Require Import ModelProperties. 
Require Import AuxiliaryLemmas. 
 
Section openIsSecure. 
 
Lemma OpenPSS :
 forall (s t : SFSstate) (u : SUBJECT),
 FuncPre5 s -> SecureState s -> TransFunc u s Open t -> SecureState t. 
(* Goal: forall (s t : SFSstate) (u : SUBJECT) (_ : FuncPre5 s) (_ : SecureState s) (_ : TransFunc u s Open t), SecureState t *)
intros s t Sub FP5 SS TF; inversion TF. 
(* Goal: and (forall o : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s t o, ExecuterIsOwner s Sub o) (forall _ : MACObjCtrlAttrHaveChanged s t o, @set_In SUBJECT Sub (groups s (SecAdmGrp s)))) (forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s t u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
inversion H. 
unfold SecureState, DACSecureState, MACSecureState in |- *; simpl in |- *;
 BreakSS. 
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
split; intros. 
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
elim (OBJeq_dec o o0); intro EQo. 
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
rewrite <- EQo. 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
elim (SUBeq_dec Sub u0); intro EQu. 
(* Goal: forall (_ : match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end) (_ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end), match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQu. 
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) Sub o) (forall _ : @set_In SUBJECT Sub (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) Sub o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
unfold open_sm at 1, PreDACRead, PreDACWrite in |- *; simpl in |- *. 
cut
 match fsecmat (secmat s) o with
 | Some y => set_In (o, y) (secmat s)
 | None => ~ set_In o (DOM OBJeq_dec (secmat s))
 end. 
cut
 match fsecmat (secmat s) o with
 | None => True
 | Some y => set_In Sub (ActWriters y) -> PreDACWrite s Sub o
 end. 
(* Goal: forall (_ : match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end) (_ : match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end), match fsecmat match fsecmat (secmat s) o with | Some y => @set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (ActReaders y) (@set_add SUBJECT SUBeq_dec Sub (ActWriters y)))) (@set_remove (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o y) (secmat s)) | None => @set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (secmat s) end o with | Some y => and (forall _ : @set_In SUBJECT Sub (ActReaders y), match facl (acl s) o with | Some y0 => or (@set_In SUBJECT Sub (UsersReaders y0)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y0)))) | None => False end) (forall _ : @set_In SUBJECT Sub (ActWriters y), match facl (acl s) o with | Some y0 => or (@set_In SUBJECT Sub (UsersWriters y0)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y0)))) | None => False end) | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
elim (fsecmat (secmat s) o). 
intros;
 replace
  (fsecmat
     (set_add SECMATeq_dec
        (o, mkRW (set_add SUBeq_dec Sub (ActReaders a)) (ActWriters a))
        (set_remove SECMATeq_dec (o, a) (secmat s))) o) with
  (Some (mkRW (set_add SUBeq_dec Sub (ActReaders a)) (ActWriters a))). 
(* Goal: and (forall _ : @set_In SUBJECT Sub (ActReaders (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT Sub (ActWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: @eq (option ReadersWriters) (@Some ReadersWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (fsecmat (@set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (secmat s)) o) *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
simpl in |- *. 
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
split; intros. 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
unfold PreDACWrite in H9; apply H9; auto. 
 
(* Goal: @eq (option ReadersWriters) (@Some ReadersWriters (mkRW (@set_add SUBJECT SUBeq_dec Sub (ActReaders a)) (ActWriters a))) (fsecmat (@set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (@set_add SUBJECT SUBeq_dec Sub (ActReaders a)) (ActWriters a))) (@set_remove (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o a) (secmat s))) o) *)
(* Goal: forall (_ : True) (_ : not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s)))), match fsecmat (@set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (@cons SUBJECT Sub (@nil SUBJECT)) (empty_set SUBJECT))) (secmat s)) o with | Some y => and (forall _ : @set_In SUBJECT Sub (ActReaders y), match facl (acl s) o with | Some y0 => or (@set_In SUBJECT Sub (UsersReaders y0)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y0)))) | None => False end) (forall _ : @set_In SUBJECT Sub (ActWriters y), match facl (acl s) o with | Some y0 => or (@set_In SUBJECT Sub (UsersWriters y0)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y0)))) | None => False end) | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActWriters y), PreDACWrite s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: SecureState (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
unfold fsecmat in |- *; apply AddEq1. 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
intros;
 replace
  (fsecmat
     (set_add SECMATeq_dec (o, mkRW (Sub :: nil) (empty_set SUBJECT))
        (secmat s)) o) with (Some (mkRW (Sub :: nil) (empty_set SUBJECT))). 
(* Goal: and (forall _ : @set_In SUBJECT Sub (ActReaders (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT Sub (ActWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: @eq (option ReadersWriters) (@Some ReadersWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (fsecmat (@set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (secmat s)) o) *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
simpl in |- *. 
(* Goal: and (forall _ : or (@eq SUBJECT Sub Sub) False, match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : False, match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: @eq (option ReadersWriters) (@Some ReadersWriters (mkRW (@cons SUBJECT Sub (@nil SUBJECT)) (empty_set SUBJECT))) (fsecmat (@set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (@cons SUBJECT Sub (@nil SUBJECT)) (empty_set SUBJECT))) (secmat s)) o) *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActWriters y), PreDACWrite s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: SecureState (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
split; (intro H12; elim H12). 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
tauto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
unfold fsecmat in |- *; apply AddEq1; auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
apply ReadWriteImpWrite; auto. 
 
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
unfold fsecmat in |- *; apply DOMFuncRel4. 
 
cut
 match fsecmat (open_sm s Sub o READ) o, fsecmat (secmat s) o with
 | Some y, None =>
     ActReaders y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\
     ActWriters y = empty_set SUBJECT
 | None, _ => False
 | Some y, Some z =>
     (set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)) /\
     (set_In u0 (ActWriters y) -> set_In u0 (ActWriters z))
 end. 
cut
 match fsecmat (secmat s) o with
 | None => True
 | Some y =>
     (set_In u0 (ActReaders y) -> PreDACRead s u0 o) /\
     (set_In u0 (ActWriters y) -> PreDACWrite s u0 o)
 end. 
unfold PreDACRead, PreDACWrite in |- *; simpl in |- *;
 elim (fsecmat (secmat s) o); elim (fsecmat (open_sm s Sub o READ) o). 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
tauto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
split; intros. 
(* Goal: match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end *)
(* Goal: match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
elim H10; intros. 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
absurd (Sub = u0); auto. 
(* Goal: @eq SUBJECT Sub u0 *)
(* Goal: match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActReaders y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActWriters y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: SecureState (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
rewrite H12 in H11. 
(* Goal: @eq SUBJECT Sub u0 *)
(* Goal: match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
simpl in H11. 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
tauto. 
 
(* Goal: match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActReaders y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActWriters y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: SecureState (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
elim H10; intros H12 H13; rewrite H13 in H11; simpl in H13; contradiction. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
apply DAC. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
apply Open_smCorr21; auto. 
 
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: SecureState (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
replace (fsecmat (open_sm s Sub o READ) o0) with (fsecmat (secmat s) o0). 
unfold PreDACRead, PreDACWrite in |- *; simpl in |- *;
 unfold DACSecureState, PreDACRead, PreDACWrite in DAC; 
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
 apply DAC. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: and (forall _ : @set_In SUBJECT Sub (ActReaders (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT Sub (ActWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: @eq (option ReadersWriters) (@Some ReadersWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (fsecmat (@set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (secmat s)) o) *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
unfold MACSecureState in |- *; intros; simpl in |- *. 
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
elim (OBJeq_dec o o0); intro EQo. 
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
rewrite <- EQo. 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
elim (SUBeq_dec Sub u0); intro EQu. 
(* Goal: forall (_ : match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end) (_ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end), match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQu. 
(* Goal: and (forall _ : @set_In SUBJECT Sub (ActReaders (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT Sub (ActWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: @eq (option ReadersWriters) (@Some ReadersWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (fsecmat (@set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (secmat s)) o) *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
unfold open_sm in |- *; simpl in |- *. 
cut
 match fsecmat (secmat s) o with
 | Some y => set_In (o, y) (secmat s)
 | None => ~ set_In o (DOM OBJeq_dec (secmat s))
 end. 
cut
 match fOSC (objectSC s) o with
 | Some t =>
     match fSSC (subjectSC s) Sub with
     | Some b => le_sc t b
     | None => False
     end
 | None =>
     match fSSC (subjectSC s) Sub with
     | Some _ => False
     | None => False
     end
 end. 
elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fSSC (subjectSC s) Sub); contradiction || auto. 
intros until a1;
 elim
  (fsecmat
     (set_add SECMATeq_dec
        (o, mkRW (set_add SUBeq_dec Sub (ActReaders a1)) (ActWriters a1))
        (set_remove SECMATeq_dec (o, a1) (secmat s))) o); 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 auto. 
 
intros until a0;
 elim
  (fsecmat
     (set_add SECMATeq_dec (o, mkRW (Sub :: nil) (empty_set SUBJECT))
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
        (secmat s)) o); auto. 
 
(* Goal: match fOSC (objectSC s) o with | Some t => match fSSC (subjectSC s) Sub with | Some b => le_sc t b | None => False end | None => match fSSC (subjectSC s) Sub with | Some s1 => False | None => False end end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o with | Some x => match fOSC (objectSC s) o with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: SecureState (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
unfold PreMAC in H5.
cut
 (match fSSC (subjectSC s) Sub with
  | Some _ => False
  | None => False
  end = False).
(* Goal: forall _ : @eq Prop match fSSC (subjectSC s) Sub with | Some s1 => False | None => False end False, match fOSC (objectSC s) o with | Some t => match fSSC (subjectSC s) Sub with | Some b => le_sc t b | None => False end | None => match fSSC (subjectSC s) Sub with | Some s1 => False | None => False end end *)
(* Goal: @eq Prop match fSSC (subjectSC s) Sub with | Some s1 => False | None => False end False *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o with | Some x => match fOSC (objectSC s) o with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: SecureState (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
intro; rewrite H9.
(* Goal: match fOSC (objectSC s) o with | Some t => match fSSC (subjectSC s) Sub with | Some b => le_sc t b | None => False end | None => False end *)
(* Goal: @eq Prop match fSSC (subjectSC s) Sub with | Some s1 => False | None => False end False *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o with | Some x => match fOSC (objectSC s) o with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: SecureState (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
assumption.
(* Goal: @eq Prop False match fSSC (subjectSC s) Sub with | Some s1 => False | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
case (fSSC (subjectSC s) Sub); reflexivity.

 
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
unfold fsecmat in |- *; apply DOMFuncRel4. 
 
cut
 match fsecmat (open_sm s Sub o READ) o, fsecmat (secmat s) o with
 | Some y, None =>
     ActReaders y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\
     ActWriters y = empty_set SUBJECT
 | None, _ => False
 | Some y, Some z =>
     (set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)) /\
     (set_In u0 (ActWriters y) -> set_In u0 (ActWriters z))
 end. 
cut
 match fOSC (objectSC s) o with
 | Some t =>
     match fSSC (subjectSC s) Sub with
     | Some b => le_sc t b
     | None => False
     end
 | None =>
     match fSSC (subjectSC s) Sub with
     | Some _ => False
     | None => False
     end
 end. 
cut
 match fsecmat (secmat s) o, fOSC (objectSC s) o, fSSC (subjectSC s) u0 with
 | None, _, _ => True
 | _, None, _ => True
 | _, _, None => True
 | Some x, Some y, Some z =>
     set_In u0 (ActReaders x) \/ set_In u0 (ActWriters x) -> le_sc y z
 end. 
elim (fSSC (subjectSC s) u0); elim (fsecmat (open_sm s Sub o READ) o);
 elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fSSC (subjectSC s) Sub); contradiction || auto. 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
tauto. 
 
(* Goal: forall o0 : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
intros. 
elim H11; intros H13 H14; rewrite H13 in H12; rewrite H14 in H12;
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 simpl in H12; tauto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
unfold MACSecureState in MAC; apply MAC; auto. 
 
replace
 match fSSC (subjectSC s) Sub with
 | Some _ => False
 | None => False
 end with False.
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
(* Goal: @eq Prop False match fSSC (subjectSC s) Sub with | Some s1 => False | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
case (fSSC (subjectSC s) Sub); reflexivity.
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
apply Open_smCorr21; auto. 
 
(* Goal: match fsecmat (open_sm s Sub o READ) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: SecureState (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
replace (fsecmat (open_sm s Sub o READ) o0) with (fsecmat (secmat s) o0). 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
unfold MACSecureState in MAC; apply MAC; auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(*********************************************************************) 
(*                         End READ                                  *) 
(*                                                                   *) 
(*                                                                   *) 
(*                                                                   *) 
(*                       Begin WRITE                                 *) 
(*********************************************************************) 
 
unfold SecureState, DACSecureState, MACSecureState in |- *; simpl in |- *;
 BreakSS. 
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
split; intros. 
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
elim (OBJeq_dec o o0); intro EQo. 
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
rewrite <- EQo. 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
elim (SUBeq_dec Sub u0); intro EQu. 
(* Goal: forall (_ : match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end) (_ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end), match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQu. 
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) Sub o) (forall _ : @set_In SUBJECT Sub (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) Sub o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
unfold open_sm at 1, PreDACRead, PreDACWrite in |- *; simpl in |- *. 
cut
 match fsecmat (secmat s) o with
 | Some y => set_In (o, y) (secmat s)
 | None => ~ set_In o (DOM OBJeq_dec (secmat s))
 end. 
cut
 match fsecmat (secmat s) o with
 | None => True
 | Some y => set_In Sub (ActReaders y) -> PreDACRead s Sub o
 end. 
(* Goal: forall (_ : match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end) (_ : match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end), match fsecmat match fsecmat (secmat s) o with | Some y => @set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (ActReaders y) (@set_add SUBJECT SUBeq_dec Sub (ActWriters y)))) (@set_remove (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o y) (secmat s)) | None => @set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (secmat s) end o with | Some y => and (forall _ : @set_In SUBJECT Sub (ActReaders y), match facl (acl s) o with | Some y0 => or (@set_In SUBJECT Sub (UsersReaders y0)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y0)))) | None => False end) (forall _ : @set_In SUBJECT Sub (ActWriters y), match facl (acl s) o with | Some y0 => or (@set_In SUBJECT Sub (UsersWriters y0)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y0)))) | None => False end) | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
elim (fsecmat (secmat s) o). 
intros;
 replace
  (fsecmat
     (set_add SECMATeq_dec
        (o, mkRW (ActReaders a) (set_add SUBeq_dec Sub (ActWriters a)))
        (set_remove SECMATeq_dec (o, a) (secmat s))) o) with
  (Some (mkRW (ActReaders a) (set_add SUBeq_dec Sub (ActWriters a)))). 
(* Goal: and (forall _ : @set_In SUBJECT Sub (ActReaders (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT Sub (ActWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: @eq (option ReadersWriters) (@Some ReadersWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (fsecmat (@set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (secmat s)) o) *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
simpl in |- *. 
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
split; intros. 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
unfold PreDACRead in H9; apply H9; auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
unfold fsecmat in |- *; apply AddEq1; auto. 
 
intros;
 replace
  (fsecmat
     (set_add SECMATeq_dec (o, mkRW (empty_set SUBJECT) (Sub :: nil))
        (secmat s)) o) with (Some (mkRW (empty_set SUBJECT) (Sub :: nil))). 
(* Goal: and (forall _ : @set_In SUBJECT Sub (ActReaders (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT Sub (ActWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: @eq (option ReadersWriters) (@Some ReadersWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (fsecmat (@set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (secmat s)) o) *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
simpl in |- *. 
(* Goal: and (forall _ : False, match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : or (@eq SUBJECT Sub Sub) False, match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: @eq (option ReadersWriters) (@Some ReadersWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (fsecmat (@set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (secmat s)) o) *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
split; (intro H11; elim H11). 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: forall (a : ReadersWriters) (_ : and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end)) (_ : False), True *)
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
contradiction. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
unfold fsecmat in |- *; apply AddEq1; auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
apply ReadWriteImpRead; auto. 
 
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
unfold fsecmat in |- *; apply DOMFuncRel4. 
 
cut
 match fsecmat (open_sm s Sub o WRITE) o, fsecmat (secmat s) o with
 | Some y, None =>
     ActWriters y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\
     ActReaders y = empty_set SUBJECT
 | None, _ => False
 | Some y, Some z =>
     (set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)) /\
     (set_In u0 (ActWriters y) -> set_In u0 (ActWriters z))
 end. 
cut
 match fsecmat (secmat s) o with
 | None => True
 | Some y =>
     (set_In u0 (ActReaders y) -> PreDACRead s u0 o) /\
     (set_In u0 (ActWriters y) -> PreDACWrite s u0 o)
 end. 
unfold PreDACRead, PreDACWrite in |- *; simpl in |- *;
 elim (fsecmat (secmat s) o); elim (fsecmat (open_sm s Sub o WRITE) o). 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
tauto. 
 
(* Goal: forall (a : ReadersWriters) (_ : and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end)) (_ : False), True *)
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
contradiction. 
 
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
split; intros. 
(* Goal: match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end *)
(* Goal: match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
elim H10; intros. 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
absurd (Sub = u0); auto. 
(* Goal: @eq SUBJECT Sub u0 *)
(* Goal: match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
rewrite H13 in H11. 
(* Goal: @eq SUBJECT Sub u0 *)
(* Goal: match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
simpl in H11. 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
tauto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
elim H10; intros H12 H13; rewrite H12 in H11; simpl in H11; tauto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
apply DAC. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
apply Open_smCorr22; auto. 
 
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
replace (fsecmat (open_sm s Sub o WRITE) o0) with (fsecmat (secmat s) o0). 
unfold PreDACRead, PreDACWrite in |- *; simpl in |- *;
 unfold DACSecureState, PreDACRead, PreDACWrite in DAC; 
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
 apply DAC. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: and (forall _ : @set_In SUBJECT Sub (ActReaders (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT Sub (ActWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: @eq (option ReadersWriters) (@Some ReadersWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (fsecmat (@set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (secmat s)) o) *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
unfold MACSecureState in |- *; intros; simpl in |- *. 
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
elim (OBJeq_dec o o0); intro EQo. 
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
rewrite <- EQo. 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
elim (SUBeq_dec Sub u0); intro EQu. 
(* Goal: forall (_ : match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end) (_ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end), match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQu. 
(* Goal: and (forall _ : @set_In SUBJECT Sub (ActReaders (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT Sub (ActWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))), match facl (acl s) o with | Some y => or (@set_In SUBJECT Sub (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT Sub (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: @eq (option ReadersWriters) (@Some ReadersWriters (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (fsecmat (@set_add (prod OBJECT ReadersWriters) SECMATeq_dec (@pair OBJECT ReadersWriters o (mkRW (empty_set SUBJECT) (@cons SUBJECT Sub (@nil SUBJECT)))) (secmat s)) o) *)
(* Goal: match fsecmat (secmat s) o with | Some y => forall _ : @set_In SUBJECT Sub (ActReaders y), PreDACRead s Sub o | None => True end *)
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
unfold open_sm in |- *; simpl in |- *. 
cut
 match fsecmat (secmat s) o with
 | Some y => set_In (o, y) (secmat s)
 | None => ~ set_In o (DOM OBJeq_dec (secmat s))
 end. 
cut
 match fOSC (objectSC s) o with
 | Some t =>
     match fSSC (subjectSC s) Sub with
     | Some b => le_sc t b
     | None => False
     end
 | None =>
     match fSSC (subjectSC s) Sub with
     | Some _ => False
     | None => False
     end
 end. 
elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fSSC (subjectSC s) Sub); contradiction || auto. 
intros until a1;
 elim
  (fsecmat
     (set_add SECMATeq_dec
        (o, mkRW (ActReaders a1) (set_add SUBeq_dec Sub (ActWriters a1)))
        (set_remove SECMATeq_dec (o, a1) (secmat s))) o); 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 auto. 
 
intros until a0;
 elim
  (fsecmat
     (set_add SECMATeq_dec (o, mkRW (empty_set SUBJECT) (Sub :: nil))
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
        (secmat s)) o); auto. 
 
replace
 match fSSC (subjectSC s) Sub with
 | Some _ => False
 | None => False
 end with False.
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
(* Goal: @eq Prop False match fSSC (subjectSC s) Sub with | Some s1 => False | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
case (fSSC (subjectSC s) Sub); reflexivity.
 
(* Goal: match fsecmat (secmat s) o with | Some y => @set_In (prod OBJECT ReadersWriters) (@pair OBJECT ReadersWriters o y) (secmat s) | None => not (@set_In OBJECT o (@DOM OBJECT ReadersWriters OBJeq_dec (secmat s))) end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
unfold fsecmat in |- *; apply DOMFuncRel4. 
 
cut
 match fsecmat (open_sm s Sub o WRITE) o, fsecmat (secmat s) o with
 | Some y, None =>
     ActWriters y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\
     ActReaders y = empty_set SUBJECT
 | None, _ => False
 | Some y, Some z =>
     (set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)) /\
     (set_In u0 (ActWriters y) -> set_In u0 (ActWriters z))
 end. 
cut
 match fOSC (objectSC s) o with
 | Some t =>
     match fSSC (subjectSC s) Sub with
     | Some b => le_sc t b
     | None => False
     end
 | None =>
     match fSSC (subjectSC s) Sub with
     | Some _ => False
     | None => False
     end
 end. 
cut
 match fsecmat (secmat s) o, fOSC (objectSC s) o, fSSC (subjectSC s) u0 with
 | None, _, _ => True
 | _, None, _ => True
 | _, _, None => True
 | Some x, Some y, Some z =>
     set_In u0 (ActReaders x) \/ set_In u0 (ActWriters x) -> le_sc y z
 end. 
elim (fSSC (subjectSC s) u0); elim (fsecmat (open_sm s Sub o WRITE) o);
 elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fSSC (subjectSC s) Sub); contradiction || auto. 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
tauto. 
 
(* Goal: forall o0 : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
intros. 
elim H11; intros H13 H14; rewrite H13 in H12; rewrite H14 in H12;
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 simpl in H12; tauto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
unfold MACSecureState in MAC; apply MAC; auto. 

replace
 match fSSC (subjectSC s) Sub with
 | Some _ => False
 | None => False
 end with False.
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
(* Goal: @eq Prop False match fSSC (subjectSC s) Sub with | Some s1 => False | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
case (fSSC (subjectSC s) Sub); reflexivity.

 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
apply Open_smCorr22; auto. 
 
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
replace (fsecmat (open_sm s Sub o WRITE) o0) with (fsecmat (secmat s) o0). 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
unfold MACSecureState in MAC; apply MAC; auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
Qed. 
 
 
 
(*********************************************************************) 
(*                                                                   *) 
(*                                                                   *) 
(*                              OpenPSP                              *) 
(*                                                                   *) 
(*                                                                   *) 
(*********************************************************************) 
 
 
 
Lemma OpenPSP :
 forall (s t : SFSstate) (u : SUBJECT),
 FuncPre5 s -> StarProperty s -> TransFunc u s Open t -> StarProperty t. 
(* Goal: forall (s t : SFSstate) (u : SUBJECT) (_ : FuncPre5 s) (_ : StarProperty s) (_ : TransFunc u s Open t), StarProperty t *)
intros s t Sub FP5 SP TF; inversion TF. 
(* Goal: and (forall o : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s t o, ExecuterIsOwner s Sub o) (forall _ : MACObjCtrlAttrHaveChanged s t o, @set_In SUBJECT Sub (groups s (SecAdmGrp s)))) (forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s t u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
inversion H. 
(* Goal: forall o0 : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
unfold StarProperty in |- *; simpl in |- *; intros. 
cut
 match
   fsecmat (secmat s) o1, fsecmat (secmat s) o2, fOSC (objectSC s) o2,
   fOSC (objectSC s) o1
 with
 | None, _, _, _ => True
 | _, None, _, _ => True
 | _, _, None, _ => True
 | _, _, _, None => True
 | Some w, Some x, Some y, Some z =>
     set_In u0 (ActWriters w) -> set_In u0 (ActReaders x) -> le_sc y z
 end. 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
elim (OBJeq_dec o o1); elim (OBJeq_dec o o2); intros EQ2 EQ1. 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQ1; rewrite <- EQ2. 
elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fsecmat (open_sm s Sub o READ) o); auto. 
 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQ1. 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o READ) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o READ) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: StarProperty (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
replace (fsecmat (open_sm s Sub o READ) o2) with (fsecmat (secmat s) o2). 
cut
 match fsecmat (open_sm s Sub o READ) o, fsecmat (secmat s) o with
 | None, _ => False
 | Some y, None =>
     ActReaders y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\
     ActWriters y = empty_set SUBJECT
 | Some x, Some y => set_In u0 (ActWriters x) -> set_In u0 (ActWriters y)
 end. 
elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
 elim (fsecmat (secmat s) o2); elim (fsecmat (open_sm s Sub o READ) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fOSC (objectSC s) o2); auto. 
(* Goal: forall o0 : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
intros. 
(* Goal: forall (a : ReadersWriters) (_ : and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end)) (_ : False), True *)
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
elim H9; intros H16 H17; rewrite H17 in H11; simpl in H11; contradiction. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
apply Open_smCorr31; auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQ2. 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o READ) o1 with | Some w => match fsecmat (open_sm s Sub o READ) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: StarProperty (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
replace (fsecmat (open_sm s Sub o READ) o1) with (fsecmat (secmat s) o1). 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
elim (SUBeq_dec Sub u0); intro EQu. 
cut
 match fsecmat (secmat s) o1, fOSC (objectSC s) o, fOSC (objectSC s) o1 with
 | None, _, _ => False
 | _, None, _ => False
 | _, _, None => False
 | Some x, Some y, Some z => set_In Sub (ActWriters x) -> le_sc y z
 end. 
(* Goal: forall (_ : match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end) (_ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end), match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQu. 
elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
 elim (fsecmat (secmat s) o1); elim (fsecmat (open_sm s Sub o READ) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fOSC (objectSC s) o1); auto. 
 
(* Goal: match fsecmat (secmat s) o1 with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall _ : @set_In SUBJECT Sub (ActWriters x), le_sc y z | None => False end | None => False end | None => False end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o READ) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o READ) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o READ) o1 with | Some w => match fsecmat (open_sm s Sub o READ) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: StarProperty (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
unfold PreStarPropRead in H6; apply H6. 
 
cut
 match fsecmat (open_sm s Sub o READ) o, fsecmat (secmat s) o with
 | Some y, None =>
     ActReaders y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\
     ActWriters y = empty_set SUBJECT
 | None, _ => False
 | Some y, Some z =>
     (set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)) /\
     (set_In u0 (ActWriters y) -> set_In u0 (ActWriters z))
 end. 
elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
 elim (fsecmat (secmat s) o1); elim (fsecmat (open_sm s Sub o READ) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fOSC (objectSC s) o1); auto. 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
tauto. 
 
(* Goal: forall o0 : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
intros. 
elim H9; intros H16 H17; rewrite H16 in H12; simpl in H12; elim H12; intro;
(* Goal: forall (a : ReadersWriters) (_ : and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end)) (_ : False), True *)
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
 contradiction. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
apply Open_smCorr21; auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o READ) o1 with | Some w => match fsecmat (open_sm s Sub o READ) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: StarProperty (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
replace (fsecmat (open_sm s Sub o READ) o1) with (fsecmat (secmat s) o1). 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o READ) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o READ) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: StarProperty (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) *)
replace (fsecmat (open_sm s Sub o READ) o2) with (fsecmat (secmat s) o2). 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
unfold StarProperty in SP; apply SP; auto. 
 
 
(*********************************************************************) 
(*                         End READ                                  *) 
(*                                                                   *) 
(*                                                                   *) 
(*                                                                   *) 
(*                       Begin WRITE                                 *) 
(*********************************************************************) 
 
 
(* Goal: forall o0 : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
unfold StarProperty in |- *; simpl in |- *; intros. 
cut
 match
   fsecmat (secmat s) o1, fsecmat (secmat s) o2, fOSC (objectSC s) o2,
   fOSC (objectSC s) o1
 with
 | None, _, _, _ => True
 | _, None, _, _ => True
 | _, _, None, _ => True
 | _, _, _, None => True
 | Some w, Some x, Some y, Some z =>
     set_In u0 (ActWriters w) -> set_In u0 (ActReaders x) -> le_sc y z
 end. 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
elim (OBJeq_dec o o1); elim (OBJeq_dec o o2); intros EQ2 EQ1. 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQ1; rewrite <- EQ2. 
elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fsecmat (open_sm s Sub o WRITE) o); auto. 
 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQ1. 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
replace (fsecmat (open_sm s Sub o WRITE) o2) with (fsecmat (secmat s) o2). 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
elim (SUBeq_dec Sub u0); intro EQu. 
cut
 match fsecmat (secmat s) o2, fOSC (objectSC s) o, fOSC (objectSC s) o2 with
 | None, _, _ => False
 | _, None, _ => False
 | _, _, None => False
 | Some x, Some y, Some z => set_In Sub (ActReaders x) -> le_sc z y
 end. 
(* Goal: forall (_ : match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end) (_ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end), match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQu. 
elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
 elim (fsecmat (secmat s) o2); elim (fsecmat (open_sm s Sub o WRITE) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fOSC (objectSC s) o2); auto. 
 
(* Goal: match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o2 with | Some z => forall _ : @set_In SUBJECT Sub (ActReaders x), le_sc z y | None => False end | None => False end | None => False end *)
(* Goal: forall _ : match fsecmat (secmat s) o with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o2) (fsecmat (open_sm s Sub o WRITE) o2) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
unfold PreStarPropWrite in H6; apply H6. 
 
cut
 match fsecmat (open_sm s Sub o WRITE) o, fsecmat (secmat s) o with
 | Some y, None =>
     ActWriters y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\
     ActReaders y = empty_set SUBJECT
 | None, _ => False
 | Some y, Some z =>
     (set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)) /\
     (set_In u0 (ActWriters y) -> set_In u0 (ActWriters z))
 end. 
elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
 elim (fsecmat (secmat s) o2); elim (fsecmat (open_sm s Sub o WRITE) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fOSC (objectSC s) o2); auto. 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
tauto. 
 
(* Goal: forall o0 : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
intros. 
(* Goal: le_sc a a2 *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o2) (fsecmat (open_sm s Sub o WRITE) o2) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
elim H9; intros H15 H16. 
(* Goal: forall (a : ReadersWriters) (_ : and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end)) (_ : False), True *)
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
rewrite H15 in H11; simpl in H11; elim H11; intro; try contradiction. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
apply Open_smCorr22; auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQ2. 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
replace (fsecmat (open_sm s Sub o WRITE) o1) with (fsecmat (secmat s) o1). 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
elim (SUBeq_dec Sub u0); intro EQu. 
cut
 match fsecmat (open_sm s Sub o WRITE) o, fsecmat (secmat s) o with
 | Some y, None =>
     ActWriters y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\
     ActReaders y = empty_set SUBJECT
 | None, _ => False
 | Some y, Some z => set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)
 end. 
(* Goal: forall (_ : match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end) (_ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end), match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o with | Some x => match fOSC (objectSC s) o with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
rewrite <- EQu. 
elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
 elim (fsecmat (secmat s) o1); elim (fsecmat (open_sm s Sub o WRITE) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fOSC (objectSC s) o1); auto. 
(* Goal: forall o0 : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
intros. 
(* Goal: forall (a : ReadersWriters) (_ : and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end)) (_ : False), True *)
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
elim H9; intros H14 H15; rewrite H15 in H12; simpl in H12; contradiction. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
apply Open_smCorr32; auto. 
 
cut
 match fsecmat (open_sm s Sub o WRITE) o, fsecmat (secmat s) o with
 | Some y, None =>
     ActWriters y = set_add SUBeq_dec Sub (empty_set SUBJECT) /\
     ActReaders y = empty_set SUBJECT
 | None, _ => False
 | Some y, Some z =>
     (set_In u0 (ActReaders y) -> set_In u0 (ActReaders z)) /\
     (set_In u0 (ActWriters y) -> set_In u0 (ActWriters z))
 end. 
elim (fsecmat (secmat s) o); elim (fOSC (objectSC s) o);
 elim (fsecmat (secmat s) o1); elim (fsecmat (open_sm s Sub o WRITE) o);
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 elim (fOSC (objectSC s) o1); auto. 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
tauto. 
 
(* Goal: forall o0 : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
intros. 
(* Goal: forall (a : ReadersWriters) (_ : and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end)) (_ : False), True *)
(* Goal: forall (a : ReadersWriters) (_ : True) (_ : and (@eq (set SUBJECT) (ActWriters a) (@cons SUBJECT Sub (@nil SUBJECT))) (@eq (set SUBJECT) (ActReaders a) (empty_set SUBJECT))), and (forall _ : @set_In SUBJECT u0 (ActReaders a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersReaders y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupReaders y)))) | None => False end) (forall _ : @set_In SUBJECT u0 (ActWriters a), match facl (acl s) o with | Some y => or (@set_In SUBJECT u0 (UsersWriters y)) (@ex GRPNAME (fun g : GRPNAME => and (@set_In SUBJECT u0 (groups s g)) (@set_In GRPNAME g (GroupWriters y)))) | None => False end) *)
(* Goal: forall (_ : True) (_ : False), True *)
(* Goal: match fsecmat (secmat s) o with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead s u0 o) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite s u0 o) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o with | Some y => match fsecmat (secmat s) o with | Some z => and (forall _ : @set_In SUBJECT u0 (ActReaders y), @set_In SUBJECT u0 (ActReaders z)) (forall _ : @set_In SUBJECT u0 (ActWriters y), @set_In SUBJECT u0 (ActWriters z)) | None => and (@eq (set SUBJECT) (ActWriters y) (@set_add SUBJECT SUBeq_dec Sub (empty_set SUBJECT))) (@eq (set SUBJECT) (ActReaders y) (empty_set SUBJECT)) end | None => False end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some y => and (forall _ : @set_In SUBJECT u0 (ActReaders y), PreDACRead (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) (forall _ : @set_In SUBJECT u0 (ActWriters y), PreDACWrite (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0 o0) | None => True end *)
(* Goal: match fsecmat (open_sm s Sub o WRITE) o0 with | Some x => match fOSC (objectSC s) o0 with | Some y => match fSSC (subjectSC s) u0 with | Some z => forall _ : or (@set_In SUBJECT u0 (ActReaders x)) (@set_In SUBJECT u0 (ActWriters x)), le_sc y z | None => True end | None => True end | None => True end *)
elim H9; intros H14 H15; rewrite H15 in H12; simpl in H12; contradiction. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
apply Open_smCorr22; auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (open_sm s Sub o WRITE) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
replace (fsecmat (open_sm s Sub o WRITE) o1) with (fsecmat (secmat s) o1). 
(* Goal: forall _ : match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end, match fsecmat (secmat s) o1 with | Some w => match fsecmat (open_sm s Sub o WRITE) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
replace (fsecmat (open_sm s Sub o WRITE) o2) with (fsecmat (secmat s) o2). 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
auto. 
 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
unfold StarProperty in SP; apply SP; auto. 
 
Qed. 
 
 
Lemma OpenPCP : forall s t : SFSstate, PreservesControlProp s Open t. 
intros; unfold PreservesControlProp in |- *; intros Sub TF; inversion TF;
 unfold ControlProperty in |- *. 
(* Goal: and (forall o : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s t o, ExecuterIsOwner s Sub o) (forall _ : MACObjCtrlAttrHaveChanged s t o, @set_In SUBJECT Sub (groups s (SecAdmGrp s)))) (forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s t u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
inversion H. 
(* Goal: and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
split. 
(* Goal: forall o0 : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
intros. 
(* Goal: and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
split. 
intros;
 absurd
  (DACCtrlAttrHaveChanged s
     (mkSFS (groups s) (primaryGrp s) (subjectSC s) 
        (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) 
        (acl s) (open_sm s Sub o READ) (files s) (directories s)) o0); 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 auto. 
 
intros;
 absurd
  (MACObjCtrlAttrHaveChanged s
     (mkSFS (groups s) (primaryGrp s) (subjectSC s) 
        (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) 
        (acl s) (open_sm s Sub o READ) (files s) (directories s)) o0); 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 auto. 
 
intros;
 absurd
  (MACSubCtrlAttrHaveChanged s
     (mkSFS (groups s) (primaryGrp s) (subjectSC s) 
        (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) 
        (acl s) (open_sm s Sub o READ) (files s) (directories s)) u0); 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 auto. 
 
(* Goal: and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
split. 
(* Goal: forall o0 : OBJECT, and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
intros. 
(* Goal: and (forall _ : DACCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, ExecuterIsOwner s Sub o0) (forall _ : MACObjCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0, @set_In SUBJECT Sub (groups s (SecAdmGrp s))) *)
(* Goal: forall (u0 : SUBJECT) (_ : MACSubCtrlAttrHaveChanged s (mkSFS (groups s) (primaryGrp s) (subjectSC s) (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0), @set_In SUBJECT Sub (groups s (SecAdmGrp s)) *)
split. 
intros;
 absurd
  (DACCtrlAttrHaveChanged s
     (mkSFS (groups s) (primaryGrp s) (subjectSC s) 
        (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) 
        (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0); 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 auto. 
 
intros;
 absurd
  (MACObjCtrlAttrHaveChanged s
     (mkSFS (groups s) (primaryGrp s) (subjectSC s) 
        (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) 
        (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) o0); 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 auto. 
 
intros;
 absurd
  (MACSubCtrlAttrHaveChanged s
     (mkSFS (groups s) (primaryGrp s) (subjectSC s) 
        (AllGrp s) (RootGrp s) (SecAdmGrp s) (objectSC s) 
        (acl s) (open_sm s Sub o WRITE) (files s) (directories s)) u0); 
(* Goal: @eq (Exc ReadersWriters) (fsecmat (secmat s) o1) (fsecmat (open_sm s Sub o WRITE) o1) *)
(* Goal: match fsecmat (secmat s) o1 with | Some w => match fsecmat (secmat s) o2 with | Some x => match fOSC (objectSC s) o2 with | Some y => match fOSC (objectSC s) o1 with | Some z => forall (_ : @set_In SUBJECT u0 (ActWriters w)) (_ : @set_In SUBJECT u0 (ActReaders x)), le_sc y z | None => True end | None => True end | None => True end | None => True end *)
 auto. 
 
Qed. 
 
 
End openIsSecure. 
 
Hint Resolve OpenPSS OpenPSP OpenPCP. 
 