theory Enrich2

imports Main Flask Static Init_prop Valid_prop Tainted_prop Delete_prop Co2sobj_prop S2ss_prop S2ss_prop2

 Temp Enrich Proc_fd_of_file_prop

begin

context tainting_s begin

fun enrich_msgq :: "t_state \<Rightarrow> t_msgq \<Rightarrow> t_msgq \<Rightarrow> t_state"

where

  "enrich_msgq [] tq dq = []"

| "enrich_msgq (CreateMsgq p q # s) tq dq = 

    (if (tq = q) 

     then (CreateMsgq p dq # CreateMsgq p q # s)

     else CreateMsgq p q # (enrich_msgq s tq dq))"

| "enrich_msgq (SendMsg p q m # s) tq dq = 

    (if (tq = q) 

     then (SendMsg p dq m # SendMsg p q m # (enrich_msgq s tq dq))

     else SendMsg p q m # (enrich_msgq s tq dq))"

| "enrich_msgq (RecvMsg p q m # s) tq dq = 

    (if (tq = q) 

     then (RecvMsg p dq m # RecvMsg p q m # (enrich_msgq s tq dq))

     else RecvMsg p q m # (enrich_msgq s tq dq))"

| "enrich_msgq (e # s) tq dq = e # (enrich_msgq s tq dq)"

lemma enrich_msgq_duq_in:

  "\<lbrakk>q' \<notin> current_msgqs s; q \<in> current_msgqs s; no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> q' \<in> current_msgqs (enrich_msgq s q q')"

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons, case_tac a)

apply auto

done

lemma enrich_msgq_duq_sms:

  "\<lbrakk>q' \<notin> current_msgqs s; q \<in> current_msgqs s; no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> msgs_of_queue (enrich_msgq s q q') q' = msgs_of_queue s q"

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons, case_tac a)

apply auto

done

lemma enrich_msgq_cur_inof:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> inum_of_file (enrich_msgq s q q') f = inum_of_file s f"

apply (induct s arbitrary:f, simp)

apply (frule vt_grant_os, frule vd_cons, case_tac a)

apply (auto split:option.splits)

done

lemma enrich_msgq_cur_inos:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> inum_of_socket (enrich_msgq s q q') = inum_of_socket s"

apply (rule ext)

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons, case_tac a)

apply (auto split:option.splits)

done

lemma enrich_msgq_cur_inos':

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> inum_of_socket (enrich_msgq s q q') sock = inum_of_socket s sock"

apply (simp add:enrich_msgq_cur_inos)

done

lemma enrich_msgq_cur_inums:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> current_inode_nums (enrich_msgq s q q') = current_inode_nums s"

apply (auto simp:current_inode_nums_def current_file_inums_def 

  current_sock_inums_def enrich_msgq_cur_inof enrich_msgq_cur_inos)

done

lemma enrich_msgq_cur_itag:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> itag_of_inum (enrich_msgq s q q') = itag_of_inum s"

apply (rule ext)

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons, case_tac a)

apply (auto split:option.splits t_socket_type.splits)

done

lemma enrich_msgq_cur_tcps:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> is_tcp_sock (enrich_msgq s q q') = is_tcp_sock s"

apply (rule ext)

apply (auto simp:is_tcp_sock_def enrich_msgq_cur_itag enrich_msgq_cur_inos

  split:option.splits t_inode_tag.splits)

done

lemma enrich_msgq_cur_udps:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> is_udp_sock (enrich_msgq s q q') = is_udp_sock s"

apply (rule ext)

apply (auto simp:is_udp_sock_def enrich_msgq_cur_itag enrich_msgq_cur_inos

  split:option.splits t_inode_tag.splits)

done

lemma enrich_msgq_cur_msgqs:

  "\<lbrakk>q \<in> current_msgqs s; no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> current_msgqs (enrich_msgq s q q') = current_msgqs s \<union> {q'}"

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons)

apply (case_tac a, auto)

done

lemma enrich_msgq_cur_msgs:

  "\<lbrakk>q' \<notin> current_msgqs s; q \<in> current_msgqs s; no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> msgs_of_queue (enrich_msgq s q q') =  (msgs_of_queue s) (q' := msgs_of_queue s q)" 

apply (rule ext, simp, rule conjI, rule impI)

apply (simp add:enrich_msgq_duq_sms)

apply (rule impI) 

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons)

apply (case_tac a, auto)

done

lemma enrich_msgq_cur_procs:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> current_procs (enrich_msgq s q q') = current_procs s"

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons)

apply (case_tac a, auto)

done

lemma enrich_msgq_cur_files:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> current_files (enrich_msgq s q q') = current_files s"

apply (auto simp:current_files_def)

apply (simp add:enrich_msgq_cur_inof)+

done

lemma enrich_msgq_cur_fds:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> current_proc_fds (enrich_msgq s q q') = current_proc_fds s"

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons, case_tac a)

apply auto

done

lemma enrich_msgq_filefd:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> file_of_proc_fd (enrich_msgq s q q') = file_of_proc_fd s"

apply (rule ext, rule ext)

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons, case_tac a)

apply auto

done

lemma enrich_msgq_flagfd:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> flags_of_proc_fd (enrich_msgq s q q') = flags_of_proc_fd s"

apply (rule ext, rule ext)

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons, case_tac a)

apply auto

done

lemma enrich_msgq_proc_fds:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> proc_file_fds (enrich_msgq s q q') = proc_file_fds s"

apply (auto simp:proc_file_fds_def enrich_msgq_filefd)

done

lemma enrich_msgq_hungs:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> files_hung_by_del (enrich_msgq s q q') = files_hung_by_del s"

apply (induct s, simp)

apply (frule vt_grant_os, frule vd_cons, case_tac a)

apply (auto simp:files_hung_by_del.simps)

done

lemma enrich_msgq_is_file:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> is_file (enrich_msgq s q q') = is_file s"

apply (rule ext)

apply (auto simp add:is_file_def enrich_msgq_cur_itag enrich_msgq_cur_inof

  split:option.splits t_inode_tag.splits)

done

lemma enrich_msgq_is_dir:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> is_dir (enrich_msgq s q q') = is_dir s"

apply (rule ext)

apply (auto simp add:is_dir_def enrich_msgq_cur_itag enrich_msgq_cur_inof

  split:option.splits t_inode_tag.splits)

done

lemma enrich_msgq_sameinode:

  "\<lbrakk>no_del_event s; valid s\<rbrakk>

  \<Longrightarrow> (f \<in> same_inode_files (enrich_msgq s q q') f') = (f \<in> same_inode_files s f')"

apply (induct s, simp)

apply (simp add:same_inode_files_def)

apply (auto simp:enrich_msgq_is_file enrich_msgq_cur_inof)

done

lemma enrich_msgq_tainted_aux1:

  "\<lbrakk>no_del_event s; q \<in> current_msgqs s; q' \<notin> current_msgqs s; valid s\<rbrakk>

   \<Longrightarrow> (tainted s \<union> {O_msg q' m| m. O_msg q m \<in> tainted s}) \<subseteq> tainted (enrich_msgq s q q')"

apply (induct s, simp) 

apply (frule vt_grant_os, frule vd_cons)

apply (case_tac a)

apply (auto split:option.splits if_splits dest:tainted_in_current

  simp:enrich_msgq_filefd enrich_msgq_sameinode)

done

lemma enrich_msgq_tainted_aux2:

  "\<lbrakk>no_del_event s; q \<in> current_msgqs s; q' \<notin> current_msgqs s; valid s; valid (enrich_msgq s q q')\<rbrakk>

   \<Longrightarrow> tainted (enrich_msgq s q q') \<subseteq> (tainted s \<union> {O_msg q' m| m. O_msg q m \<in> tainted s})"

apply (induct s, simp) 

apply (frule vt_grant_os, frule vd_cons)

apply (case_tac a)

apply (auto split:option.splits if_splits simp:enrich_msgq_filefd enrich_msgq_sameinode 

  dest:tainted_in_current vd_cons)

apply (drule_tac vd_cons)+

apply (simp)

apply (drule set_mp)

apply simp

apply simp

apply (drule_tac s = s in tainted_in_current)

apply simp+

done

lemma enrich_msgq_alive:

  "\<lbrakk>alive s obj; valid s; q \<in> current_msgqs s; q' \<notin> current_msgqs s; no_del_event s\<rbrakk>

   \<Longrightarrow> alive (enrich_msgq s q q') obj"

apply (case_tac obj)

apply (simp_all add:enrich_msgq_is_file enrich_msgq_is_dir enrich_msgq_cur_msgqs 

  enrich_msgq_cur_msgs enrich_msgq_cur_procs enrich_msgq_cur_fds

  enrich_msgq_cur_tcps enrich_msgq_cur_udps)

apply (rule impI, simp)

done

lemma enrich_msgq_alive':

  "\<lbrakk>alive (enrich_msgq s q q') obj; valid s; q \<in> current_msgqs s; q' \<notin> current_msgqs s; no_del_event s\<rbrakk>

   \<Longrightarrow> alive s obj \<or> obj = O_msgq q' \<or> (\<exists> m. obj = O_msg q' m \<and> alive s (O_msg q m))"

apply (case_tac obj)

apply (simp_all add:enrich_msgq_is_file enrich_msgq_is_dir enrich_msgq_cur_msgqs 

  enrich_msgq_cur_msgs enrich_msgq_cur_procs enrich_msgq_cur_fds

  enrich_msgq_cur_tcps enrich_msgq_cur_udps)

apply (auto split:if_splits)

done

lemma enrich_msgq_not_alive:

  "\<lbrakk>enrich_not_alive s (E_msgq q') obj; q' \<notin> current_msgqs s; q \<in> current_msgqs s; no_del_event s; valid s\<rbrakk>

   \<Longrightarrow> enrich_not_alive (enrich_msgq s q q') (E_msgq q') obj"

apply (case_tac obj)

apply (auto simp:enrich_msgq_cur_fds enrich_msgq_cur_files 

  enrich_msgq_cur_procs enrich_msgq_cur_inums enrich_msgq_cur_msgqs enrich_msgq_cur_msgs)

done

lemma enrich_msgq_nodel:

  "no_del_event (enrich_msgq s q q') = no_del_event s"

apply (induct s, simp)

by (case_tac a, auto)

lemma enrich_msgq_died_proc:

  "died (O_proc p) (enrich_msgq s q q') = died (O_proc p) s"

apply (induct s, simp)

by (case_tac a, auto)

lemma cf2sfile_execve:

  "\<lbrakk>ff \<in> current_files (Execve p f fds # s); valid (Execve p f fds # s)\<rbrakk>

   \<Longrightarrow> cf2sfile (Execve p f fds # s) ff= cf2sfile s ff"

by (auto dest:cf2sfile_other' simp:current_files_simps)

lemma cf2sfile_clone:

  "\<lbrakk>ff \<in> current_files (Clone p p' fds # s); valid (Clone p p' fds # s)\<rbrakk>

   \<Longrightarrow> cf2sfile (Clone p p' fds # s) ff= cf2sfile s ff"

by (auto dest:cf2sfile_other' simp:current_files_simps)

lemma cf2sfile_ptrace:

  "\<lbrakk>ff \<in> current_files (Ptrace p p' # s); valid (Ptrace p p' # s)\<rbrakk>

   \<Longrightarrow> cf2sfile (Ptrace p p' # s) ff= cf2sfile s ff"

by (auto dest:cf2sfile_other' simp:current_files_simps)

lemma cf2sfile_readfile:

  "\<lbrakk>ff \<in> current_files (ReadFile p fd # s); valid (ReadFile p fd # s)\<rbrakk>

   \<Longrightarrow> cf2sfile (ReadFile p fd # s) ff= cf2sfile s ff"

by (auto dest:cf2sfile_other' simp:current_files_simps)

lemma cf2sfile_writefile:

  "\<lbrakk>ff \<in> current_files (WriteFile p fd # s); valid (WriteFile p fd # s)\<rbrakk>

   \<Longrightarrow> cf2sfile (WriteFile p fd # s) ff= cf2sfile s ff"

by (auto dest:cf2sfile_other' simp:current_files_simps)

lemma cf2sfile_truncate:

  "\<lbrakk>ff \<in> current_files (Truncate p f len # s); valid (Truncate p f len # s)\<rbrakk>

   \<Longrightarrow> cf2sfile (Truncate p f len # s) ff= cf2sfile s ff"

by (auto dest:cf2sfile_other' simp:current_files_simps)

lemma cf2sfile_createmsgq:

  "\<lbrakk>ff \<in> current_files (CreateMsgq p q # s); valid (CreateMsgq p q # s)\<rbrakk>

   \<Longrightarrow> cf2sfile (CreateMsgq p q # s) ff= cf2sfile s ff"

by (auto dest:cf2sfile_other' simp:current_files_simps)

lemma cf2sfile_sendmsg:

  "\<lbrakk>ff \<in> current_files (SendMsg p q m # s); valid (SendMsg p q m # s)\<rbrakk>

   \<Longrightarrow> cf2sfile (SendMsg p q m # s) ff = cf2sfile s ff"

by (auto dest:cf2sfile_other' simp:current_files_simps)

lemma cf2sfile_recvmsg:

  "\<lbrakk>ff \<in> current_files (RecvMsg p q m # s); valid (RecvMsg p q m # s)\<rbrakk>

   \<Longrightarrow> cf2sfile (RecvMsg p q m # s) ff = cf2sfile s ff"

by (auto dest:cf2sfile_other' simp:current_files_simps)

lemmas cf2sfile_other'' = cf2sfile_recvmsg cf2sfile_sendmsg cf2sfile_createmsgq cf2sfile_truncate

  cf2sfile_writefile cf2sfile_readfile cf2sfile_ptrace cf2sfile_clone cf2sfile_execve

lemma enrich_msgq_prop:

  "\<lbrakk>valid s; q \<in> current_msgqs s; q' \<notin> current_msgqs s; no_del_event s\<rbrakk>

   \<Longrightarrow> valid (enrich_msgq s q q') \<and>

       (\<forall> tp. tp \<in> current_procs s \<longrightarrow> cp2sproc (enrich_msgq s q q') tp = cp2sproc s tp) \<and>

       (\<forall> f. f \<in> current_files s \<longrightarrow> cf2sfile (enrich_msgq s q q') f = cf2sfile s f) \<and> 

       (\<forall> tq. tq \<in> current_msgqs s \<longrightarrow> cq2smsgq (enrich_msgq s q q') tq = cq2smsgq s tq) \<and> 

       (\<forall> tp fd. fd \<in> proc_file_fds s tp \<longrightarrow> cfd2sfd (enrich_msgq s q q') tp fd = cfd2sfd s tp fd) \<and>

       (cq2smsgq (enrich_msgq s q q') q' = cq2smsgq s q) \<and>

       (tainted (enrich_msgq s q q') = (tainted s \<union> {O_msg q' m| m. O_msg q m \<in> tainted s}))"

proof (induct s)

  case Nil

  thus ?case by (auto)

next

  case (Cons e s)

  hence vd_cons': "valid (e # s)" and curq_cons: "q \<in> current_msgqs (e # s)"

    and curq'_cons: "q' \<notin> current_msgqs (e # s)" and nodel_cons: "no_del_event (e # s)"

    and os: "os_grant s e" and grant: "grant s e"  and vd: "valid s"

    by (auto dest:vd_cons vt_grant_os vt_grant)

  from curq'_cons nodel_cons have curq': "q' \<notin> current_msgqs s" by (case_tac e, auto)

  from nodel_cons have nodel: "no_del_event s" by (case_tac e, auto)

  from nodel curq' vd Cons

  have pre: "q \<in> current_msgqs s \<Longrightarrow> valid (enrich_msgq s q q') \<and>

     (\<forall>tp. tp \<in> current_procs s \<longrightarrow> cp2sproc (enrich_msgq s q q') tp = cp2sproc s tp) \<and>

     (\<forall>f. f \<in> current_files s \<longrightarrow> cf2sfile (enrich_msgq s q q') f = cf2sfile s f) \<and>

     (\<forall>tq. tq \<in> current_msgqs s \<longrightarrow> cq2smsgq (enrich_msgq s q q') tq = cq2smsgq s tq) \<and>

     (\<forall>tp fd. fd \<in> proc_file_fds s tp \<longrightarrow> cfd2sfd (enrich_msgq s q q') tp fd = cfd2sfd s tp fd) \<and>

     (cq2smsgq (enrich_msgq s q q') q' = cq2smsgq s q) \<and>

     (tainted (enrich_msgq s q q') = (tainted s \<union> {O_msg q' m| m. O_msg q m \<in> tainted s}))"

    by auto

  from pre have pre_vd: "q \<in> current_msgqs s \<Longrightarrow> valid (enrich_msgq s q q')" by simp

  from pre have pre_sp: "\<And> tp. \<lbrakk>tp \<in> current_procs s; q \<in> current_msgqs s\<rbrakk>

    \<Longrightarrow> cp2sproc (enrich_msgq s q q') tp = cp2sproc s tp" by auto

  from pre have pre_sf: "\<And> f. \<lbrakk>f \<in> current_files s; q \<in> current_msgqs s\<rbrakk>

    \<Longrightarrow> cf2sfile (enrich_msgq s q q') f = cf2sfile s f" by auto

  from pre have pre_sq: "\<And> tq. \<lbrakk>tq \<in> current_msgqs s; q \<in> current_msgqs s\<rbrakk>

    \<Longrightarrow> cq2smsgq (enrich_msgq s q q') tq = cq2smsgq s tq" by auto

  from pre have pre_sfd: "\<And> tp fd. \<lbrakk>fd \<in> proc_file_fds s tp; q \<in> current_msgqs s\<rbrakk>

    \<Longrightarrow> cfd2sfd (enrich_msgq s q q') tp fd = cfd2sfd s tp fd" by auto

  hence pre_sfd': "\<And> tp fd f. \<lbrakk>file_of_proc_fd s tp fd = Some f; q \<in> current_msgqs s\<rbrakk>

    \<Longrightarrow> cfd2sfd (enrich_msgq s q q') tp fd = cfd2sfd s tp fd" by (auto simp:proc_file_fds_def)

  from pre have pre_duq: "q \<in> current_msgqs s \<Longrightarrow> cq2smsgq (enrich_msgq s q q') q' = cq2smsgq s q"

    by auto

  have vd_enrich:"q \<in> current_msgqs s \<Longrightarrow> valid (e # enrich_msgq s q q')" 

    apply (frule pre_vd)

    apply (erule_tac s = s and obj' = "E_msgq q'" in enrich_valid_intro_cons)

    apply (simp_all add:pre nodel nodel_cons curq_cons vd_cons' vd enrich_msgq_hungs)

    apply (clarsimp simp:nodel vd curq' enrich_msgq_alive)

    apply (rule allI, rule impI, erule enrich_msgq_not_alive)

    apply (simp_all add:curq' curq'_cons nodel vd enrich_msgq_cur_msgs enrich_msgq_filefd enrich_msgq_flagfd)

    done

  have q_neq_q': "q' \<noteq> q" using curq'_cons curq_cons by auto

  have vd_enrich_cons: "valid (enrich_msgq (e # s) q q')"

  proof-

    have "\<And> p q''. e = CreateMsgq p q'' \<Longrightarrow> valid (enrich_msgq (e # s) q q')"

    proof-

      fix p q'' assume ev: "e = CreateMsgq p q''" 

      show "valid (enrich_msgq (e # s) q q')"

      proof (cases "q'' = q")

        case False with ev vd_enrich curq_cons

        show ?thesis by simp

      next

        case True 

        have "os_grant (CreateMsgq p q # s) (CreateMsgq p q')"

          using os ev

          by (simp add:q_neq_q' curq')

        moreover have "grant (CreateMsgq p q # s) (CreateMsgq p q')"

          using grant ev

          by (auto simp add:sectxt_of_obj_def split:option.splits)

        ultimately 

        show ?thesis using  ev vd_cons' True 

          by (auto intro: valid.intros(2))

      qed

    qed

    moreover have "\<And> p q'' m. \<lbrakk>e = SendMsg p q'' m; q \<in> current_msgqs s\<rbrakk>

      \<Longrightarrow> valid (enrich_msgq (e # s) q q')" 

    proof-

      fix p q'' m assume ev: "e = SendMsg p q'' m" and q_in: "q \<in> current_msgqs s"

      show "valid (enrich_msgq (e # s) q q')"

      proof (cases "q'' = q")

        case False with ev vd_enrich q_in

        show ?thesis by simp

      next

        case True

        from grant os ev True obtain psec qsec 

          where psec: "sectxt_of_obj s (O_proc p) = Some psec"

          and qsec: "sectxt_of_obj s (O_msgq q) = Some qsec"

          by (auto split:option.splits)

        from psec q_in os ev 

        have psec':"sectxt_of_obj (enrich_msgq s q q') (O_proc p) = Some psec"  

          by (auto dest!:pre_sp simp:cp2sproc_def split:option.splits)

        from qsec q_in pre_duq vd

        have qsec': "sectxt_of_obj (enrich_msgq s q q') (O_msgq q') = Some qsec"

          by (auto simp:cq2smsgq_def split:option.splits dest!:current_has_sms')

        show ?thesis using ev True vd_cons' q_in vd_enrich nodel vd 

          curq' psec psec' qsec qsec' grant os q_neq_q'

          apply (simp, erule_tac valid.intros(2))    

          apply (auto simp:q_neq_q' enrich_msgq_cur_msgqs enrich_msgq_cur_procs

            enrich_msgq_cur_msgs sectxt_of_obj_simps)

          done        

      qed

    qed

    moreover have "\<And> p q'' m. \<lbrakk>e = RecvMsg p q'' m; q \<in> current_msgqs s\<rbrakk>

           \<Longrightarrow> valid (enrich_msgq (e # s) q q')"

    proof-

      fix p q'' m assume ev: "e = RecvMsg p q'' m" and q_in: "q \<in> current_msgqs s"

      show "valid (enrich_msgq (e # s) q q')"

      proof (cases "q'' = q")

        case False with ev vd_enrich q_in

        show ?thesis by simp

      next

        case True

        from grant os ev True obtain psec qsec msec

          where psec: "sectxt_of_obj s (O_proc p) = Some psec"

          and qsec: "sectxt_of_obj s (O_msgq q) = Some qsec"

          and msec: "sectxt_of_obj s (O_msg q (hd (msgs_of_queue s q))) = Some msec"

          by (auto split:option.splits)

        from psec q_in os ev 

        have psec':"sectxt_of_obj (enrich_msgq s q q') (O_proc p) = Some psec"  

          by (auto dest!:pre_sp simp:cp2sproc_def split:option.splits)

        from qsec q_in pre_duq vd

        have qsec': "sectxt_of_obj (enrich_msgq s q q') (O_msgq q') = Some qsec"

          by (auto simp:cq2smsgq_def split:option.splits dest!:current_has_sms')

        from qsec q_in vd

        have qsec'': "sectxt_of_obj (enrich_msgq s q q') (O_msgq q) = Some qsec"

          apply (frule_tac pre_sq, simp_all)          

          by (auto simp:cq2smsgq_def split:option.splits dest!:current_has_sms')

        from msec q_in pre_duq vd qsec qsec' qsec'' curq' nodel

        have msec': "sectxt_of_obj (enrich_msgq s q q') (O_msg q' (hd (msgs_of_queue s q))) = Some msec"

          apply (auto simp:cq2smsgq_def  enrich_msgq_cur_msgs

            split:option.splits dest!:current_has_sms')

          apply (case_tac "msgs_of_queue s q")

          using os ev True apply simp

          apply (simp add:cqm2sms.simps split:option.splits)

          apply (auto simp:cm2smsg_def split:option.splits)

          done          

        show ?thesis using ev True vd_cons' q_in vd_enrich nodel vd 

          curq'  grant os q_neq_q' psec psec' msec msec' qsec qsec'

          apply (simp, erule_tac valid.intros(2))

          apply (auto simp:enrich_msgq_cur_msgqs enrich_msgq_cur_procs

            enrich_msgq_cur_msgs sectxt_of_obj_simps)

          done

      qed

    qed

    ultimately

    show ?thesis using vd_enrich curq_cons vd_cons'

      apply (case_tac e)

      apply (auto simp del:enrich_msgq.simps)

      apply (auto split:if_splits )

      done

  qed

  have curpsec: "\<And> tp. \<lbrakk>tp \<in> current_procs s; q \<in> current_msgqs s\<rbrakk> \<Longrightarrow> 

    sectxt_of_obj (enrich_msgq s q q') (O_proc tp) = sectxt_of_obj s (O_proc tp)"

    using pre_vd vd

    apply (frule_tac pre_sp, simp)

    by (auto simp:cp2sproc_def split:option.splits if_splits dest!:current_has_sec')    

  have curfsec: "\<And> f. \<lbrakk>is_file s f; q \<in> current_msgqs s\<rbrakk> \<Longrightarrow> 

    sectxt_of_obj (enrich_msgq s q q') (O_file f) = sectxt_of_obj s (O_file f)"

  proof-

    fix f 

    assume a1: "is_file s f" and a2: "q \<in> current_msgqs s"

    from a2 pre_sf pre_vd

    have pre': "\<And>f. f \<in> current_files s \<Longrightarrow> cf2sfile (enrich_msgq s q q') f = cf2sfile s f"

      and vd_enrich: "valid (enrich_msgq s q q')"

      by auto

    hence csf: "cf2sfile (enrich_msgq s q q') f = cf2sfile s f"

      using a1 by (auto simp:is_file_in_current)

    from a1 obtain sf where csf_some: "cf2sfile s f = Some sf"

      apply (case_tac "cf2sfile s f")

      apply (drule current_file_has_sfile')

      apply (simp add:vd, simp add:is_file_in_current, simp)

      done

    from a1 have a1': "is_file (enrich_msgq s q q') f"

      using vd nodel by (simp add:enrich_msgq_is_file)

    show "sectxt_of_obj (enrich_msgq s q q') (O_file f) = sectxt_of_obj s (O_file f)"

      using csf csf_some vd_enrich vd a1 a1'

      apply (auto simp:cf2sfile_def split:option.splits if_splits)

      apply (case_tac f, simp_all)

      apply (drule root_is_dir', simp+)

      done

  qed

  have curdsec: "\<And> tf. \<lbrakk>is_dir s tf; q \<in> current_msgqs s\<rbrakk>

    \<Longrightarrow> sectxt_of_obj (enrich_msgq s q q') (O_dir tf) = sectxt_of_obj s (O_dir tf)"

  proof-  

    fix tf 

    assume a1: "is_dir s tf" and a2: "q \<in> current_msgqs s"

    from a2 pre_sf pre_vd

    have pre': "\<And>f. f \<in> current_files s \<Longrightarrow> cf2sfile (enrich_msgq s q q') f = cf2sfile s f"

      and vd_enrich: "valid (enrich_msgq s q q')"

      by auto

    hence csf: "cf2sfile (enrich_msgq s q q') tf = cf2sfile s tf"

      using a1 by (auto simp:is_dir_in_current)