StartPSS.
inversion H.
unfold SecureState in |- *.
BreakSS.
split.
unfold DACSecureState in |- *.
simpl in |- *.
intros.
elim (OBJeq_dec o o0).
intro.
rewrite <- a.
cut (fsecmat (secmat s) o = None).
intro.
rewrite H6.
eauto.
unfold fsecmat in |- *.
auto.
intro.
cut
(match fsecmat (secmat s) o0 with
| Some y => set_In u0 (ActReaders y) -> PreDACRead s u0 o0
| None => True
end /\
match fsecmat (secmat s) o0 with
| Some y => set_In u0 (ActWriters y) -> PreDACWrite s u0 o0
| None => True
end).
elim (fsecmat (secmat s) o0).
unfold PreDACRead, PreDACWrite, addUsrGrpToAcl_acl in |- *.
simpl in |- *.
elim (facl (acl s) o).
intro.
replace
(facl
(set_add ACLeq_dec
(o,
acldata (owner a) (group a) (set_add SUBeq_dec ru (UsersReaders a))
(set_add GRPeq_dec rg (GroupReaders a))
(set_add SUBeq_dec wu (UsersWriters a))
(set_add GRPeq_dec wg (GroupWriters a))
(set_add SUBeq_dec pu (UsersOwners a))
(set_add GRPeq_dec pg (GroupOwners a)))
(set_remove ACLeq_dec (o, a) (acl s))) o0) with
(facl (acl s) o0).
elim (facl (acl s) o0).
auto.
auto.
unfold facl in |- *.
auto.
auto.
trivial.
split.
apply ReadWriteImpRead.
auto.
apply ReadWriteImpWrite.
auto.
auto.
Qed.

(* Specifications: *)
Lemma AddUsrGrpToAclPSP :
forall (s t : SFSstate) (u : SUBJECT),
StarProperty s -> TransFunc u s AddUsrGrpToAcl t -> StarProperty t.