Section delUsrGrpFromAclIsSecure.
StartPSS.
inversion H.
unfold SecureState in |- *.
BreakSS.
split.
unfold DACSecureState in |- *.
simpl in |- *.
intros.
elim (OBJeq_dec o o0).
intro.
rewrite <- a.
cut (fsecmat (secmat s) o = None).
intro.
rewrite H7.
eauto.
unfold fsecmat in |- *.
auto.
intro.
cut
(match fsecmat (secmat s) o0 with
| Some y => set_In u0 (ActReaders y) -> PreDACRead s u0 o0
| None => True
end /\
match fsecmat (secmat s) o0 with
| Some y => set_In u0 (ActWriters y) -> PreDACWrite s u0 o0
| None => True
end).
elim (fsecmat (secmat s) o0).
unfold PreDACRead, PreDACWrite, delUsrGrpFromAcl_acl in |- *.
simpl in |- *.
elim (facl (acl s) o).
intro.
replace
(facl
(set_add ACLeq_dec
(o,
acldata
match SUBeq_dec (owner a) pu with
| left _ => root
| right _ => owner a
end (group a) (set_remove SUBeq_dec ru (UsersReaders a))
(set_remove GRPeq_dec rg (GroupReaders a))
(set_remove SUBeq_dec wu (UsersWriters a))
(set_remove GRPeq_dec wg (GroupWriters a))
match SUBeq_dec (owner a) pu with
| left _ =>
set_add SUBeq_dec root (set_remove SUBeq_dec pu (UsersOwners a))
| right _ => set_remove SUBeq_dec pu (UsersOwners a)
end (set_remove GRPeq_dec pg (GroupOwners a)))
(set_remove ACLeq_dec (o, a) (acl s))) o0) with
(facl (acl s) o0).
elim (facl (acl s) o0).
auto.
auto.
unfold facl in |- *.
auto.
auto.
tauto.
split.
apply ReadWriteImpRead.
auto.
apply ReadWriteImpWrite.
auto.
auto.
Qed.
StartPSP.
inversion H; auto.
Qed.

Lemma DelUsrGrpFromAclPCP :
forall s t : SFSstate, PreservesControlProp s DelUsrGrpFromAcl t.