw is a set of groups with write access to o, uo is a set of subjects which are owners of o, go is a set of groups wich are owners of o.  (set_In (o, (mkRW ar aw)) (secmat s): iff (mkRW ar aw) are the subjects accessing object o in state s, in that case: ar: subjects reading from o aw: subjects writing into o  (set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s  (set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s. *)
Record SFSstate : Set := mkSFS
{groups : GRPNAME -> set SUBJECT;
primaryGrp : SUBJECT -> GRPNAME;
subjectSC : set (SUBJECT * SecClass);
AllGrp : GRPNAME;
RootGrp : GRPNAME;
SecAdmGrp : GRPNAME;
objectSC : set (OBJECT * SecClass);
acl : set (OBJECT * AccessCtrlListData);
secmat : set (OBJECT * ReadersWriters);
files : set (OBJECT * FILECONT);
directories : set (OBJECT * DIRCONT)}.

(*Axioms needed for decidability                                     *)
Axiom SSCeq_dec : forall x1 x2 : SUBJECT * SecClass, {x1 = x2} + {x1 <> x2}.
Axiom OSCeq_dec : forall x1 x2 : OBJECT * SecClass, {x1 = x2} + {x1 <> x2}.