(*********************************************************************)
(*                     Secured FileSystem                            *)
(*********************************************************************)
(*This record represents the state of the filesystem from the security point of view. Designations for each field:  (groups g): all the subjects which belong to group g  (primaryGrp s): the (UNIX) primary group of subject s  (set_In (u,sc) (subjectSC s)): iff sc is the security class of u in state s  AllGrp: group containing all the system subjects  SecAdmGrp: group of the security administrators in charge of MAC attributes  RootGrp: group of all subjects with the same access of subject root  (set_In (o,sc) (objectSC s)): iff sc is the security class of o in state s  (set_In (o,(acldata o g ur gr uw gw uo go)) (acl s)): iff (acldata o g ur gr uw gw uo go) is the ACL of o in state s, in that case: o is the UNIX owner of o, g is the UNIX group of o, ur is a set of subjects with read access to o, gr is a set of groups with read access to o, uw is a set of subjects with write access to o, gw is a set of groups with write access to o, uo is a set of subjects which are owners of o, go is a set of groups wich are owners of o.  (set_In (o, (mkRW ar aw)) (secmat s): iff (mkRW ar aw) are the subjects accessing object o in state s, in that case: ar: subjects reading from o aw: subjects writing into o  (set_In (f,fc) (files s)): iff file name f with file content fc is stored in the file system in state s  (set_In (f,dc) (directories s)): iff directory name d with directory content dc is stored in the filesystem in state s. *)

(*Axioms needed for decidability                                     *)
Axiom SSCeq_dec : forall x1 x2 : SUBJECT * SecClass, {x1 = x2} + {x1 <> x2}.