Sectxt_prop.thy
changeset 1 7d9c0ed02b56
child 7 f27882976251
equal deleted inserted replaced
0:34d01e9a772e 1:7d9c0ed02b56
       
     1 theory Sectxt_prop
       
     2 imports Main Flask Flask_type Current_files_prop Current_sockets_prop Alive_prop
       
     3 begin
       
     4 
       
     5 context flask begin
       
     6 
       
     7 lemma alive_obj_has_type:
       
     8   assumes alive: "alive s obj" and vs: "valid s"
       
     9   shows "\<exists> t. type_of_obj s obj = Some t"
       
    10 using alive vs
       
    11 proof (induct s arbitrary:obj)
       
    12   case Nil
       
    13   thus ?case
       
    14     by (simp add:init_alive_prop[THEN sym] init_obj_has_type)
       
    15 next
       
    16   case (Cons e s)
       
    17   hence a2: "alive (e # s) obj" and a3: "valid (e # s)" by auto
       
    18   hence a4: "valid s" and a5: "os_grant s e" and a6: "grant s e" 
       
    19     by (auto intro:vd_cons vt_grant_os vt_grant)  
       
    20   hence a1: "\<And> obj. alive s obj \<Longrightarrow> \<exists>t. type_of_obj s obj = Some t" using Cons by auto
       
    21   have a1': "\<And> obj. type_of_obj s obj = None \<Longrightarrow> \<not> alive s obj" by (rule_tac notI, auto dest:a1)
       
    22   have p1: "\<And> p. p \<in> current_procs s \<Longrightarrow> \<exists> t. type_of_obj s (O_proc p) = Some t" by (auto intro:a1)
       
    23   have p2: "\<And> f. is_file s f \<Longrightarrow> \<exists> t. type_of_obj s (O_file f) = Some t"
       
    24     by (auto intro!:a1 simp:is_file_in_current)
       
    25   have p3: "\<And> f. is_dir s f \<Longrightarrow> \<exists> t. type_of_obj s (O_dir f) = Some t" 
       
    26     by (auto intro!:a1 simp:is_dir_in_current)
       
    27   have p4: "\<And> sock. is_tcp_sock s sock \<Longrightarrow> \<exists> t. type_of_obj s (O_tcp_sock sock) = Some t"
       
    28     by (auto intro!:a1 simp:is_tcp_in_current)
       
    29   have p5: "\<And> sock. is_udp_sock s sock \<Longrightarrow> \<exists> t. type_of_obj s (O_udp_sock sock) = Some t"
       
    30     by (auto intro!:a1 simp:is_udp_in_current)
       
    31   have p6: "\<And> p fd. fd \<in> current_proc_fds s p \<Longrightarrow> \<exists> t. type_of_obj s (O_fd p fd) = Some t"
       
    32     by (auto intro:a1)
       
    33   have p7: "\<And> n. n \<in> init_nodes \<Longrightarrow> \<exists> t. type_of_obj s (O_node n) = Some t" by (auto intro:a1)
       
    34   have p8: "\<And> h. h \<in> current_shms s \<Longrightarrow> \<exists> t. type_of_obj s (O_shm h) = Some t" by (auto intro:a1)
       
    35   have p9: "\<And> q. q \<in> current_msgqs s \<Longrightarrow> \<exists> t. type_of_obj s (O_msgq q) = Some t" by (auto intro:a1)
       
    36   have p10: "\<And> q m. \<lbrakk>m \<in> set (msgs_of_queue s q); q \<in> current_msgqs s\<rbrakk>
       
    37     \<Longrightarrow> \<exists> t. type_of_obj s (O_msg q m) = Some t" by (auto intro:a1)
       
    38   show ?case using a5 a2 a4 a3
       
    39     apply (case_tac e)
       
    40     apply (auto split:option.splits t_object.splits if_splits t_socket_type.splits
       
    41                 dest!:a1' intro:a1 intro:p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 simp:alive_simps)
       
    42     done
       
    43 qed
       
    44 
       
    45 lemma alive_obj_has_user:
       
    46   assumes alive: "alive s obj" and vs: "valid s"
       
    47   shows "\<exists> t. user_of_obj s obj = Some t"
       
    48 using alive vs
       
    49 proof (induct s arbitrary:obj)
       
    50   case Nil
       
    51   thus ?case
       
    52     by (simp add:init_alive_prop[THEN sym] init_obj_has_user)
       
    53 next
       
    54   case (Cons e s)
       
    55   hence a2: "alive (e # s) obj" and a3: "valid (e # s)" by auto
       
    56   hence a4: "valid s" and a5: "os_grant s e" and a6: "grant s e" 
       
    57     by (auto intro:vd_cons vt_grant_os vt_grant)  
       
    58   hence a1: "\<And> obj. alive s obj \<Longrightarrow> \<exists>t. user_of_obj s obj = Some t" using Cons by auto
       
    59   have a1': "\<And> obj. user_of_obj s obj = None \<Longrightarrow> \<not> alive s obj" by (rule_tac notI, auto dest:a1)
       
    60   have p1: "\<And> p. p \<in> current_procs s \<Longrightarrow> \<exists> t. user_of_obj s (O_proc p) = Some t" by (auto intro:a1)
       
    61   have p2: "\<And> f. is_file s f \<Longrightarrow> \<exists> t. user_of_obj s (O_file f) = Some t"
       
    62     by (auto intro!:a1 simp:is_file_in_current)
       
    63   have p3: "\<And> f. is_dir s f \<Longrightarrow> \<exists> t. user_of_obj s (O_dir f) = Some t" 
       
    64     by (auto intro!:a1 simp:is_dir_in_current)
       
    65   have p4: "\<And> sock. is_tcp_sock s sock \<Longrightarrow> \<exists> t. user_of_obj s (O_tcp_sock sock) = Some t"
       
    66     by (auto intro!:a1 simp:is_tcp_in_current)
       
    67   have p5: "\<And> sock. is_udp_sock s sock \<Longrightarrow> \<exists> t. user_of_obj s (O_udp_sock sock) = Some t"
       
    68     by (auto intro!:a1 simp:is_udp_in_current)
       
    69   have p6: "\<And> p fd. fd \<in> current_proc_fds s p \<Longrightarrow> \<exists> t. user_of_obj s (O_fd p fd) = Some t"
       
    70     by (auto intro:a1)
       
    71   have p7: "\<And> n. n \<in> init_nodes \<Longrightarrow> \<exists> t. user_of_obj s (O_node n) = Some t" by (auto intro:a1)
       
    72   have p8: "\<And> h. h \<in> current_shms s \<Longrightarrow> \<exists> t. user_of_obj s (O_shm h) = Some t" by (auto intro:a1)
       
    73   have p9: "\<And> q. q \<in> current_msgqs s \<Longrightarrow> \<exists> t. user_of_obj s (O_msgq q) = Some t" by (auto intro:a1)
       
    74   have p10: "\<And> q m. \<lbrakk>m \<in> set (msgs_of_queue s q); q \<in> current_msgqs s\<rbrakk>
       
    75     \<Longrightarrow> \<exists> t. user_of_obj s (O_msg q m) = Some t" by (auto intro:a1)
       
    76   show ?case using a5 a2 a4 a3
       
    77     apply (case_tac e)
       
    78     apply (auto split:option.splits t_object.splits if_splits t_socket_type.splits
       
    79                 dest!:a1' intro:a1 intro:p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 simp:alive_simps)
       
    80     done
       
    81 qed
       
    82   
       
    83 lemma alive_obj_has_type': "\<lbrakk>type_of_obj s obj = None; valid s\<rbrakk> \<Longrightarrow> \<not> alive s obj" 
       
    84 by (rule_tac notI, auto dest:alive_obj_has_type)
       
    85 
       
    86 lemma current_proc_has_type: 
       
    87   "\<lbrakk>p \<in> current_procs s; valid s\<rbrakk> \<Longrightarrow> \<exists> t. type_of_obj s (O_proc p) = Some t" 
       
    88 by (auto intro:alive_obj_has_type)
       
    89 
       
    90 lemma current_proc_has_type': 
       
    91   "\<lbrakk>type_of_obj s (O_proc p) = None; valid s\<rbrakk> \<Longrightarrow> p \<notin> current_procs s" 
       
    92 by (rule notI, auto dest:current_proc_has_type)
       
    93 
       
    94 lemma is_file_has_type: "\<lbrakk>is_file s f; valid s\<rbrakk> \<Longrightarrow> \<exists> t. type_of_obj s (O_file f) = Some t"
       
    95 by (auto intro:alive_obj_has_type simp:is_file_in_current)
       
    96 
       
    97 lemma is_file_has_type': "\<lbrakk>type_of_obj s (O_file f) = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_file s f"
       
    98 by (auto intro:notI dest:is_file_has_type)
       
    99 
       
   100 lemma is_dir_has_type: "\<lbrakk>is_dir s f; valid s\<rbrakk> \<Longrightarrow> \<exists> t. type_of_obj s (O_dir f) = Some t"
       
   101 by (auto intro:alive_obj_has_type simp:is_dir_in_current)
       
   102 
       
   103 lemma is_dir_has_type': "\<lbrakk>type_of_obj s (O_dir f) = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_dir s f"
       
   104 by (auto intro:notI dest:is_dir_has_type)
       
   105 
       
   106 lemma is_tcp_has_type: "\<lbrakk>is_tcp_sock s sock; valid s\<rbrakk> \<Longrightarrow> \<exists> t. type_of_obj s (O_tcp_sock sock) = Some t"
       
   107 by (auto intro:alive_obj_has_type simp:is_tcp_in_current)
       
   108 
       
   109 lemma is_tcp_has_type': "\<lbrakk>type_of_obj s (O_tcp_sock sock) = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_tcp_sock s sock"
       
   110 by (auto intro:notI dest:is_tcp_has_type)
       
   111 
       
   112 lemma is_udp_has_type: "\<lbrakk>is_udp_sock s sock; valid s\<rbrakk> \<Longrightarrow> \<exists> t. type_of_obj s (O_udp_sock sock) = Some t"
       
   113 by (auto intro:alive_obj_has_type simp:is_udp_in_current)
       
   114 
       
   115 lemma is_udp_has_type': "\<lbrakk>type_of_obj s (O_udp_sock sock) = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_udp_sock s sock"
       
   116 by (auto intro:notI dest:is_udp_has_type)
       
   117 
       
   118 lemma current_fd_has_type: "\<lbrakk>fd \<in> current_proc_fds s p; valid s\<rbrakk> \<Longrightarrow> \<exists> t. type_of_obj s (O_fd p fd) = Some t"
       
   119 by (auto intro:alive_obj_has_type)
       
   120 
       
   121 lemma current_fd_has_type': "\<lbrakk>type_of_obj s (O_fd p fd) = None; valid s\<rbrakk> \<Longrightarrow> fd \<notin> current_proc_fds s p"
       
   122 by (auto intro:notI dest:current_fd_has_type)
       
   123 
       
   124 lemma init_node_has_type: "\<lbrakk>n \<in> init_nodes; valid s\<rbrakk> \<Longrightarrow> \<exists> t. type_of_obj s (O_node n) = Some t" 
       
   125 by (auto intro: alive_obj_has_type)
       
   126 
       
   127 lemma init_node_has_type': "\<lbrakk>type_of_obj s (O_node n) = None; valid s\<rbrakk> \<Longrightarrow> n \<notin> init_nodes" 
       
   128 by (auto intro:notI dest:init_node_has_type)
       
   129 
       
   130 lemma current_shm_has_type: "\<lbrakk>h \<in> current_shms s; valid s\<rbrakk> \<Longrightarrow> \<exists> t. type_of_obj s (O_shm h) = Some t" 
       
   131 by (auto intro:alive_obj_has_type)
       
   132 
       
   133 lemma current_shm_has_type': "\<lbrakk>type_of_obj s (O_shm h) = None; valid s\<rbrakk> \<Longrightarrow> h \<notin> current_shms s" 
       
   134 by (auto intro:notI dest:current_shm_has_type)
       
   135 
       
   136 lemma current_msgq_has_type: "\<lbrakk>q \<in> current_msgqs s; valid s\<rbrakk> \<Longrightarrow> \<exists> t. type_of_obj s (O_msgq q) = Some t" 
       
   137 by (auto intro:alive_obj_has_type)
       
   138 
       
   139 lemma current_msgq_has_type': "\<lbrakk>type_of_obj s (O_msgq q) = None; valid s\<rbrakk> \<Longrightarrow> q \<notin> current_msgqs s" 
       
   140 by (auto intro:notI dest:current_msgq_has_type)
       
   141 
       
   142 lemma current_msg_has_type: "\<lbrakk>m \<in> set (msgs_of_queue s q); q \<in> current_msgqs s; valid s\<rbrakk>
       
   143     \<Longrightarrow> \<exists> t. type_of_obj s (O_msg q m) = Some t" 
       
   144 by (auto intro:alive_obj_has_type)
       
   145 
       
   146 lemma current_msg_has_type': "\<lbrakk>type_of_obj s (O_msg q m) = None; valid s\<rbrakk>
       
   147     \<Longrightarrow> m \<notin> set (msgs_of_queue s q) \<or> q \<notin> current_msgqs s" 
       
   148 by (auto dest!:current_msg_has_type)
       
   149 
       
   150 lemmas current_has_type = alive_obj_has_type current_proc_has_type is_file_has_type is_dir_has_type 
       
   151   is_tcp_has_type is_udp_has_type current_fd_has_type init_node_has_type current_shm_has_type
       
   152   current_msgq_has_type current_msg_has_type
       
   153 
       
   154 lemmas current_has_type' = alive_obj_has_type' current_proc_has_type' is_file_has_type' is_dir_has_type'
       
   155   is_tcp_has_type' is_udp_has_type' current_fd_has_type' init_node_has_type' current_shm_has_type'
       
   156   current_msgq_has_type' current_msg_has_type' 
       
   157 
       
   158 lemma alive_obj_has_user': "\<lbrakk>user_of_obj s obj = None; valid s\<rbrakk> \<Longrightarrow> \<not> alive s obj" 
       
   159 by (rule_tac notI, auto dest:alive_obj_has_user)
       
   160 
       
   161 lemma current_proc_has_user: 
       
   162   "\<lbrakk>p \<in> current_procs s; valid s\<rbrakk> \<Longrightarrow> \<exists> t. user_of_obj s (O_proc p) = Some t" 
       
   163 by (auto intro:alive_obj_has_user)
       
   164 
       
   165 lemma current_proc_has_user': 
       
   166   "\<lbrakk>user_of_obj s (O_proc p) = None; valid s\<rbrakk> \<Longrightarrow> p \<notin> current_procs s" 
       
   167 by (rule notI, auto dest:current_proc_has_user)
       
   168 
       
   169 lemma is_file_has_user: "\<lbrakk>is_file s f; valid s\<rbrakk> \<Longrightarrow> \<exists> t. user_of_obj s (O_file f) = Some t"
       
   170 by (auto intro:alive_obj_has_user simp:is_file_in_current)
       
   171 
       
   172 lemma is_file_has_user': "\<lbrakk>user_of_obj s (O_file f) = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_file s f"
       
   173 by (auto intro:notI dest:is_file_has_user)
       
   174 
       
   175 lemma is_dir_has_user: "\<lbrakk>is_dir s f; valid s\<rbrakk> \<Longrightarrow> \<exists> t. user_of_obj s (O_dir f) = Some t"
       
   176 by (auto intro:alive_obj_has_user simp:is_dir_in_current)
       
   177 
       
   178 lemma is_dir_has_user': "\<lbrakk>user_of_obj s (O_dir f) = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_dir s f"
       
   179 by (auto intro:notI dest:is_dir_has_user)
       
   180 
       
   181 lemma is_tcp_has_user: "\<lbrakk>is_tcp_sock s sock; valid s\<rbrakk> \<Longrightarrow> \<exists> t. user_of_obj s (O_tcp_sock sock) = Some t"
       
   182 by (auto intro:alive_obj_has_user simp:is_tcp_in_current)
       
   183 
       
   184 lemma is_tcp_has_user': "\<lbrakk>user_of_obj s (O_tcp_sock sock) = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_tcp_sock s sock"
       
   185 by (auto intro:notI dest:is_tcp_has_user)
       
   186 
       
   187 lemma is_udp_has_user: "\<lbrakk>is_udp_sock s sock; valid s\<rbrakk> \<Longrightarrow> \<exists> t. user_of_obj s (O_udp_sock sock) = Some t"
       
   188 by (auto intro:alive_obj_has_user simp:is_udp_in_current)
       
   189 
       
   190 lemma is_udp_has_user': "\<lbrakk>user_of_obj s (O_udp_sock sock) = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_udp_sock s sock"
       
   191 by (auto intro:notI dest:is_udp_has_user)
       
   192 
       
   193 lemma current_fd_has_user: "\<lbrakk>fd \<in> current_proc_fds s p; valid s\<rbrakk> \<Longrightarrow> \<exists> t. user_of_obj s (O_fd p fd) = Some t"
       
   194 by (auto intro:alive_obj_has_user)
       
   195 
       
   196 lemma current_fd_has_user': "\<lbrakk>user_of_obj s (O_fd p fd) = None; valid s\<rbrakk> \<Longrightarrow> fd \<notin> current_proc_fds s p"
       
   197 by (auto intro:notI dest:current_fd_has_user)
       
   198 
       
   199 lemma init_node_has_user: "\<lbrakk>n \<in> init_nodes; valid s\<rbrakk> \<Longrightarrow> \<exists> t. user_of_obj s (O_node n) = Some t" 
       
   200 by (auto intro: alive_obj_has_user)
       
   201 
       
   202 lemma init_node_has_user': "\<lbrakk>user_of_obj s (O_node n) = None; valid s\<rbrakk> \<Longrightarrow> n \<notin> init_nodes" 
       
   203 by (auto intro:notI dest:init_node_has_user)
       
   204 
       
   205 lemma current_shm_has_user: "\<lbrakk>h \<in> current_shms s; valid s\<rbrakk> \<Longrightarrow> \<exists> t. user_of_obj s (O_shm h) = Some t" 
       
   206 by (auto intro:alive_obj_has_user)
       
   207 
       
   208 lemma current_shm_has_user': "\<lbrakk>user_of_obj s (O_shm h) = None; valid s\<rbrakk> \<Longrightarrow> h \<notin> current_shms s" 
       
   209 by (auto intro:notI dest:current_shm_has_user)
       
   210 
       
   211 lemma current_msgq_has_user: "\<lbrakk>q \<in> current_msgqs s; valid s\<rbrakk> \<Longrightarrow> \<exists> t. user_of_obj s (O_msgq q) = Some t" 
       
   212 by (auto intro:alive_obj_has_user)
       
   213 
       
   214 lemma current_msgq_has_user': "\<lbrakk>user_of_obj s (O_msgq q) = None; valid s\<rbrakk> \<Longrightarrow> q \<notin> current_msgqs s" 
       
   215 by (auto intro:notI dest:current_msgq_has_user)
       
   216 
       
   217 lemma current_msg_has_user: "\<lbrakk>m \<in> set (msgs_of_queue s q); q \<in> current_msgqs s; valid s\<rbrakk>
       
   218     \<Longrightarrow> \<exists> t. user_of_obj s (O_msg q m) = Some t" 
       
   219 by (auto intro:alive_obj_has_user)
       
   220 
       
   221 lemma current_msg_has_user': "\<lbrakk>user_of_obj s (O_msg q m) = None; valid s\<rbrakk>
       
   222     \<Longrightarrow> m \<notin> set (msgs_of_queue s q) \<or> q \<notin> current_msgqs s" 
       
   223 by (auto dest!:current_msg_has_user)
       
   224 
       
   225 lemmas current_has_user = alive_obj_has_user current_proc_has_user is_file_has_user is_dir_has_user 
       
   226   is_tcp_has_user is_udp_has_user current_fd_has_user init_node_has_user current_shm_has_user
       
   227   current_msgq_has_user current_msg_has_user
       
   228 
       
   229 lemmas current_has_user' = alive_obj_has_user' current_proc_has_user' is_file_has_user' is_dir_has_user'
       
   230   is_tcp_has_user' is_udp_has_user' current_fd_has_user' init_node_has_user' current_shm_has_user'
       
   231   current_msgq_has_user' current_msg_has_user' 
       
   232 
       
   233 lemma current_proc_has_role:
       
   234   "\<lbrakk>p \<in> current_procs s; valid s\<rbrakk> \<Longrightarrow> \<exists> r. role_of_proc s p = Some r"
       
   235 apply (induct s arbitrary:p, simp add:init_procrole_prop2)
       
   236 apply (frule vd_cons, frule vt_grant_os, frule vt_grant, case_tac a)
       
   237 apply (auto split:option.splits dest:current_has_type' simp:sectxt_of_obj_def)
       
   238 done
       
   239 
       
   240 lemma current_proc_has_role':
       
   241   "\<lbrakk>role_of_proc s p = None; valid s\<rbrakk> \<Longrightarrow> p \<notin> current_procs s"
       
   242 by (auto dest:current_proc_has_role)
       
   243 
       
   244 lemma alive_obj_has_role:
       
   245   "\<lbrakk>alive s obj; valid s\<rbrakk> \<Longrightarrow> \<exists> r. role_of_obj s obj = Some r"
       
   246 by (case_tac obj, auto intro:current_proc_has_role)
       
   247 
       
   248 lemma alive_obj_has_sec:
       
   249   "\<lbrakk>alive s obj; valid s\<rbrakk> \<Longrightarrow> \<exists> sec. sectxt_of_obj s obj = Some sec"
       
   250 apply (frule alive_obj_has_type, simp)
       
   251 apply (frule alive_obj_has_role, simp)
       
   252 apply (frule alive_obj_has_user, simp)
       
   253 apply (auto split:option.splits simp:sectxt_of_obj_def)
       
   254 done
       
   255 
       
   256 lemma alive_obj_has_sec':
       
   257   "\<lbrakk>sectxt_of_obj s obj = None; valid s\<rbrakk> \<Longrightarrow> \<not> alive s obj"
       
   258 by (auto dest:alive_obj_has_sec)
       
   259 
       
   260 lemma alive_obj_has_sec'':
       
   261   "\<lbrakk>alive s obj; valid s\<rbrakk> \<Longrightarrow> \<exists> u r t. sectxt_of_obj s obj = Some (u,r,t)"
       
   262 by (auto dest:alive_obj_has_sec)
       
   263 
       
   264 lemma current_proc_has_sec: 
       
   265   "\<lbrakk>p \<in> current_procs s; valid s\<rbrakk> \<Longrightarrow> \<exists> sec. sectxt_of_obj s (O_proc p) = Some sec"
       
   266 by (rule alive_obj_has_sec, simp+) 
       
   267 
       
   268 lemma current_proc_has_sec': 
       
   269   "\<lbrakk>sectxt_of_obj s (O_proc p) = None; valid s\<rbrakk> \<Longrightarrow> p \<notin> current_procs s" 
       
   270 by (rule notI, auto dest:current_proc_has_sec)
       
   271 
       
   272 lemma current_proc_has_sec'': 
       
   273   "\<lbrakk>p \<in> current_procs s; valid s\<rbrakk> \<Longrightarrow> \<exists> u r t. sectxt_of_obj s (O_proc p) = Some (u,r,t)"
       
   274 by (drule current_proc_has_sec, auto)
       
   275 
       
   276 lemma is_file_has_sec: "\<lbrakk>is_file s f; valid s\<rbrakk> \<Longrightarrow> \<exists> sec. sectxt_of_obj s (O_file f) = Some sec"
       
   277 by (rule alive_obj_has_sec, simp_all add:is_file_in_current)
       
   278 
       
   279 lemma is_file_has_sec': "\<lbrakk>sectxt_of_obj s (O_file f) = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_file s f"
       
   280 by (auto intro:notI dest:is_file_has_sec)
       
   281 
       
   282 lemma is_file_has_sec'': "\<lbrakk>is_file s f; valid s\<rbrakk> \<Longrightarrow> \<exists> u r t. sectxt_of_obj s (O_file f) = Some (u,r,t)"
       
   283 by (drule is_file_has_sec, auto)
       
   284 
       
   285 lemma is_dir_has_sec: "\<lbrakk>is_dir s f; valid s\<rbrakk> \<Longrightarrow> \<exists> sec. sectxt_of_obj s (O_dir f) = Some sec"
       
   286 by (rule alive_obj_has_sec, simp_all add:is_dir_in_current)
       
   287 
       
   288 lemma is_dir_has_sec': "\<lbrakk>sectxt_of_obj s (O_dir f) = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_dir s f"
       
   289 by (auto intro:notI dest:is_dir_has_sec)
       
   290 
       
   291 lemma is_dir_has_sec'': "\<lbrakk>is_dir s f; valid s\<rbrakk> \<Longrightarrow> \<exists> u r t. sectxt_of_obj s (O_dir f) = Some (u,r,t)"
       
   292 by (drule is_dir_has_sec, auto)
       
   293 
       
   294 lemma is_tcp_has_sec: "\<lbrakk>is_tcp_sock s sock; valid s\<rbrakk> \<Longrightarrow> \<exists> sec. sectxt_of_obj s (O_tcp_sock sock) = Some sec"
       
   295 by (rule alive_obj_has_sec, simp_all add:is_tcp_in_current)
       
   296 
       
   297 lemma is_tcp_has_sec': "\<lbrakk>sectxt_of_obj s (O_tcp_sock sock) = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_tcp_sock s sock"
       
   298 by (auto intro:notI dest:is_tcp_has_sec)
       
   299 
       
   300 lemma is_tcp_has_sec'': "\<lbrakk>is_tcp_sock s sock; valid s\<rbrakk> 
       
   301   \<Longrightarrow> \<exists> u r t. sectxt_of_obj s (O_tcp_sock sock) = Some (u,r,t)"
       
   302 by (drule is_tcp_has_sec, simp_all add:is_tcp_in_current)
       
   303 
       
   304 lemma is_udp_has_sec: "\<lbrakk>is_udp_sock s sock; valid s\<rbrakk> \<Longrightarrow> \<exists> sec. sectxt_of_obj s (O_udp_sock sock) = Some sec"
       
   305 by (rule alive_obj_has_sec, simp_all add:is_udp_in_current)
       
   306 
       
   307 lemma is_udp_has_sec': "\<lbrakk>sectxt_of_obj s (O_udp_sock sock) = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_udp_sock s sock"
       
   308 by (auto intro:notI dest:is_udp_has_sec)
       
   309 
       
   310 lemma is_udp_has_sec'': "\<lbrakk>is_udp_sock s sock; valid s\<rbrakk> 
       
   311   \<Longrightarrow> \<exists> u r t. sectxt_of_obj s (O_udp_sock sock) = Some (u,r,t)"
       
   312 by (drule is_udp_has_sec, simp_all add:is_udp_in_current)
       
   313 
       
   314 lemma current_fd_has_sec: "\<lbrakk>fd \<in> current_proc_fds s p; valid s\<rbrakk> \<Longrightarrow> \<exists> sec. sectxt_of_obj s (O_fd p fd) = Some sec"
       
   315 by (rule alive_obj_has_sec, simp+)
       
   316 
       
   317 lemma current_fd_has_sec': "\<lbrakk>sectxt_of_obj s (O_fd p fd) = None; valid s\<rbrakk> \<Longrightarrow> fd \<notin> current_proc_fds s p"
       
   318 by (auto intro:notI dest:current_fd_has_sec)
       
   319 
       
   320 lemma current_fd_has_sec'': "\<lbrakk>fd \<in> current_proc_fds s p; valid s\<rbrakk> 
       
   321   \<Longrightarrow> \<exists> u r t. sectxt_of_obj s (O_fd p fd) = Some (u, r, t)"
       
   322 by (drule current_fd_has_sec, simp+)
       
   323 
       
   324 lemma init_node_has_sec: "\<lbrakk>n \<in> init_nodes; valid s\<rbrakk> \<Longrightarrow> \<exists> sec. sectxt_of_obj s (O_node n) = Some sec" 
       
   325 by (rule alive_obj_has_sec, simp+)
       
   326 
       
   327 lemma init_node_has_sec': "\<lbrakk>sectxt_of_obj s (O_node n) = None; valid s\<rbrakk> \<Longrightarrow> n \<notin> init_nodes" 
       
   328 by (auto intro:notI dest:init_node_has_sec)
       
   329 
       
   330 lemma init_node_has_sec'': "\<lbrakk>n \<in> init_nodes; valid s\<rbrakk> \<Longrightarrow> \<exists> u r t. sectxt_of_obj s (O_node n) = Some (u,r,t)" 
       
   331 by (drule init_node_has_sec, simp+)
       
   332 
       
   333 lemma current_shm_has_sec: "\<lbrakk>h \<in> current_shms s; valid s\<rbrakk> \<Longrightarrow> \<exists> sec. sectxt_of_obj s (O_shm h) = Some sec" 
       
   334 by (rule alive_obj_has_sec, simp+)
       
   335 
       
   336 lemma current_shm_has_sec': "\<lbrakk>sectxt_of_obj s (O_shm h) = None; valid s\<rbrakk> \<Longrightarrow> h \<notin> current_shms s" 
       
   337 by (auto intro:notI dest:current_shm_has_sec)
       
   338 
       
   339 lemma current_shm_has_sec'': "\<lbrakk>h \<in> current_shms s; valid s\<rbrakk> \<Longrightarrow> \<exists> u r t. sectxt_of_obj s (O_shm h) = Some (u,r,t)" 
       
   340 by (drule current_shm_has_sec, simp+)
       
   341 
       
   342 lemma current_msgq_has_sec: "\<lbrakk>q \<in> current_msgqs s; valid s\<rbrakk> \<Longrightarrow> \<exists> sec. sectxt_of_obj s (O_msgq q) = Some sec" 
       
   343 by (rule alive_obj_has_sec, simp+)
       
   344 
       
   345 lemma current_msgq_has_sec': "\<lbrakk>sectxt_of_obj s (O_msgq q) = None; valid s\<rbrakk> \<Longrightarrow> q \<notin> current_msgqs s" 
       
   346 by (auto intro:notI dest:current_msgq_has_sec)
       
   347 
       
   348 lemma current_msgq_has_sec'': "\<lbrakk>q \<in> current_msgqs s; valid s\<rbrakk> 
       
   349   \<Longrightarrow> \<exists> u r t. sectxt_of_obj s (O_msgq q) = Some (u,r,t)" 
       
   350 by (drule current_msgq_has_sec, simp+)
       
   351 
       
   352 lemma current_msg_has_sec: "\<lbrakk>m \<in> set (msgs_of_queue s q); q \<in> current_msgqs s; valid s\<rbrakk>
       
   353     \<Longrightarrow> \<exists> sec. sectxt_of_obj s (O_msg q m) = Some sec" 
       
   354 by (rule alive_obj_has_sec, simp+)
       
   355 
       
   356 lemma current_msg_has_sec': "\<lbrakk>sectxt_of_obj s (O_msg q m) = None; valid s\<rbrakk>
       
   357     \<Longrightarrow> m \<notin> set (msgs_of_queue s q) \<or> q \<notin> current_msgqs s" 
       
   358 by (auto dest!:current_msg_has_sec)
       
   359 
       
   360 lemma current_msg_has_sec'': "\<lbrakk>m \<in> set (msgs_of_queue s q); q \<in> current_msgqs s; valid s\<rbrakk>
       
   361     \<Longrightarrow> \<exists> u r t. sectxt_of_obj s (O_msg q m) = Some (u, r, t)" 
       
   362 by (drule current_msg_has_sec, simp+)
       
   363 
       
   364 lemmas current_has_sec = alive_obj_has_sec current_proc_has_sec is_file_has_sec is_dir_has_sec 
       
   365   is_tcp_has_sec is_udp_has_sec current_fd_has_sec init_node_has_sec current_shm_has_sec
       
   366   current_msgq_has_sec current_msg_has_sec
       
   367 
       
   368 lemmas current_has_sec' = alive_obj_has_sec' current_proc_has_sec' is_file_has_sec' is_dir_has_sec'
       
   369   is_tcp_has_sec' is_udp_has_sec' current_fd_has_sec' init_node_has_sec' current_shm_has_sec'
       
   370   current_msgq_has_sec' current_msg_has_sec' 
       
   371 
       
   372 lemmas current_has_sec'' = alive_obj_has_sec'' current_proc_has_sec'' is_file_has_sec'' is_dir_has_sec''
       
   373   is_tcp_has_sec'' is_udp_has_sec'' current_fd_has_sec'' init_node_has_sec'' current_shm_has_sec''
       
   374   current_msgq_has_sec'' current_msg_has_sec'' 
       
   375 
       
   376 (*************** sectxt_of_obj simpset ****************)
       
   377 
       
   378 lemma sec_execve:
       
   379   "valid (Execve p f fds # s) \<Longrightarrow> sectxt_of_obj (Execve p f fds # s) = 
       
   380    (sectxt_of_obj s) (O_proc p := (
       
   381      case (sectxt_of_obj s (O_proc p), sectxt_of_obj s (O_file f)) of
       
   382        (Some psec, Some fsec) \<Rightarrow> npctxt_execve psec fsec
       
   383      | _ \<Rightarrow> None))"
       
   384 apply (rule ext, frule vd_cons, frule vt_grant_os, frule vt_grant,case_tac x)
       
   385 apply (auto simp:sectxt_of_obj_def split:option.splits 
       
   386            dest!:current_has_type' current_proc_has_role' current_has_user')
       
   387 done
       
   388 
       
   389 lemma sec_clone:
       
   390   "valid (Clone p p' fds shms # s) \<Longrightarrow> sectxt_of_obj (Clone p p' fds shms # s) = (\<lambda> obj. 
       
   391      case obj of 
       
   392        O_proc p'' \<Rightarrow> if (p'' = p') then sectxt_of_obj s (O_proc p) 
       
   393                      else sectxt_of_obj s obj
       
   394      | O_fd p'' fd \<Rightarrow> if (p'' = p' \<and> fd \<in> fds) then sectxt_of_obj s (O_fd p fd)
       
   395                       else if (p'' = p') then None
       
   396                       else sectxt_of_obj s obj
       
   397      | O_tcp_sock (p'', fd) \<Rightarrow> if (p'' = p' \<and> fd \<in> fds) then sectxt_of_obj s (O_tcp_sock (p, fd))
       
   398                                else if (p'' = p') then None
       
   399                                else sectxt_of_obj s obj
       
   400      | O_udp_sock (p'', fd) \<Rightarrow> if (p'' = p' \<and> fd \<in> fds) then sectxt_of_obj s (O_udp_sock (p, fd))
       
   401                                else if (p'' = p') then None
       
   402                                else sectxt_of_obj s obj
       
   403      | _ \<Rightarrow> sectxt_of_obj s obj )"
       
   404 apply (rule ext, frule vd_cons, frule vt_grant_os, case_tac obj)
       
   405 apply (auto simp:sectxt_of_obj_def split:option.splits if_splits
       
   406            dest!:current_has_type' current_proc_has_role' current_has_user')
       
   407 done
       
   408 
       
   409 lemma sec_open:
       
   410   "valid (Open p f flags fd opt # s) \<Longrightarrow> sectxt_of_obj (Open p f flags fd opt # s) = (\<lambda> obj. 
       
   411      case obj of
       
   412        O_file f' \<Rightarrow> if (f' = f \<and> opt \<noteq> None) then 
       
   413                       (case (parent f) of 
       
   414                          None \<Rightarrow> None
       
   415                        | Some pf \<Rightarrow> (case (sectxt_of_obj s (O_proc p), sectxt_of_obj s (O_dir pf)) of
       
   416                                       (Some psec, Some pfsec) \<Rightarrow> Some (fst psec, R_object, 
       
   417                                         type_transition ((snd o snd) psec) ((snd o snd) pfsec) C_file True)
       
   418                                     | _ \<Rightarrow> None))
       
   419                     else sectxt_of_obj s obj
       
   420      | O_fd p' fd' \<Rightarrow> if (p' = p \<and> fd' = fd) then 
       
   421                         (case (sectxt_of_obj s (O_proc p)) of 
       
   422                            Some psec \<Rightarrow> Some (fst psec, R_object, (snd o snd) psec)
       
   423                          | _ \<Rightarrow> None)
       
   424                       else sectxt_of_obj s obj
       
   425      | _ \<Rightarrow> sectxt_of_obj s obj)"
       
   426 apply (rule ext, frule vd_cons, frule vt_grant_os, case_tac obj)
       
   427 apply (auto simp:sectxt_of_obj_def split:option.splits if_splits
       
   428            dest!:current_has_type' current_proc_has_role' current_has_user')
       
   429 done
       
   430 
       
   431 lemma sec_mkdir:
       
   432   "valid (Mkdir p f inum # s) \<Longrightarrow> sectxt_of_obj (Mkdir p f inum # s) = 
       
   433      (sectxt_of_obj s) (O_dir f := 
       
   434         (case parent f of 
       
   435            None \<Rightarrow> None
       
   436          | Some pf \<Rightarrow> (case (sectxt_of_obj s (O_proc p), sectxt_of_obj s (O_dir pf)) of
       
   437                          (Some psec, Some pfsec) \<Rightarrow> Some (fst psec, R_object, 
       
   438                             type_transition ((snd o snd) psec) ((snd o snd) pfsec) C_dir True)
       
   439                       | _ \<Rightarrow> None)))"
       
   440 apply (rule ext, frule vd_cons, frule vt_grant_os, case_tac x)
       
   441 apply (auto simp:sectxt_of_obj_def split:option.splits if_splits
       
   442            dest!:current_has_type' current_proc_has_role' current_has_user')
       
   443 done
       
   444 
       
   445 lemma sec_linkhard:
       
   446   "valid (LinkHard p f f' # s) \<Longrightarrow> sectxt_of_obj (LinkHard p f f' # s) = 
       
   447      (sectxt_of_obj s) (O_file f' := 
       
   448         (case parent f' of 
       
   449            None \<Rightarrow> None
       
   450          | Some pf \<Rightarrow> (case (sectxt_of_obj s (O_proc p), sectxt_of_obj s (O_dir pf)) of
       
   451                          (Some psec, Some pfsec) \<Rightarrow> Some (fst psec, R_object, 
       
   452                             type_transition ((snd o snd) psec) ((snd o snd) pfsec) C_file True)
       
   453                       | _ \<Rightarrow> None)))"
       
   454 apply (rule ext, frule vd_cons, frule vt_grant_os, case_tac x)
       
   455 apply (auto simp:sectxt_of_obj_def split:option.splits if_splits
       
   456            dest!:current_has_type' current_proc_has_role' current_has_user')
       
   457 done
       
   458 
       
   459 lemma sec_createmsgq:
       
   460   "valid (CreateMsgq p q # s) \<Longrightarrow> sectxt_of_obj (CreateMsgq p q # s) = (sectxt_of_obj s) (O_msgq q := 
       
   461      (case (sectxt_of_obj s (O_proc p)) of
       
   462         Some psec \<Rightarrow> Some (fst psec, R_object, (snd o snd) psec)
       
   463       | _ \<Rightarrow> None))"
       
   464 apply (rule ext, frule vd_cons, frule vt_grant_os, case_tac x)
       
   465 apply (auto simp:sectxt_of_obj_def split:option.splits if_splits
       
   466            dest!:current_has_type' current_proc_has_role' current_has_user')
       
   467 done
       
   468 
       
   469 lemma sec_sendmsg:
       
   470   "valid (SendMsg p q m # s) \<Longrightarrow> sectxt_of_obj (SendMsg p q m # s) = (sectxt_of_obj s) (O_msg q m := 
       
   471      (case (sectxt_of_obj s (O_proc p), sectxt_of_obj s (O_msgq q)) of 
       
   472         (Some psec, Some qsec) \<Rightarrow> Some (fst psec, R_object, 
       
   473            type_transition ((snd o snd) psec) ((snd o snd) qsec) C_msg False)
       
   474       | _ \<Rightarrow> None))"
       
   475 apply (rule ext, frule vd_cons, frule vt_grant_os, case_tac x)
       
   476 apply (auto simp:sectxt_of_obj_def split:option.splits if_splits
       
   477            dest!:current_has_type' current_proc_has_role' current_has_user')
       
   478 done
       
   479 
       
   480 lemma sec_createshm:
       
   481   "valid (CreateShM p h # s) \<Longrightarrow> sectxt_of_obj (CreateShM p h # s) = (sectxt_of_obj s) (O_shm h := 
       
   482      case (sectxt_of_obj s (O_proc p)) of
       
   483         Some psec \<Rightarrow> Some (fst psec, R_object, (snd o snd) psec)
       
   484       | _ \<Rightarrow> None)"
       
   485 apply (rule ext, frule vd_cons, frule vt_grant_os, case_tac x)
       
   486 apply (auto simp:sectxt_of_obj_def split:option.splits if_splits
       
   487            dest!:current_has_type' current_proc_has_role' current_has_user')
       
   488 done
       
   489 
       
   490 lemma sec_createsock:
       
   491   "valid (CreateSock p af st fd inum # s) \<Longrightarrow> sectxt_of_obj (CreateSock p af st fd inum # s) = (\<lambda> obj. 
       
   492      case obj of       
       
   493        O_fd p' fd' \<Rightarrow> if (p' = p \<and> fd' = fd) then 
       
   494                         (case (sectxt_of_obj s (O_proc p)) of
       
   495                            Some psec \<Rightarrow> Some (fst psec, R_object, (snd o snd) psec)
       
   496                          | _ \<Rightarrow> None)
       
   497                       else sectxt_of_obj s obj
       
   498      | O_tcp_sock (p', fd') \<Rightarrow> if (p' = p \<and> fd' = fd \<and> st = STREAM) then 
       
   499                                  (case (sectxt_of_obj s (O_proc p)) of
       
   500                                     Some psec \<Rightarrow> Some (fst psec, R_object, (snd o snd) psec)
       
   501                                   | _ \<Rightarrow> None)
       
   502                                else sectxt_of_obj s obj
       
   503      | O_udp_sock (p', fd') \<Rightarrow> if (p' = p \<and> fd' = fd \<and> st = DGRAM) then 
       
   504                                  (case (sectxt_of_obj s (O_proc p)) of
       
   505                                     Some psec \<Rightarrow> Some (fst psec, R_object, (snd o snd) psec)
       
   506                                   | _ \<Rightarrow> None)
       
   507                                else sectxt_of_obj s obj
       
   508      | _ \<Rightarrow> sectxt_of_obj s obj )"
       
   509 apply (rule ext, frule vd_cons, frule vt_grant_os, case_tac obj)
       
   510 apply (auto simp:sectxt_of_obj_def split:option.splits if_splits
       
   511            dest!:current_has_type' current_proc_has_role' current_has_user')
       
   512 done
       
   513 
       
   514 lemma sec_accept: 
       
   515   "valid (Accept p fd addr port fd' inum # s) \<Longrightarrow> sectxt_of_obj (Accept p fd addr port fd' inum # s) = (\<lambda> obj. 
       
   516      case obj of       
       
   517        O_fd p' fd'' \<Rightarrow> if (p' = p \<and> fd'' = fd') then 
       
   518                         (case (sectxt_of_obj s (O_proc p)) of
       
   519                            Some psec \<Rightarrow> Some (fst psec, R_object, (snd o snd) psec)
       
   520                          | _ \<Rightarrow> None)
       
   521                       else sectxt_of_obj s obj
       
   522      | O_tcp_sock (p', fd'') \<Rightarrow> if (p' = p \<and> fd'' = fd') then 
       
   523                                  (case (sectxt_of_obj s (O_proc p)) of
       
   524                                     Some psec \<Rightarrow> Some (fst psec, R_object, (snd o snd) psec)
       
   525                                   | _ \<Rightarrow> None)
       
   526                                else sectxt_of_obj s obj
       
   527      | _ \<Rightarrow> sectxt_of_obj s obj )"
       
   528 apply (rule ext, frule vd_cons, frule vt_grant_os, case_tac obj)
       
   529 apply (auto simp:sectxt_of_obj_def split:option.splits if_splits
       
   530            dest!:current_has_type' current_proc_has_role' current_has_user')
       
   531 done
       
   532 
       
   533 lemma sec_others :
       
   534   "\<lbrakk>valid (e # s); 
       
   535     \<forall> p p' fds shms. e \<noteq> Clone p p' fds shms;
       
   536     \<forall> p f fds. e \<noteq> Execve p f fds;
       
   537     \<forall> p f flags fd opt. e \<noteq> Open p f flags fd opt;
       
   538     \<forall> p f inum. e \<noteq> Mkdir p f inum;
       
   539     \<forall> p f f'. e \<noteq> LinkHard p f f';
       
   540     \<forall> p q. e \<noteq> CreateMsgq p q;
       
   541     \<forall> p q m. e \<noteq> SendMsg p q m;
       
   542     \<forall> p h. e \<noteq> CreateShM p h;
       
   543     \<forall> p af st fd inum. e \<noteq> CreateSock p af st fd inum;
       
   544     \<forall> p fd addr port fd' inum. e \<noteq> Accept p fd addr port fd' inum
       
   545    \<rbrakk> \<Longrightarrow> sectxt_of_obj (e # s) = sectxt_of_obj s"
       
   546 apply (rule ext, frule vd_cons, frule vt_grant_os, case_tac e, case_tac[!] x)
       
   547 apply (auto simp:sectxt_of_obj_def split:option.splits if_splits
       
   548            dest!:current_has_type' current_proc_has_role' current_has_user')
       
   549 done
       
   550 
       
   551 lemmas sectxt_of_obj_simps = sec_execve sec_open sec_mkdir sec_linkhard sec_createmsgq sec_sendmsg
       
   552   sec_createshm sec_createsock sec_accept sec_clone sec_others (* init_sectxt_prop *)
       
   553 
       
   554 (**************** get_parentfs_ctxts simpset **************)
       
   555 
       
   556 lemma parentf_is_dir_prop1: "\<lbrakk>is_dir s (x # pf); valid s\<rbrakk> \<Longrightarrow> is_dir s pf"
       
   557 apply (rule_tac f = "x # pf" in parentf_is_dir)
       
   558 by (auto simp:is_dir_def current_files_def split:option.splits t_inode_tag.splits)
       
   559 
       
   560 lemma parentf_is_dir_prop2: "\<lbrakk>is_file s (x # pf); valid s\<rbrakk> \<Longrightarrow> is_dir s pf"
       
   561 apply (rule_tac f = "x # pf" in parentf_is_dir)
       
   562 by (auto simp:is_dir_def is_file_def current_files_def split:option.splits t_inode_tag.splits)
       
   563 
       
   564 lemma parentf_is_dir_prop3: "\<lbrakk>(x # pf) \<in> current_files s; valid s\<rbrakk> \<Longrightarrow> is_dir s pf"
       
   565 apply (rule_tac f = "x # pf" in parentf_is_dir)
       
   566 by (auto simp:is_dir_def current_files_def split:option.splits t_inode_tag.splits)
       
   567 
       
   568 lemma get_pfs_secs_prop:
       
   569   "\<lbrakk>get_parentfs_ctxts s f = None; valid s\<rbrakk> \<Longrightarrow> \<not> is_dir s f"
       
   570 apply (induct f)
       
   571 by (auto split:option.splits dest:current_has_sec' parentf_is_dir_prop1)
       
   572 
       
   573 lemma get_pfs_secs_open:
       
   574   "valid (Open p f flags fd opt # s) \<Longrightarrow> get_parentfs_ctxts (Open p f flags fd opt # s) = get_parentfs_ctxts s"
       
   575 apply (frule noroot_events, frule vd_cons, frule vt_grant_os)
       
   576 apply (rule ext, induct_tac x)
       
   577 by (auto split:option.splits simp:sectxt_of_obj_simps)
       
   578 
       
   579 lemma get_pfs_secs_other:
       
   580   "\<lbrakk>valid (e # s); \<forall> p f inum. e \<noteq> Mkdir p f inum\<rbrakk> 
       
   581    \<Longrightarrow> get_parentfs_ctxts (e # s) = get_parentfs_ctxts s"
       
   582 apply (frule vd_cons, frule vt_grant_os, rule ext, induct_tac x)
       
   583 apply (case_tac [!] e)
       
   584 apply (auto split:option.splits if_splits simp:sectxt_of_obj_simps)
       
   585 done
       
   586 
       
   587 lemma get_pfs_secs_mkdir1:
       
   588   assumes mkdir: "valid (Mkdir p f inum # s)" and noteq: "is_dir s f'"
       
   589   shows "get_parentfs_ctxts (Mkdir p f inum # s) f' = get_parentfs_ctxts s f'"
       
   590 proof-
       
   591   from mkdir have vd: "valid s" and os: "os_grant s (Mkdir p f inum)"
       
   592     by (frule_tac vd_cons, simp, frule_tac vt_grant_os, simp)
       
   593   from mkdir have notroot: "f \<noteq> []" by (auto intro!:noroot_mkdir)
       
   594   show ?thesis using noteq
       
   595   proof (induct f')
       
   596     case Nil
       
   597     show ?case using notroot mkdir by (simp add:sectxt_of_obj_simps)
       
   598   next
       
   599     case (Cons a f')
       
   600     hence p1: "is_dir s f'" using vd by (simp add:parentf_is_dir_prop1)
       
   601     from Cons have p2: "is_dir s (a # f')" by simp
       
   602     from Cons p1 have p3: "get_parentfs_ctxts (Mkdir p f inum # s) f' = get_parentfs_ctxts s f'" by simp
       
   603     from p2 os have p4: "a # f' \<noteq> f" by (auto simp:is_dir_in_current)
       
   604     from p1 os have p5: "f' \<noteq> f"  by (auto simp:is_dir_in_current)
       
   605     show ?case using mkdir vd os p4 p5  p1
       
   606       by (auto simp:sectxt_of_obj_simps is_dir_simps p3
       
   607               split:option.splits   dest:current_has_sec' get_pfs_secs_prop)
       
   608   qed
       
   609 qed
       
   610 
       
   611 lemma get_pfs_secs_mkdir2:
       
   612   "valid (Mkdir p f inum # s) \<Longrightarrow> get_parentfs_ctxts (Mkdir p f inum # s) f = (
       
   613      case f of 
       
   614        [] \<Rightarrow> get_parentfs_ctxts s []
       
   615      | x#pf \<Rightarrow> (case (get_parentfs_ctxts s pf, sectxt_of_obj s (O_proc p), sectxt_of_obj s (O_dir pf)) of
       
   616                  (Some pfsecs, Some psec, Some pfsec) \<Rightarrow> Some ((fst psec, R_object, type_transition ((snd o snd) psec) ((snd o snd) pfsec) C_dir True) # pfsecs)
       
   617                | _ \<Rightarrow> None))"
       
   618 apply (frule vd_cons, frule vt_grant_os)
       
   619 apply (frule noroot_events, case_tac f)
       
   620 by (auto split:option.splits dest:current_has_sec' get_pfs_secs_prop get_pfs_secs_mkdir1
       
   621           simp:sectxt_of_obj_simps is_dir_simps)
       
   622 
       
   623 lemmas get_parentfs_ctxts_simps = get_pfs_secs_other get_pfs_secs_mkdir1 get_pfs_secs_mkdir2
       
   624 
       
   625 end
       
   626 
       
   627 end