theory Enrich

imports Main Flask Static Init_prop Valid_prop Tainted_prop Delete_prop Co2sobj_prop S2ss_prop S2ss_prop2

 Temp Enrich Proc_fd_of_file_prop

begin

context tainting_s begin

(* \<And> *)

lemma current_proc_fds_in_curp:

  "\<lbrakk>fd \<in> current_proc_fds s p; valid s\<rbrakk> \<Longrightarrow> p \<in> current_procs s"

apply (induct s)

apply (simp add:init_fds_of_proc_prop1)

apply (frule vt_grant_os, frule vd_cons)

apply (case_tac a, auto split:if_splits option.splits)

done

lemma get_parentfs_ctxts_prop:

  "\<lbrakk>get_parentfs_ctxts s (a # f) = Some ctxts; sectxt_of_obj s (O_dir f) = Some ctxt; valid s\<rbrakk>

   \<Longrightarrow> ctxt \<in> set (ctxts)"

apply (induct f)

apply (auto split:option.splits)

done

lemma search_check_allp_intro:

  "\<lbrakk>search_check s sp pf; get_parentfs_ctxts s pf = Some ctxts; valid s; is_dir s pf\<rbrakk>

   \<Longrightarrow> search_check_allp sp (set ctxts)"

apply (case_tac pf)

apply (simp split:option.splits if_splits add:search_check_allp_def)

apply (rule ballI)

apply (auto simp:search_check_ctxt_def search_check_dir_def split:if_splits option.splits)

apply (auto simp:search_check_allp_def search_check_file_def)

apply (frule is_dir_not_file, simp)

done

lemma search_check_leveling_f:

  "\<lbrakk>search_check s sp pf; parent f = Some pf; is_file s f; valid s;

    sectxt_of_obj s (O_file f) = Some fctxt; search_check_file sp fctxt\<rbrakk>

   \<Longrightarrow> search_check s sp f"

apply (case_tac f, simp+)

apply (auto split:option.splits simp:search_check_ctxt_def)

apply (frule parentf_is_dir_prop2, simp)

apply (erule get_pfs_secs_prop, simp)

apply (erule_tac search_check_allp_intro, simp_all)

apply (simp add:parentf_is_dir_prop2)

done

lemma enrich_proc_dup_ffds':

  "\<lbrakk>fd \<notin> current_proc_fds (enrich_proc s p p') p'; is_created_proc s p; p' \<notin> all_procs s; no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> fd \<notin> proc_file_fds s p \<and> file_of_proc_fd s p fd = None"

apply (auto simp:enrich_proc_dup_ffds_eq_fds)

apply (simp add:proc_file_fds_def)

done

lemma enrich_proc_cur_inof:

  "\<lbrakk>valid s; no_del_event s\<rbrakk> \<Longrightarrow> inum_of_file (enrich_proc s p p') f = inum_of_file s f"

apply (induct s arbitrary:f)

apply simp

apply (frule vd_cons, frule vt_grant_os, frule vt_grant)

apply (case_tac a, auto)

apply (auto split:option.splits simp del:grant.simps)

done

lemma not_all_procs_sock:

  "\<lbrakk>p' \<notin> all_procs s; valid s\<rbrakk> \<Longrightarrow> inum_of_socket s (p', fd) = None"

apply (frule not_all_procs_prop3)

apply (case_tac "inum_of_socket s (p', fd)", simp_all)

apply (drule cn_in_curp', simp+)

done

lemma enrich_proc_cur_inos:

  "\<lbrakk>valid s; no_del_event s; p' \<notin> all_procs s\<rbrakk> 

   \<Longrightarrow> inum_of_socket (enrich_proc s p p') (tp, fd) = inum_of_socket s (tp, fd)"

apply (induct s arbitrary:tp)

apply simp

apply (frule vd_cons, frule vt_grant_os)

apply (case_tac a, auto split:option.splits simp:not_all_procs_sock)

apply (simp add:proc_file_fds_def, erule exE)

apply (case_tac "inum_of_socket s (nat1, fd)", simp_all)

apply (drule filefd_socket_conflict, simp_all add:current_sockets_def)

done

lemma enrich_proc_cur_inums:

  "\<lbrakk>p' \<notin> all_procs s; no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> current_inode_nums (enrich_proc s p p') = current_inode_nums s"

apply (auto simp:current_inode_nums_def current_file_inums_def 

  current_sock_inums_def enrich_proc_cur_inof enrich_proc_cur_inos)

done

lemma enrich_proc_cur_itag:

  "\<lbrakk>valid s; no_del_event s; p' \<notin> all_procs s\<rbrakk> 

   \<Longrightarrow> itag_of_inum (enrich_proc s p p') i = itag_of_inum s i"

apply (induct s)

apply simp

apply (frule vd_cons, frule vt_grant_os)

apply (case_tac a, auto split:option.splits t_socket_type.splits)

done

lemma enrich_proc_cur_tcps:

  "\<lbrakk>valid s; no_del_event s; p' \<notin> all_procs s\<rbrakk> 

   \<Longrightarrow> is_tcp_sock (enrich_proc s p p') = is_tcp_sock s"

apply (rule ext, case_tac x)

apply (auto simp add:is_tcp_sock_def enrich_proc_cur_itag enrich_proc_cur_inos

  split:option.splits t_inode_tag.splits)

done

lemma enrich_proc_cur_udps:

  "\<lbrakk>valid s; no_del_event s; p' \<notin> all_procs s\<rbrakk> 

   \<Longrightarrow> is_udp_sock (enrich_proc s p p') = is_udp_sock s"

apply (rule ext, case_tac x)

apply (auto simp add:is_udp_sock_def enrich_proc_cur_itag enrich_proc_cur_inos

  split:option.splits t_inode_tag.splits)

done

lemma enrich_proc_cur_msgqs:

  "valid s \<Longrightarrow> current_msgqs (enrich_proc s p p') = current_msgqs s"

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons)

apply (case_tac a, auto)

done

lemma enrich_proc_cur_msgs:

  "valid s \<Longrightarrow> msgs_of_queue (enrich_proc s p p') q = msgs_of_queue s q "

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons)

apply (case_tac a, auto)

done

lemma enrich_proc_cur_procs:

  "\<lbrakk>p' \<notin> all_procs s; no_del_event s; is_created_proc s p; valid s\<rbrakk> 

   \<Longrightarrow> current_procs (enrich_proc s p p') = current_procs s \<union> {p'}"

apply (induct s, simp add:is_created_proc_def)

apply (frule vt_grant_os, frule vd_cons)

apply (case_tac a, auto simp:is_created_proc_simps)

done

lemma enrich_proc_cur_files:

  "\<lbrakk>valid s; no_del_event s\<rbrakk> \<Longrightarrow> current_files (enrich_proc s p p') = current_files s"

apply (auto simp:current_files_def)

apply (simp add: enrich_proc_cur_inof)+

done

lemma enrich_proc_cur_fds1:

  "\<lbrakk>p' \<notin> all_procs s; no_del_event s; is_created_proc s p; valid s; tp \<in> current_procs s\<rbrakk>

   \<Longrightarrow> current_proc_fds (enrich_proc s p p') tp = current_proc_fds s tp"

apply (induct s, simp add:is_created_proc_def)

apply (frule vt_grant_os, frule vd_cons)

apply (frule not_all_procs_prop3)

apply (case_tac a)

apply (auto simp:is_created_proc_simps)

done

lemma enrich_proc_cur_fds1':

  "\<lbrakk>p' \<notin> all_procs s; no_del_event s; is_created_proc s p; valid s; tp \<noteq> p'\<rbrakk>

   \<Longrightarrow> current_proc_fds (enrich_proc s p p') tp = current_proc_fds s tp"

apply (induct s, simp add:is_created_proc_def)

apply (frule vt_grant_os, frule vd_cons)

apply (frule not_all_procs_prop3)

apply (case_tac a)

apply (auto simp:is_created_proc_simps)

done

lemma enrich_proc_cur_fds:

  "\<lbrakk>p' \<notin> all_procs s; no_del_event s; is_created_proc s p; valid s\<rbrakk>

   \<Longrightarrow> current_proc_fds (enrich_proc s p p') tp = (if (tp = p') then proc_file_fds s p else current_proc_fds s tp)"

apply (simp add:enrich_proc_cur_fds1' enrich_proc_dup_ffds_eq_fds split:if_splits)

done

lemma enrich_proc_not_alive:

  "\<lbrakk>enrich_not_alive s (E_proc p') obj; is_created_proc s p; p' \<notin> all_procs s; no_del_event s; valid s\<rbrakk>

  \<Longrightarrow> enrich_not_alive (enrich_proc s p p') (E_proc p') obj"

apply (case_tac obj)

apply (simp_all add:enrich_proc_cur_procs enrich_proc_cur_files enrich_proc_cur_inums 

  enrich_proc_cur_msgqs enrich_proc_cur_msgs enrich_proc_cur_fds)

done

lemma enrich_proc_filefd:

  "\<lbrakk>file_of_proc_fd s tp fd = Some f; is_created_proc s p; p' \<notin> all_procs s; no_del_event s; valid s\<rbrakk>

  \<Longrightarrow> file_of_proc_fd (enrich_proc s p p') tp fd = Some f"

apply (induct s arbitrary:tp, simp add:is_created_proc_def)

apply (frule vt_grant_os, frule vd_cons)

apply (frule not_all_procs_prop3)

apply (case_tac a)

apply (auto simp:is_created_proc_simps dest:proc_fd_in_procs split:if_splits)

done

lemma enrich_proc_flagfd:

  "\<lbrakk>flags_of_proc_fd s tp fd = Some f; is_created_proc s p; p' \<notin> all_procs s; no_del_event s; valid s\<rbrakk>

  \<Longrightarrow> flags_of_proc_fd (enrich_proc s p p') tp fd = Some f"

apply (induct s arbitrary:tp, simp add:is_created_proc_def)

apply (frule vt_grant_os, frule vd_cons)

apply (frule not_all_procs_prop3)

apply (case_tac a)

apply (auto simp:is_created_proc_simps dest:proc_fd_in_procs current_fflag_has_ffd split:if_splits option.splits)

done

lemma enrich_proc_hungs:

  "\<lbrakk>valid s; no_del_event s\<rbrakk> \<Longrightarrow> files_hung_by_del (enrich_proc s p p') = files_hung_by_del s"

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons)

apply (case_tac a, auto simp:files_hung_by_del.simps)

done

lemma enrich_proc_is_file:

  "\<lbrakk>valid s; no_del_event s; p' \<notin> all_procs s\<rbrakk> 

   \<Longrightarrow> is_file (enrich_proc s p p') = is_file s"

apply (rule ext, case_tac x)

apply (auto simp add:is_file_def enrich_proc_cur_itag enrich_proc_cur_inof

  split:option.splits t_inode_tag.splits)

done

lemma enrich_proc_is_dir:

  "\<lbrakk>valid s; no_del_event s; p' \<notin> all_procs s\<rbrakk> 

   \<Longrightarrow> is_dir (enrich_proc s p p') = is_dir s"

apply (rule ext, case_tac x)

apply (auto simp add:is_dir_def enrich_proc_cur_itag enrich_proc_cur_inof

  split:option.splits t_inode_tag.splits)

done

lemma enrich_proc_alive:

  "\<lbrakk>alive s obj; valid s; is_created_proc s p; p' \<notin> all_procs s; no_del_event s\<rbrakk>

   \<Longrightarrow> alive (enrich_proc s p p') obj"

apply (case_tac obj)

apply (simp_all add:enrich_proc_is_file enrich_proc_is_dir enrich_proc_cur_msgqs 

  enrich_proc_cur_msgs enrich_proc_cur_procs enrich_proc_cur_fds

  enrich_proc_cur_tcps enrich_proc_cur_udps)

apply (rule impI, simp)

apply (drule current_proc_fds_in_curp, simp, simp add:not_all_procs_prop3)

done

lemma enrich_proc_prop:

  "\<lbrakk>valid s; is_created_proc s p; p' \<notin> all_procs s; no_del_event s\<rbrakk>

   \<Longrightarrow> valid (enrich_proc s p p') \<and> 

       (\<forall> tp. tp \<in> current_procs s \<longrightarrow> cp2sproc (enrich_proc s p p') tp = cp2sproc s tp) \<and>

       (\<forall> f. f \<in> current_files s \<longrightarrow> cf2sfile (enrich_proc s p p') f = cf2sfile s f) \<and> 

       (\<forall> q. q \<in> current_msgqs s \<longrightarrow> cq2smsgq (enrich_proc s p p') q = cq2smsgq s q) \<and> 

       (\<forall> tp fd. fd \<in> proc_file_fds s tp \<longrightarrow> cfd2sfd (enrich_proc s p p') tp fd = cfd2sfd s tp fd) \<and>

       (cp2sproc (enrich_proc s p p') p' = cp2sproc s p) \<and>

       (\<forall> fd. fd \<in> proc_file_fds s p \<longrightarrow> cfd2sfd (enrich_proc s p p') p' fd = cfd2sfd s p fd)"

proof (induct s)

  case Nil

  thus ?case by (auto simp:is_created_proc_def)

next

  case (Cons e s)

  hence vd_cons': "valid (e # s)" and created_cons: "is_created_proc (e # s) p"

    and all_procs_cons: "p' \<notin> all_procs (e # s)" and vd: "valid s" 

    and os: "os_grant s e" and grant: "grant s e" 

    and nodel_cons: "no_del_event (e # s)"

    by (auto dest:vd_cons' vt_grant_os vt_grant)

  from all_procs_cons have all_procs: "p' \<notin> all_procs s" by (case_tac e, auto)

  from nodel_cons have nodel: "no_del_event s" by (case_tac e, auto)

  from Cons have pre: "is_created_proc s p \<Longrightarrow> valid (enrich_proc s p p') \<and>

     (\<forall>tp. tp \<in> current_procs s \<longrightarrow> cp2sproc (enrich_proc s p p') tp = cp2sproc s tp) \<and>

     (\<forall>f. f \<in> current_files s \<longrightarrow> cf2sfile (enrich_proc s p p') f = cf2sfile s f) \<and>

     (\<forall>q. q \<in> current_msgqs s \<longrightarrow> cq2smsgq (enrich_proc s p p') q = cq2smsgq s q) \<and>

     (\<forall>tp fd. fd \<in> proc_file_fds s tp \<longrightarrow> cfd2sfd (enrich_proc s p p') tp fd = cfd2sfd s tp fd) \<and>     

     (cp2sproc (enrich_proc s p p') p' = cp2sproc s p) \<and>

     (\<forall> fd. fd \<in> proc_file_fds s p \<longrightarrow> cfd2sfd (enrich_proc s p p') p' fd = cfd2sfd s p fd)"

    using vd all_procs nodel by auto

  have vd_enrich_cons: "valid (enrich_proc (e # s) p p')"

  proof-

      valid (Execve p f fds # s); p' \<notin> all_procs s\<rbrakk>

      \<Longrightarrow> valid (Execve p' f (fds \<inter> proc_file_fds s p) # Execve p f fds # enrich_proc s p p')"

    proof-

      fix f fds

      assume a1: "valid (Execve p f fds # enrich_proc s p p')" and a2: "is_created_proc s p"

        and a3: "valid (Execve p f fds # s)" and a0: "p' \<notin> all_procs s"

      have cp2sp: "\<forall> tp. tp \<in> current_procs s \<longrightarrow> cp2sproc (enrich_proc s p p') tp = cp2sproc s tp"

        and cf2sf: "\<forall> tf. tf \<in> current_files s \<longrightarrow> cf2sfile (enrich_proc s p p') tf = cf2sfile s tf"

        and cfd2sfd: "\<forall> tp tfd. tfd \<in> proc_file_fds s tp \<longrightarrow> cfd2sfd (enrich_proc s p p') tp tfd = cfd2sfd s tp tfd"

        and dup_sp: "cp2sproc (enrich_proc s p p') p' = cp2sproc s p"

        and dup_sfd: "\<forall> fd. fd \<in> proc_file_fds s p \<longrightarrow> cfd2sfd (enrich_proc s p p') p' fd = cfd2sfd s p fd"

        using pre a2

        by auto

      show "valid (Execve p' f (fds \<inter> proc_file_fds s p) # Execve p f fds # enrich_proc s p p')"

      proof-

        from a0 a3 have a0': "p' \<noteq> p" by (auto dest!:vt_grant_os not_all_procs_prop3)

        from a3 have grant: "grant s (Execve p f fds)" and os: "os_grant s (Execve p f fds)"

          by (auto dest:vt_grant_os vt_grant simp del:os_grant.simps)

        have f_in: "is_file (enrich_proc s p p') f"

          using vd nodel os all_procs

          by (auto dest:vt_grant_os simp:enrich_proc_is_file)

        moreover have a5: "proc_file_fds s p \<subseteq> proc_file_fds (Execve p f fds # enrich_proc s p p') p'" 

          using a3 a0'

          apply (frule_tac vt_grant_os)

          apply (auto simp:proc_file_fds_def)

          apply (rule_tac x = fa in exI)

          apply (erule enrich_proc_dup_ffd)

          apply (simp_all add:vd all_procs a2)

          done

        ultimately have "os_grant (Execve p f fds # enrich_proc s p p') (Execve p' f (fds \<inter> proc_file_fds s p))"

          apply (auto simp:is_file_simps enrich_proc_dup_in a2 vd all_procs a1 enrich_proc_dup_ffds)

          done

        moreover have "grant (Execve p f fds # enrich_proc s p p') (Execve p' f (fds \<inter> proc_file_fds s p))"

        proof-

          from grant obtain up rp tp uf rf tf 

            where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"

            and p2: "sectxt_of_obj s (O_file f) = Some (uf, rf, tf)" 

            by (simp split:option.splits, blast)

          with grant obtain pu nr nt where p3: "npctxt_execve (up, rp, tp) (uf, rf, tf) = Some (pu, nr, nt)"

            by (simp split:option.splits del:npctxt_execve.simps, blast)

          have p1': "sectxt_of_obj (Execve p f fds # enrich_proc s p p') (O_proc p') = Some (up, rp, tp)"

            using p1 dup_sp a1 a0'

            apply (simp add:sectxt_of_obj_simps)

            by (simp add:cp2sproc_def split:option.splits)

          from os have f_in': "is_file s f"  by simp 

          from vd os have "\<exists> sf. cf2sfile s f = Some sf"

            by (auto dest!:is_file_in_current current_file_has_sfile)

          hence p2': "sectxt_of_obj (Execve p f fds # enrich_proc s p p') (O_file f) = Some (uf, rf, tf)" 

            using f_in p2 cf2sf os a1

            apply (erule_tac x = f in allE)

            apply (auto dest:is_file_in_current simp:cf2sfile_def sectxt_of_obj_simps split:option.splits)

            apply (case_tac f, simp)

            apply (drule_tac s = s in root_is_dir', simp add:vd, simp+)

            done 

          from dup_sfd a5 have "\<forall>fd. fd \<in> proc_file_fds s p \<longrightarrow> 

            cfd2sfd (Execve p f fds # enrich_proc s p p') p' fd = cfd2sfd s p fd"

            apply (rule_tac allI)

            apply (erule_tac x = fd in allE, clarsimp)

            apply (drule set_mp, simp)

            apply (auto simp:cfd2sfd_execve proc_file_fds_def a1)

            done

          hence "inherit_fds_check (Execve p f fds # enrich_proc s p p') (up, nr, nt) p' (fds \<inter> proc_file_fds s p)"

            using grant os p1 p2 p3 vd

            apply (clarsimp)

            apply (rule_tac s = s and p = p and fds = fds in enrich_inherit_fds_check_dup)

            apply simp_all

            done

          moreover have "search_check (Execve p f fds # enrich_proc s p p') (up, rp, tp) f"

            using p1 p2 p2' vd cf2sf f_in f_in' grant p3 f_in a1

            apply (rule_tac s = s in enrich_search_check)

            apply (simp_all add:is_file_simps)

            apply (rule allI, rule impI, erule_tac x = fa in allE, simp)

            apply (drule_tac ff = fa in cf2sfile_other')

            apply (auto simp:a2 enrich_proc_cur_files nodel)

            done

          ultimately show ?thesis 

            using p1' p2' p3

            apply (simp split:option.splits)

            using grant p1 p2

            apply simp

            done

        qed

        ultimately show ?thesis using a1

          by (erule_tac valid.intros(2), auto)

      qed

    qed

    moreover have "\<And>tp fds. \<lbrakk>valid (Clone tp p fds # s); p' \<noteq> p; p' \<notin> all_procs s\<rbrakk> \<Longrightarrow> 

      valid (Clone tp p' (fds \<inter> proc_file_fds s tp) # Clone tp p fds # s)"

      apply (frule vt_grant_os, frule vt_grant, drule not_all_procs_prop3)

      apply (rule valid.intros(2))

      apply (simp_all split:option.splits add:sectxt_of_obj_simps)

      apply (auto simp add:proc_file_fds_def)[1]

      apply (auto simp:inherit_fds_check_def sectxt_of_obj_simps sectxts_of_fds_def inherit_fds_check_ctxt_def)

      done

    moreover have "\<And>f flags fd opt. \<lbrakk>valid (Open p f flags fd opt # enrich_proc s p p'); 

      is_created_proc s p; valid (Open p f flags fd opt # s); p' \<notin> all_procs s\<rbrakk>

       \<Longrightarrow> valid (Open p' f (remove_create_flag flags) fd None # Open p f flags fd opt # enrich_proc s p p')"

    proof-

      fix f flags fd opt

      assume a1: "valid (Open p f flags fd opt # enrich_proc s p p')" and a2: "is_created_proc s p"

        and a3: "valid (Open p f flags fd opt # s)" and a4: "p' \<notin> all_procs s"

      have cp2sp: "\<forall> tp. tp \<in> current_procs s \<longrightarrow> cp2sproc (enrich_proc s p p') tp = cp2sproc s tp"

        and cf2sf: "\<forall> tf. tf \<in> current_files s \<longrightarrow> cf2sfile (enrich_proc s p p') tf = cf2sfile s tf"

        and cfd2sfd: "\<forall> tp tfd. tfd \<in> proc_file_fds s tp \<longrightarrow> cfd2sfd (enrich_proc s p p') tp tfd = cfd2sfd s tp tfd"

        and dup_sp: "cp2sproc (enrich_proc s p p') p' = cp2sproc s p"

        and dup_sfd: "\<forall> fd. fd \<in> proc_file_fds s p \<longrightarrow> cfd2sfd (enrich_proc s p p') p' fd = cfd2sfd s p fd"

        using pre a2 by auto

      from a4 a3 have a0: "p' \<noteq> p" by (auto dest!:vt_grant_os not_all_procs_prop3 split:option.splits)

      have a5: "p' \<in> current_procs (enrich_proc s p p')" 

        using a2 a3 vd

        apply (erule_tac enrich_proc_dup_in)

        by (simp_all add:vd a4)

      have a6: "is_file (Open p f flags fd opt # enrich_proc s p p') f"

        using a1 a3

        by (auto simp:is_file_open dest:vt_grant_os)

      have a7: "fd \<notin> current_proc_fds (enrich_proc s p p') p'"

        using a2 a4 vd nodel

        apply (simp add:enrich_proc_dup_ffds_eq_fds)

        apply (rule notI)

        apply (drule_tac p = p in file_fds_subset_pfds)

        apply (drule set_mp, simp)

        using a3

        apply (drule_tac vt_grant_os)

        apply (auto split:option.splits)

        done

      from a1 have a8: "valid (enrich_proc s p p')" by (erule_tac valid.cases, auto)

      from a3 have grant: "grant s (Open p f flags fd opt)" and os: "os_grant s (Open p f flags fd opt)"

        by (auto dest:vt_grant_os vt_grant)

      show "valid (Open p' f (remove_create_flag flags) fd None # Open p f flags fd opt # enrich_proc s p p')"

      proof (cases opt)

        case None

        have f_in: "is_file (enrich_proc s p p') f"

          using vd nodel os all_procs None

          by (auto dest:vt_grant_os simp:enrich_proc_is_file) 

        from grant None obtain up rp tp uf rf tf 

          where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"

          and p2: "sectxt_of_obj s (O_file f) = Some (uf, rf, tf)" 

          apply (simp split:option.splits)

          by (case_tac a, case_tac aa, blast)

        have p1': "sectxt_of_obj (Open p f flags fd opt # enrich_proc s p p') (O_proc p') = Some (up, rp, tp)"

          using p1 dup_sp a1

          apply (simp add:sectxt_of_obj_simps)

          by (simp add:cp2sproc_def split:option.splits)

        from os None have f_in': "is_file s f" by simp 

        from vd os None have "\<exists> sf. cf2sfile s f = Some sf"

          by (auto dest!:is_file_in_current current_file_has_sfile)

        hence p2': "sectxt_of_obj (Open p f flags fd opt # enrich_proc s p p') (O_file f) = Some (uf, rf, tf)" 

          using p2 cf2sf os a1 None f_in' vd f_in

          apply (erule_tac x = f in allE)

          apply (auto dest:is_file_in_current simp:cf2sfile_def sectxt_of_obj_simps split:option.splits)

          apply (case_tac f, simp)

          apply (drule_tac s = s in root_is_dir', simp add:vd, simp+)

          done 

        have "search_check (Open p f flags fd opt # enrich_proc s p p') (up, rp, tp) f"

          using p1 p2 p2' vd cf2sf f_in f_in' grant f_in a1 None

          apply (rule_tac s = s in enrich_search_check)

          apply (simp_all add:is_file_simps)

          apply (rule allI, rule impI, erule_tac x = fa in allE, simp)

          apply (simp add:cf2sfile_open_none)

          done

        thus ?thesis using a0 a5 a6 a7 None a1

          apply (rule_tac valid.intros(2))

          apply (simp_all add:a1)

          apply (case_tac flags, simp add:is_creat_excl_flag_def)

          using p1' p2'

          apply simp

          using grant p1 p2

          apply (simp add:oflags_check_remove_create)

          done

      next

        case (Some inum)

        with os obtain pf where parent: "parent f = Some pf" by auto

        with grant Some obtain pu rp pt pfu pfr pft where

          p1: "sectxt_of_obj s (O_proc p) = Some (pu, rp, pt)" 

          and p2: "sectxt_of_obj s (O_dir pf) = Some (pfu, pfr, pft)"

          apply (simp split:option.splits)

          apply (case_tac a, case_tac aa, blast)

          done

        from p1 have p1': "sectxt_of_obj (enrich_proc s p p') (O_proc p) = Some (pu, rp, pt)"

          using cp2sp os

          apply (erule_tac x = p in allE)

          apply (auto split:option.splits simp:cp2sproc_def)

          done

        from os parent Some

        have pf_in: "is_dir s pf" by auto

        hence "\<exists> sf. cf2sfile s pf = Some sf" using vd

          by (auto dest!:is_dir_in_current current_file_has_sfile)

        from a1 parent Some have pf_in': "is_dir (enrich_proc s p p') pf" 

          apply (frule_tac vt_grant_os)

          by (clarsimp)

        have p2': "sectxt_of_obj (enrich_proc s p p') (O_dir pf) = Some (pfu, pfr, pft)"

        proof-

          have "cf2sfile (enrich_proc s p p') pf = cf2sfile s pf"

            using cf2sf pf_in

            apply (drule_tac is_dir_in_current)

            apply (erule_tac x = pf in allE)

            by simp

          with pf_in pf_in' p2 vd Some a8

          show ?thesis            

            apply (frule_tac is_dir_not_file)

            apply (frule_tac s = "enrich_proc s p p'" in is_dir_not_file)

            apply (simp add:cf2sfile_def)

            apply (case_tac pf, simp) 

            apply (simp add:sroot_def root_sec_remains)            

            by (auto split:option.splits dest!:current_has_sec' get_pfs_secs_prop' dest:parentf_is_dir_prop1)        

        qed

        from p1 have dup: "sectxt_of_obj (Open p f flags fd (Some inum) # enrich_proc s p p') (O_proc p') 

          = Some (pu, rp, pt)"

          using a1 Some

          apply (simp add:sec_open)

          using dup_sp

          apply (auto split:option.splits if_splits simp:cp2sproc_def)

          done        

        have nsf: "sectxt_of_obj (Open p f flags fd (Some inum) # enrich_proc s p p') (O_file f) 

          = Some (pu, R_object, type_transition pt pft C_file True)"

          using a1 Some p1 p2 parent p2' p1'

          by (simp add:sec_open)

        have "search_check (Open p f flags fd (Some inum) # enrich_proc s p p') (pu, rp, pt) f"

        proof-

          have "search_check (Open p f flags fd (Some inum) # enrich_proc s p p') (pu, rp, pt) pf"

            using grant Some parent p1 p2 vd a1 pf_in pf_in' p2'

            apply simp 

            apply (rule_tac s = s in enrich_search_check') 

            apply (simp_all add:is_dir_simps sectxt_of_obj_simps)

            apply (rule allI, rule impI)

            apply (case_tac "fa = f")

            using os Some

            apply simp

            apply (drule_tac f' = fa in cf2sfile_open)

            apply (simp add:current_files_simps)

            using enrich_proc_cur_files a2 nodel

            apply simp

            apply simp

            using cf2sf

            apply simp

            done