theory Enrich+
−
imports Main Flask Static Init_prop Valid_prop Tainted_prop Delete_prop Co2sobj_prop S2ss_prop S2ss_prop2+
−
 Temp+
−
begin+
−
+
−
datatype t_enrich_obj = +
−
  E_proc "t_process"+
−
| E_file "t_file"+
−
| E_fd   "t_process" "t_fd"+
−
| E_inum "nat"+
−
| E_msgq "t_msgq"+
−
| E_msg  "t_msgq"    "t_msg"+
−
+
−
context tainting_s begin+
−
+
−
(* enrich s target_proc duplicated_pro *)+
−
fun enrich_proc :: "t_state \<Rightarrow> t_process \<Rightarrow> t_process \<Rightarrow> t_state"+
−
where +
−
  "enrich_proc [] tp dp = []"+
−
| "enrich_proc (Execve p f fds # s) tp dp = (+
−
     if (tp = p) +
−
     then Execve dp f (fds \<inter> proc_file_fds s p) # Execve p f fds # (enrich_proc s tp dp)+
−
     else Execve p f fds # (enrich_proc s tp dp))"+
−
| "enrich_proc (Clone p p' fds # s) tp dp = (+
−
     if (tp = p') +
−
     then Clone p dp (fds \<inter> proc_file_fds s p) # Clone p p' fds # s+
−
     else Clone p p' fds # (enrich_proc s tp dp))"+
−
| "enrich_proc (Open p f flags fd opt # s) tp dp = (+
−
     if (tp = p)+
−
     then Open dp f (remove_create_flag flags) fd None # Open p f flags fd opt # (enrich_proc s tp dp)+
−
     else Open p f flags fd opt # (enrich_proc s tp dp))"+
−
| "enrich_proc (ReadFile p fd # s) tp dp = (+
−
     if (tp = p) +
−
     then ReadFile dp fd # ReadFile p fd # (enrich_proc s tp dp)+
−
     else ReadFile p fd # (enrich_proc s tp dp))"+
−
| "enrich_proc (CloseFd p fd # s) tp dp = (+
−
     if (tp = p \<and> fd \<in> proc_file_fds s p)+
−
     then CloseFd dp fd # CloseFd p fd # (enrich_proc s tp dp)+
−
     else CloseFd p fd # (enrich_proc s tp dp))"+
−
(*+
−
| "enrich_proc (Attach p h flag # s) tp dp = (+
−
     if (tp = p)+
−
     then Attach dp h flag # Attach p h flag # (enrich_proc s tp dp)+
−
     else Attach p h flag # (enrich_proc s tp dp))"+
−
| "enrich_proc (Detach p h # s) tp dp = (+
−
     if (tp = p) +
−
     then Detach dp h # Detach p h # (enrich_proc s tp dp)+
−
     else Detach p h # (enrich_proc s tp dp))"+
−
*)+
−
| "enrich_proc (Kill p p' # s) tp dp = (+
−
     if (tp = p') then Kill p p' # s+
−
     else Kill p p' # (enrich_proc s tp dp))"+
−
| "enrich_proc (Exit p # s) tp dp = (+
−
     if (tp = p) then Exit p # s+
−
     else Exit p # (enrich_proc s tp dp))"+
−
| "enrich_proc (e # s) tp dp = e # (enrich_proc s tp dp)"+
−
+
−
lemma enrich_search_check:+
−
  assumes grant: "search_check s (up, rp, tp) f"+
−
  and cf2sf: "\<forall> f. f \<in> current_files s \<longrightarrow> cf2sfile s' f = cf2sfile s f"+
−
  and vd: "valid s" and f_in: "is_file s f"  and f_in': "is_file s' f"+
−
  and sec: "sectxt_of_obj s' (O_file f) = sectxt_of_obj s (O_file f)"+
−
  shows "search_check s' (up, rp, tp) f"+
−
proof (cases f)+
−
  case Nil+
−
  with f_in vd have "False" +
−
    by (auto dest:root_is_dir') +
−
  thus ?thesis by simp+
−
next+
−
  case (Cons n pf)+
−
  from vd f_in obtain sf where sf: "cf2sfile s f = Some sf"+
−
    apply (drule_tac is_file_in_current, drule_tac current_file_has_sfile, simp)+
−
    apply (erule exE, simp)+
−
    done+
−
  then obtain psfs where psfs: "get_parentfs_ctxts s pf = Some psfs" using Cons+
−
    by (auto simp:cf2sfile_def split:option.splits if_splits)+
−
  from sf cf2sf f_in have sf': "cf2sfile s' f = Some sf" by (auto dest:is_file_in_current)+
−
  then obtain psfs' where psfs': "get_parentfs_ctxts s' pf = Some psfs'"using Cons+
−
    by (auto simp:cf2sfile_def split:option.splits if_splits)+
−
  with sf sf' psfs have psfs_eq: "set psfs' = set psfs" using Cons f_in f_in'+
−
    apply (simp add:cf2sfile_def split:option.splits)+
−
    apply (case_tac sf, simp)+
−
    done+
−
  show ?thesis using grant f_in f_in' psfs psfs' psfs_eq sec+
−
    apply (simp add:Cons split:option.splits)+
−
    by (case_tac a, simp)+
−
qed+
−
+
−
lemma enrich_search_check':+
−
  assumes grant: "search_check s (up, rp, tp) f"+
−
  and cf2sf: "\<forall> f. f \<in> current_files s \<longrightarrow> cf2sfile s' f = cf2sfile s f"+
−
  and vd: "valid s" and vd': "valid s'" and f_in: "is_dir s f"  and f_in': "is_dir s' f"+
−
  and sec: "sectxt_of_obj s' (O_dir f) = sectxt_of_obj s (O_dir f)"+
−
  shows "search_check s' (up, rp, tp) f"+
−
proof (cases f)+
−
  case Nil+
−
  have "sectxt_of_obj s' (O_dir []) = sectxt_of_obj s (O_dir [])"+
−
    using cf2sf +
−
    apply (erule_tac x = "[]" in allE)+
−
    by (auto simp:cf2sfile_def root_sec_remains vd vd')+
−
  thus ?thesis using grant Nil +
−
    by auto+
−
next+
−
  case (Cons n pf)+
−
  from vd f_in obtain sf where sf: "cf2sfile s f = Some sf"+
−
    apply (drule_tac is_dir_in_current, drule_tac current_file_has_sfile, simp)+
−
    apply (erule exE, simp)+
−
    done+
−
  then obtain psfs where psfs: "get_parentfs_ctxts s pf = Some psfs" using Cons+
−
    by (auto simp:cf2sfile_def split:option.splits if_splits)+
−
  from sf cf2sf f_in have sf': "cf2sfile s' f = Some sf" by (auto dest:is_dir_in_current)+
−
  then obtain psfs' where psfs': "get_parentfs_ctxts s' pf = Some psfs'"using Cons+
−
    by (auto simp:cf2sfile_def split:option.splits if_splits)+
−
  with sf sf' psfs have psfs_eq: "set psfs' = set psfs" using Cons f_in f_in'+
−
    apply (drule_tac is_dir_not_file)+
−
    apply (drule is_dir_not_file)    +
−
    apply (simp add:cf2sfile_def split:option.splits)+
−
    apply (case_tac sf, simp)+
−
    done+
−
  show ?thesis using grant f_in f_in' psfs psfs' psfs_eq sec+
−
    apply (drule_tac is_dir_not_file)+
−
    apply (drule_tac is_dir_not_file)+
−
    apply (simp add:Cons split:option.splits)+
−
    by (case_tac a, simp)+
−
qed+
−
+
−
lemma proc_filefd_has_sfd: "\<lbrakk>fd \<in> proc_file_fds s p; valid s\<rbrakk> \<Longrightarrow> \<exists> sfd. cfd2sfd s p fd = Some sfd"+
−
apply (simp add:proc_file_fds_def)+
−
apply (auto dest: current_filefd_has_sfd)+
−
done+
−
+
−
lemma enrich_inherit_fds_check:+
−
  assumes grant: "inherit_fds_check s (up, nr, nt) p fds"  and vd: "valid s"+
−
  and cfd2sfd: "\<forall> p fd. fd \<in> proc_file_fds s p\<longrightarrow> cfd2sfd s' p fd = cfd2sfd s p fd"+
−
  and fd_in: "fds \<subseteq> proc_file_fds s p" and fd_in': "fds \<subseteq> proc_file_fds s' p"+
−
  shows "inherit_fds_check s' (up, nr, nt) p fds"+
−
proof-+
−
  have "\<And> fd. fd \<in> fds \<Longrightarrow> sectxt_of_obj s' (O_fd p fd) = sectxt_of_obj s (O_fd p fd)"+
−
  proof-+
−
    fix fd+
−
    assume fd_in_fds: "fd \<in> fds"+
−
    hence fd_in_cfds: "fd \<in> proc_file_fds s p" +
−
      and fd_in_cfds': "fd \<in> proc_file_fds s' p" +
−
      using fd_in fd_in' by auto+
−
    with cfd2sfd+
−
    have cfd_eq: "cfd2sfd s' p fd = cfd2sfd s p fd" by auto+
−
    from fd_in_cfds obtain f where ffd: "file_of_proc_fd s p fd = Some f"+
−
      by (auto simp:proc_file_fds_def)+
−
    moreover have "flags_of_proc_fd s p fd \<noteq> None"+
−
      using ffd vd by (auto dest:current_filefd_has_flags)+
−
    moreover have "sectxt_of_obj s (O_fd p fd) \<noteq> None"+
−
      using fd_in_cfds vd+
−
      apply (rule_tac notI)+
−
      by (auto dest!:current_has_sec' file_fds_subset_pfds[where p = p] intro:vd)+
−
    moreover have "cf2sfile s f \<noteq> None"+
−
      apply (rule notI)+
−
      apply (drule current_file_has_sfile')+
−
      using ffd+
−
      by (auto simp:vd is_file_in_current dest:file_of_pfd_is_file)+
−
    ultimately show "sectxt_of_obj s' (O_fd p fd) = sectxt_of_obj s (O_fd p fd)"+
−
      using cfd_eq+
−
      by (auto simp:cfd2sfd_def split:option.splits)+
−
  qed+
−
  hence "sectxts_of_fds s' p fds = sectxts_of_fds s p fds"+
−
    by (simp add:sectxts_of_fds_def)+
−
  thus ?thesis using grant+
−
    by (simp add:inherit_fds_check_def)+
−
qed+
−
+
−
+
−
lemma enrich_inherit_fds_check_dup:+
−
  assumes grant: "inherit_fds_check s (up, nr, nt) p fds"  and vd: "valid s"+
−
  and cfd2sfd: "\<forall> fd. fd \<in> proc_file_fds s p \<longrightarrow> cfd2sfd s' p' fd = cfd2sfd s p fd"+
−
  and fd_in: "fds' \<subseteq> fds \<inter> proc_file_fds s p" +
−
  shows "inherit_fds_check s' (up, nr, nt) p' fds'"+
−
proof- +
−
  have "sectxts_of_fds s' p' fds' \<subseteq> sectxts_of_fds s p fds"+
−
  proof-+
−
    have "\<And> fd sfd. \<lbrakk>fd \<in> fds'; sectxt_of_obj s' (O_fd p' fd) = Some sfd\<rbrakk> +
−
                     \<Longrightarrow> \<exists> fd \<in> fds. sectxt_of_obj s (O_fd p fd) = Some sfd"+
−
    proof-+
−
      fix fd sfd+
−
      assume fd_in_fds': "fd \<in> fds'"+
−
        and sec: "sectxt_of_obj s' (O_fd p' fd) = Some sfd"+
−
      from fd_in_fds' fd_in+
−
      have fd_in_fds: "fd \<in> fds" and fd_in_cfds: "fd \<in> proc_file_fds s p" +
−
        by auto+
−
      from fd_in_cfds obtain f where ffd: "file_of_proc_fd s p fd = Some f"+
−
        by (auto simp:proc_file_fds_def)+
−
      moreover have "flags_of_proc_fd s p fd \<noteq> None"+
−
        using ffd vd by (auto dest:current_filefd_has_flags)+
−
      moreover have "cf2sfile s f \<noteq> None"+
−
        apply (rule notI)+
−
        apply (drule current_file_has_sfile')+
−
        using ffd+
−
        by (auto simp:vd is_file_in_current dest:file_of_pfd_is_file)+
−
      moreover have "sectxt_of_obj s (O_fd p fd) \<noteq> None"+
−
        using fd_in_cfds vd+
−
        apply (rule_tac notI)+
−
        by (auto dest!:current_has_sec' file_fds_subset_pfds[where p = p] intro:vd)+
−
      ultimately +
−
      have "sectxt_of_obj s (O_fd p fd) = Some sfd"+
−
        using fd_in_cfds cfd2sfd sec+
−
        apply (erule_tac x = fd in allE)+
−
        apply (auto simp:cfd2sfd_def split:option.splits)+
−
        done+
−
      thus "\<exists> fd \<in> fds. sectxt_of_obj s (O_fd p fd) = Some sfd"+
−
        using fd_in_fds+
−
        by (rule_tac x = fd in bexI, auto)+
−
    qed+
−
    thus ?thesis by (auto simp:sectxts_of_fds_def)+
−
  qed+
−
  thus ?thesis using grant+
−
    by (auto simp:inherit_fds_check_def inherit_fds_check_ctxt_def)+
−
qed+
−
+
−
lemma not_all_procs_cons:+
−
  "p \<notin> all_procs (e # s) \<Longrightarrow> p \<notin> all_procs s"+
−
by (case_tac e, auto)+
−
+
−
lemma not_all_procs_prop:+
−
  "\<lbrakk>p' \<notin> all_procs s; p \<in> current_procs s; valid s\<rbrakk> \<Longrightarrow> p' \<noteq> p"+
−
apply (induct s, rule notI, simp)+
−
apply (frule vt_grant_os, frule vd_cons, frule not_all_procs_cons, simp, rule notI)+
−
apply (case_tac a, auto)+
−
done+
−
+
−
fun enrich_not_alive :: "t_state \<Rightarrow> t_enrich_obj \<Rightarrow> bool"+
−
where+
−
  "enrich_not_alive s (E_file f) = (f \<notin> current_files s)"+
−
| "enrich_not_alive s (E_proc p) = (p \<notin> current_procs s)"+
−
| "enrich_not_alive s (E_fd p fd) = (p \<in> current_procs s \<longrightarrow> fd \<notin> current_proc_fds s p)"+
−
| "enrich_not_alive s (E_msgq q) = (q \<notin> current_msgqs s)"+
−
| "enrich_not_alive s (E_inum i) = (i \<notin> current_inode_nums s)"+
−
| "enrich_not_alive s (E_msg q m) = (q \<in> current_msgqs s \<longrightarrow> m \<notin> set (msgs_of_queue s q))"+
−
+
−
lemma file_has_parent: "\<lbrakk>is_file s f; valid s\<rbrakk> \<Longrightarrow> \<exists> pf. is_dir s pf \<and> parent f = Some pf"+
−
apply (case_tac f)+
−
apply (simp, drule root_is_dir', simp+)+
−
apply (simp add:parentf_is_dir_prop2)+
−
done+
−
+
−
lemma enrich_valid_intro_cons:+
−
  assumes vs': "valid s'"+
−
    and os: "os_grant s e" and grant: "grant s e" and vd: "valid s"+
−
    and alive: "\<forall> obj. alive s obj \<longrightarrow> alive s' obj"+
−
    and alive': "\<forall> obj. enrich_not_alive s obj \<longrightarrow> enrich_not_alive s' obj"+
−
    and hungs: "files_hung_by_del s' = files_hung_by_del s"+
−
    and cp2sp: "\<forall> p. p \<in> current_procs s \<longrightarrow> cp2sproc s' p = cp2sproc s p"+
−
    and cf2sf: "\<forall> f. f \<in> current_files s \<longrightarrow> cf2sfile s' f = cf2sfile s f"+
−
    and cq2sq: "\<forall> q. q \<in> current_msgqs s \<longrightarrow> cq2smsgq s' q = cq2smsgq s q"+
−
    and ffd_remain: "\<forall> p fd f. file_of_proc_fd s p fd = Some f \<longrightarrow> file_of_proc_fd s' p fd = Some f"+
−
    and fflags_remain: "\<forall> p fd flags. flags_of_proc_fd s p fd = Some flags \<longrightarrow> flags_of_proc_fd s' p fd = Some flags"+
−
    and sms_remain: "\<forall> q. msgs_of_queue s' q = msgs_of_queue s q"+
−
   (* and empty_remain: "\<forall> f. dir_is_empty s f \<longrightarrow> dir_is_empty s' f" *)+
−
    and cfd2sfd: "\<forall> p fd. fd \<in> proc_file_fds s p \<longrightarrow> cfd2sfd s' p fd = cfd2sfd s p fd"+
−
  shows "valid (e # s')"+
−
proof (cases e)+
−
  case (Execve p f fds)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:Execve)+
−
  have f_in: "is_file s' f" using os alive+
−
    apply (erule_tac x = "O_file f" in allE)+
−
    by (auto simp:Execve)+
−
  have fd_in: "fds \<subseteq> proc_file_fds s' p" using os alive ffd_remain+
−
    by (auto simp:Execve proc_file_fds_def)+
−
  have "os_grant s' e" using p_in f_in fd_in by (simp add:Execve)+
−
  moreover have "grant s' e"+
−
  proof-+
−
    from grant obtain up rp tp uf rf tf +
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p2: "sectxt_of_obj s (O_file f) = Some (uf, rf, tf)" +
−
      by (simp add:Execve split:option.splits, blast)+
−
    with grant obtain pu nr nt where p3: "npctxt_execve (up, rp, tp) (uf, rf, tf) = Some (pu, nr, nt)"+
−
      by (simp add:Execve split:option.splits del:npctxt_execve.simps, blast)+
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:Execve co2sobj.simps cp2sproc_def split:option.splits)+
−
    from os have f_in': "is_file s f" by (simp add:Execve)+
−
    from vd os have "\<exists> sf. cf2sfile s f = Some sf"+
−
      by (auto dest!:is_file_in_current current_file_has_sfile simp:Execve)+
−
    hence p2': "sectxt_of_obj s' (O_file f) = Some (uf, rf, tf)" using f_in f_in' p2 cf2sf+
−
      apply (erule_tac x = f in allE)+
−
      apply (auto dest:is_file_in_current simp:cf2sfile_def split:option.splits)+
−
      apply (case_tac f, simp)+
−
      apply (drule_tac s = s in root_is_dir', simp add:vd, simp+)+
−
      done+
−
    have "inherit_fds_check s' (pu, nr, nt) p fds"+
−
    proof-+
−
      have "fds \<subseteq> proc_file_fds s' p" using os ffd_remain Execve+
−
        by (auto simp:proc_file_fds_def)+
−
      thus ?thesis using Execve grant vd cfd2sfd p1 p2 p3 os+
−
        apply (rule_tac s = s in enrich_inherit_fds_check)+
−
        by (simp_all split:option.splits)+
−
    qed+
−
    moreover have "search_check s' (pu, rp, tp) f"+
−
      using p1 p2 p2' vd cf2sf f_in' grant Execve p3 f_in+
−
      apply (rule_tac s = s in enrich_search_check)+
−
      by (simp_all split:option.splits)+
−
    ultimately show ?thesis using p1' p2' p3+
−
      apply (simp add:Execve split:option.splits) +
−
      using grant Execve p1 p2+
−
      by (simp add:Execve grant p1 p2)+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (Clone p p' fds)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:Clone)+
−
  have p'_not_in: "p' \<notin> current_procs s'" using os alive'+
−
    apply (erule_tac x = "E_proc p'" in allE)+
−
    by (auto simp:Clone)+
−
  have fd_in: "fds \<subseteq> proc_file_fds s' p" using os alive ffd_remain+
−
    by (auto simp:Clone proc_file_fds_def)+
−
  have "os_grant s' e" using p_in p'_not_in fd_in by (simp add:Clone)+
−
  moreover have "grant s' e" +
−
  proof-+
−
    from grant obtain up rp tp +
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      apply (simp add:Clone split:option.splits)+
−
      by (case_tac a, auto)+
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:Clone co2sobj.simps cp2sproc_def split:option.splits)+
−
    have p2: "inherit_fds_check s' (up, rp, tp) p fds"+
−
    proof-+
−
      have "fds \<subseteq> proc_file_fds s' p" using os ffd_remain Clone+
−
        by (auto simp:proc_file_fds_def)+
−
      thus ?thesis using Clone grant vd cfd2sfd p1 os+
−
        apply (rule_tac s = s in enrich_inherit_fds_check)+
−
        by (simp_all split:option.splits)+
−
    qed+
−
    show ?thesis using p1 p2 p1' grant+
−
      by (simp add:Clone)+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (Kill p p')+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:Kill)+
−
  have p'_in: "p' \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p'" in allE)+
−
    by (auto simp:Kill)+
−
  have "os_grant s' e" using p_in p'_in by (simp add:Kill)+
−
  moreover have "grant s' e" +
−
  proof-+
−
    from grant obtain up rp tp up' rp' tp'+
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p'1: "sectxt_of_obj s (O_proc p') = Some (up', rp', tp')"+
−
      apply (simp add:Kill split:option.splits)+
−
      by (case_tac a, case_tac aa, blast)+
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:Kill co2sobj.simps cp2sproc_def split:option.splits)+
−
    from p'1 have p'1': "sectxt_of_obj s' (O_proc p') = Some (up', rp', tp')"+
−
      using os cp2sp+
−
      apply (erule_tac x = p' in allE)+
−
      by (auto simp:Kill co2sobj.simps cp2sproc_def split:option.splits)+
−
    show ?thesis using p1 p'1 p1' p'1' grant+
−
      by (simp add:Kill)+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (Ptrace p p')+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:Ptrace)+
−
  have p'_in: "p' \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p'" in allE)+
−
    by (auto simp:Ptrace)+
−
  have "os_grant s' e" using p_in p'_in by (simp add:Ptrace)+
−
  moreover have "grant s' e" +
−
  proof-+
−
    from grant obtain up rp tp up' rp' tp'+
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p'1: "sectxt_of_obj s (O_proc p') = Some (up', rp', tp')"+
−
      apply (simp add:Ptrace split:option.splits)+
−
      by (case_tac a, case_tac aa, blast)+
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:Ptrace co2sobj.simps cp2sproc_def split:option.splits)+
−
    from p'1 have p'1': "sectxt_of_obj s' (O_proc p') = Some (up', rp', tp')"+
−
      using os cp2sp+
−
      apply (erule_tac x = p' in allE)+
−
      by (auto simp:Ptrace co2sobj.simps cp2sproc_def split:option.splits)+
−
    show ?thesis using p1 p'1 p1' p'1' grant+
−
      by (simp add:Ptrace)+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (Exit p)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:Exit)+
−
  have "os_grant s' e" using p_in by (simp add:Exit)+
−
  moreover have "grant s' e" +
−
    by (simp add:Exit)+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (Open p f flags fd opt)+
−
  show ?thesis+
−
  proof (cases opt)+
−
    case None+
−
    have p_in: "p \<in> current_procs s'" using os alive+
−
      apply (erule_tac x = "O_proc p" in allE)+
−
      by (auto simp:Open None)+
−
    have f_in: "is_file s' f" using os alive+
−
      apply (erule_tac x = "O_file f" in allE)+
−
      by (auto simp:Open None)+
−
    have fd_not_in: "fd \<notin> current_proc_fds s' p"+
−
      using os alive' p_in+
−
      apply (erule_tac x = "E_fd p fd" in allE)+
−
      by (simp add:Open None)+
−
    have "os_grant s' e" using p_in f_in fd_not_in os+
−
      by (simp add:Open None)+
−
    moreover have "grant s' e" +
−
    proof-+
−
      from grant obtain up rp tp uf rf tf +
−
        where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
        and p2: "sectxt_of_obj s (O_file f) = Some (uf, rf, tf)" +
−
        apply (simp add:Open None split:option.splits)+
−
        by (case_tac a, case_tac aa, blast)+
−
      from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
        using os cp2sp+
−
        apply (erule_tac x = p in allE)+
−
        by (auto simp:Open None co2sobj.simps cp2sproc_def split:option.splits)+
−
      from os have f_in': "is_file s f" by (simp add:Open None)+
−
      from vd os have "\<exists> sf. cf2sfile s f = Some sf"+
−
        by (auto dest!:is_file_in_current current_file_has_sfile simp:Open None)+
−
      hence p2': "sectxt_of_obj s' (O_file f) = Some (uf, rf, tf)" using f_in f_in' p2 cf2sf+
−
        apply (erule_tac x = f in allE)+
−
        apply (auto dest:is_file_in_current simp:cf2sfile_def split:option.splits)+
−
        apply (case_tac f, simp)+
−
        apply (drule_tac s = s in root_is_dir', simp add:vd, simp+)+
−
        done+
−
      have "search_check s' (up, rp, tp) f"+
−
        using p1 p2 p2' vd cf2sf f_in' grant Open None f_in+
−
        apply (rule_tac s = s in enrich_search_check)+
−
        by (simp_all split:option.splits)+
−
      thus ?thesis using p1' p2' +
−
        apply (simp add:Open None split:option.splits) +
−
        using grant Open None p1 p2 +
−
        by simp+
−
    qed+
−
    ultimately show ?thesis using vs'+
−
      by (erule_tac valid.intros(2), simp+)+
−
  next+
−
    case (Some inum)+
−
    from os obtain pf where pf_in_s: "is_dir s pf" and parent: "parent f = Some pf"+
−
      by (auto simp:Open Some)+
−
    have pf_in: "is_dir s' pf" using pf_in_s alive+
−
      apply (erule_tac x = "O_dir pf" in allE)+
−
      by simp+
−
    have p_in: "p \<in> current_procs s'" using os alive+
−
      apply (erule_tac x = "O_proc p" in allE)+
−
      by (auto simp:Open Some)+
−
    have f_not_in: "f \<notin> current_files s'" using os alive'+
−
      apply (erule_tac x = "E_file f" in allE)+
−
      by (auto simp:Open Some)+
−
    have fd_not_in: "fd \<notin> current_proc_fds s' p"+
−
      using os alive' p_in+
−
      apply (erule_tac x = "E_fd p fd" in allE)+
−
      by (simp add:Open Some)+
−
    have inum_not_in: "inum \<notin> current_inode_nums s'"+
−
      using os alive' +
−
      apply (erule_tac x = "E_inum inum" in allE)+
−
      by (simp add:Open Some)+
−
    have "os_grant s' e" using p_in pf_in parent f_not_in fd_not_in inum_not_in os+
−
      by (simp add:Open Some hungs)+
−
    moreover have "grant s' e"  +
−
    proof-+
−
      from grant parent obtain up rp tp uf rf tf +
−
        where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
        and p2: "sectxt_of_obj s (O_dir pf) = Some (uf, rf, tf)" +
−
        apply (simp add:Open Some split:option.splits)+
−
        by (case_tac a, case_tac aa, blast)+
−
      from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
        using os cp2sp+
−
        apply (erule_tac x = p in allE)+
−
        by (auto simp:Open Some co2sobj.simps cp2sproc_def split:option.splits)+
−
      from vd os pf_in_s have "\<exists> sf. cf2sfile s pf = Some sf"+
−
        by (auto dest!:is_dir_in_current current_file_has_sfile simp:Open Some)+
−
      hence p2': "sectxt_of_obj s' (O_dir pf) = Some (uf, rf, tf)" using p2 cf2sf pf_in pf_in_s+
−
        apply (erule_tac x = pf in allE)+
−
        apply (erule exE, frule_tac s = s in is_dir_in_current, simp)+
−
        apply (drule is_dir_not_file, drule is_dir_not_file)+
−
        apply (auto simp:cf2sfile_def split:option.splits)+
−
        apply (case_tac pf, simp_all)+
−
        by (simp add:sroot_def root_sec_remains vd vs')+
−
      have "search_check s' (up, rp, tp) pf"+
−
        using p1 p2 p2' vd cf2sf pf_in grant Open Some pf_in_s parent vs'+
−
        apply (rule_tac s = s in enrich_search_check')+
−
        by (simp_all split:option.splits)+
−
      thus ?thesis using p1' p2' parent +
−
        apply (simp add:Open Some split:option.splits) +
−
        using grant Open Some p1 p2 +
−
        by simp+
−
    qed+
−
    ultimately show ?thesis using vs'+
−
      by (erule_tac valid.intros(2), simp+)+
−
  qed+
−
next+
−
  case (ReadFile p fd)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:ReadFile)+
−
  have fd_in: "fd \<in> current_proc_fds s' p" using os alive+
−
    apply (erule_tac x = "O_fd p fd" in allE)+
−
    by (auto simp:ReadFile)+
−
  obtain f where ffd: "file_of_proc_fd s p fd = Some f"+
−
    using os ReadFile by auto+
−
  hence f_in_s: "is_file s f" using vd+
−
    by (auto intro:file_of_pfd_is_file)+
−
  obtain flags where fflag: "flags_of_proc_fd s p fd = Some flags"+
−
    using os ReadFile by auto+
−
  have ffd_in: "file_of_proc_fd s' p fd = Some f"+
−
    using ffd_remain ffd by auto+
−
  hence f_in: "is_file s' f" using vs'+
−
    by (auto intro:file_of_pfd_is_file)+
−
  have flags_in: "flags_of_proc_fd s' p fd = Some flags"+
−
    using fflags_remain fflag by auto+
−
  have "os_grant s' e" using p_in fd_in ffd_in flags_in fflag os f_in +
−
    by (auto simp add:ReadFile is_file_in_current)+
−
  moreover have "grant s' e" +
−
  proof-+
−
    from grant ffd obtain up rp tp uf rf tf ufd rfd tfd+
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p2: "sectxt_of_obj s (O_file f) = Some (uf, rf, tf)"+
−
      and p3: "sectxt_of_obj s (O_fd p fd) = Some (ufd, rfd, tfd)"+
−
      apply (simp add:ReadFile split:option.splits)+
−
      by (case_tac a, case_tac aa, case_tac ab, blast)+
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:ReadFile co2sobj.simps cp2sproc_def split:option.splits)+
−
    from vd f_in_s have "\<exists> sf. cf2sfile s f = Some sf"+
−
      by (auto dest!:is_file_in_current current_file_has_sfile)+
−
    hence p2': "sectxt_of_obj s' (O_file f) = Some (uf, rf, tf)" using f_in f_in_s p2 cf2sf+
−
      apply (erule_tac x = f in allE)+
−
      apply (auto dest:is_file_in_current simp:cf2sfile_def split:option.splits)+
−
      apply (case_tac f, simp)+
−
      apply (drule_tac s = s in root_is_dir', simp add:vd, simp+)+
−
      done+
−
    have p3': "sectxt_of_obj s' (O_fd p fd) = Some (ufd, rfd, tfd)" +
−
      using cfd2sfd ffd_in ffd p3 f_in f_in_s vd+
−
      apply (erule_tac x = p in allE)+
−
      apply (erule_tac x = fd in allE)+
−
      apply (simp add:proc_file_fds_def)+
−
      apply (auto simp:cfd2sfd_def fflag flags_in p3 split:option.splits+
−
        dest!:current_file_has_sfile' simp:is_file_in_current)+
−
      done+
−
    show ?thesis using p1' p2' p3' ffd_in ffd+
−
      apply (simp add:ReadFile split:option.splits) +
−
      using grant p1 p2 p3 ReadFile+
−
      by simp+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (WriteFile p fd)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:WriteFile)+
−
  have fd_in: "fd \<in> current_proc_fds s' p" using os alive+
−
    apply (erule_tac x = "O_fd p fd" in allE)+
−
    by (auto simp:WriteFile)+
−
  obtain f where ffd: "file_of_proc_fd s p fd = Some f"+
−
    using os WriteFile by auto+
−
  hence f_in_s: "is_file s f" using vd+
−
    by (auto intro:file_of_pfd_is_file)+
−
  obtain flags where fflag: "flags_of_proc_fd s p fd = Some flags"+
−
    using os WriteFile by auto+
−
  have ffd_in: "file_of_proc_fd s' p fd = Some f"+
−
    using ffd_remain ffd by auto+
−
  hence f_in: "is_file s' f" using vs'+
−
    by (auto intro:file_of_pfd_is_file)+
−
  have flags_in: "flags_of_proc_fd s' p fd = Some flags"+
−
    using fflags_remain fflag by auto+
−
  have "os_grant s' e" using p_in fd_in ffd_in flags_in fflag os f_in +
−
    by (auto simp add:WriteFile is_file_in_current)+
−
  moreover have "grant s' e" +
−
  proof-+
−
    from grant ffd obtain up rp tp uf rf tf ufd rfd tfd+
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p2: "sectxt_of_obj s (O_file f) = Some (uf, rf, tf)"+
−
      and p3: "sectxt_of_obj s (O_fd p fd) = Some (ufd, rfd, tfd)"+
−
      apply (simp add:WriteFile split:option.splits)+
−
      by (case_tac a, case_tac aa, case_tac ab, blast)+
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:WriteFile co2sobj.simps cp2sproc_def split:option.splits)+
−
    from vd f_in_s have "\<exists> sf. cf2sfile s f = Some sf"+
−
      by (auto dest!:is_file_in_current current_file_has_sfile)+
−
    hence p2': "sectxt_of_obj s' (O_file f) = Some (uf, rf, tf)" using f_in f_in_s p2 cf2sf+
−
      apply (erule_tac x = f in allE)+
−
      apply (auto dest:is_file_in_current simp:cf2sfile_def split:option.splits)+
−
      apply (case_tac f, simp)+
−
      apply (drule_tac s = s in root_is_dir', simp add:vd, simp+)+
−
      done+
−
    have p3': "sectxt_of_obj s' (O_fd p fd) = Some (ufd, rfd, tfd)" +
−
      using cfd2sfd ffd_in ffd p3 f_in f_in_s vd+
−
      apply (erule_tac x = p in allE)+
−
      apply (erule_tac x = fd in allE)+
−
      apply (simp add:proc_file_fds_def)+
−
      apply (auto simp:cfd2sfd_def fflag flags_in p3 split:option.splits+
−
        dest!:current_file_has_sfile' simp:is_file_in_current)+
−
      done+
−
    show ?thesis using p1' p2' p3' ffd_in ffd+
−
      apply (simp add:WriteFile split:option.splits) +
−
      using grant p1 p2 p3 WriteFile+
−
      by simp+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (CloseFd p fd)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:CloseFd)+
−
  have fd_in: "fd \<in> current_proc_fds s' p" using os alive+
−
    apply (erule_tac x = "O_fd p fd" in allE)+
−
    by (auto simp:CloseFd)+
−
  have "os_grant s' e" using p_in fd_in +
−
    by (auto simp add:CloseFd)+
−
  moreover have "grant s' e" +
−
    by(simp add:CloseFd)+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (UnLink p f)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:UnLink)+
−
  have f_in: "is_file s' f" using os alive+
−
    apply (erule_tac x = "O_file f" in allE)+
−
    by (auto simp:UnLink)+
−
  from os vd obtain pf where pf_in_s: "is_dir s pf"+
−
    and parent: "parent f = Some pf"+
−
    by (auto simp:UnLink dest!:file_has_parent)+
−
  from pf_in_s alive have pf_in: "is_dir s' pf"+
−
    apply (erule_tac x = "O_dir pf" in allE)+
−
    by (auto simp:UnLink)+
−
  have "os_grant s' e" using p_in f_in os+
−
    by (simp add:UnLink hungs)+
−
  moreover have "grant s' e" +
−
  proof-    +
−
    from grant parent obtain up rp tp uf rf tf upf rpf tpf+
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p2: "sectxt_of_obj s (O_file f) = Some (uf, rf, tf)" +
−
      and p3: "sectxt_of_obj s (O_dir pf) = Some (upf, rpf, tpf)" +
−
      apply (simp add:UnLink split:option.splits)+
−
      by (case_tac a, case_tac aa, case_tac ab, blast) +
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:UnLink co2sobj.simps cp2sproc_def split:option.splits)+
−
    from vd os pf_in_s have "\<exists> sf. cf2sfile s f = Some sf"+
−
      by (auto dest!:is_file_in_current current_file_has_sfile simp:UnLink)+
−
    hence p2': "sectxt_of_obj s' (O_file f) = Some (uf, rf, tf)" +
−
      using p2 cf2sf f_in os parent +
−
      apply (erule_tac x = f in allE)+
−
      apply (erule exE, clarsimp simp:UnLink)+
−
      apply (frule_tac s = s in is_file_in_current, simp)+
−
      by (auto simp:cf2sfile_def split:option.splits)+
−
    from vd os pf_in_s have "\<exists> sf. cf2sfile s pf = Some sf"+
−
      by (auto dest!:is_dir_in_current current_file_has_sfile simp:UnLink)+
−
    hence p3': "sectxt_of_obj s' (O_dir pf) = Some (upf, rpf, tpf)" using p3 cf2sf pf_in pf_in_s+
−
      apply (erule_tac x = pf in allE)+
−
      apply (erule exE, frule_tac s = s in is_dir_in_current, simp)+
−
      apply (drule is_dir_not_file, drule is_dir_not_file)+
−
      apply (auto simp:cf2sfile_def split:option.splits)+
−
      apply (case_tac pf, simp_all)+
−
      by (simp add:sroot_def root_sec_remains vd vs')+
−
    have "search_check s' (up, rp, tp) f"+
−
      using p1 p2 p2' vd cf2sf f_in grant UnLink os parent vs'+
−
      apply (rule_tac s = s in enrich_search_check)+
−
      by (simp_all split:option.splits)+
−
    thus ?thesis using p1' p2' p3' parent +
−
      apply (simp add:UnLink split:option.splits) +
−
      using grant UnLink p1 p2 p3+
−
      by simp+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (Rmdir p f)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:Rmdir)+
−
  have f_in: "is_dir s' f" using os alive+
−
    apply (erule_tac x = "O_dir f" in allE)+
−
    by (auto simp:Rmdir dir_is_empty_def)+
−
  have not_root: "f \<noteq> []" using os +
−
    by (auto simp:Rmdir)+
−
  from os vd obtain pf where pf_in_s: "is_dir s pf"+
−
    and parent: "parent f = Some pf"+
−
    apply (auto simp:Rmdir dir_is_empty_def)+
−
    apply (case_tac f, simp+)+
−
    apply (drule parentf_is_dir_prop1, auto)+
−
    done+
−
  from pf_in_s alive have pf_in: "is_dir s' pf"+
−
    apply (erule_tac x = "O_dir pf" in allE)+
−
    by (auto simp:Rmdir)+
−
  have empty_in: "dir_is_empty s' f" using os+
−
    apply (simp add:dir_is_empty_def f_in)+
−
    apply auto using alive'+
−
    apply (erule_tac x = "E_file f'" in allE)+
−
    by (simp add:Rmdir dir_is_empty_def)+
−
  have "os_grant s' e" using p_in f_in os empty_in+
−
    by (simp add:Rmdir hungs)+
−
  moreover have "grant s' e" +
−
  proof-+
−
    from grant parent obtain up rp tp uf rf tf upf rpf tpf+
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p2: "sectxt_of_obj s (O_dir f) = Some (uf, rf, tf)" +
−
      and p3: "sectxt_of_obj s (O_dir pf) = Some (upf, rpf, tpf)" +
−
      apply (simp add:Rmdir split:option.splits)+
−
      by (case_tac a, case_tac aa, case_tac ab, blast) +
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:Rmdir co2sobj.simps cp2sproc_def split:option.splits)+
−
    from vd os pf_in_s have "\<exists> sf. cf2sfile s f = Some sf"+
−
      by (auto dest!:is_dir_in_current current_file_has_sfile simp:dir_is_empty_def Rmdir)+
−
    hence p2': "sectxt_of_obj s' (O_dir f) = Some (uf, rf, tf)" +
−
      using p2 cf2sf f_in os parent +
−
      apply (erule_tac x = f in allE)+
−
      apply (erule exE, clarsimp simp:Rmdir dir_is_empty_def)+
−
      apply (frule_tac s = s in is_dir_in_current, simp)+
−
      apply (drule is_dir_not_file, drule is_dir_not_file)+
−
      by (auto simp:cf2sfile_def split:option.splits)+
−
    from vd os pf_in_s have "\<exists> sf. cf2sfile s pf = Some sf"+
−
      by (auto dest!:is_dir_in_current current_file_has_sfile simp:Rmdir)+
−
    hence p3': "sectxt_of_obj s' (O_dir pf) = Some (upf, rpf, tpf)" using p3 cf2sf pf_in pf_in_s+
−
      apply (erule_tac x = pf in allE)+
−
      apply (erule exE, frule_tac s = s in is_dir_in_current, simp)+
−
      apply (drule is_dir_not_file, drule is_dir_not_file)+
−
      apply (auto simp:cf2sfile_def split:option.splits)+
−
      apply (case_tac pf, simp_all)+
−
      by (simp add:sroot_def root_sec_remains vd vs')+
−
    have "search_check s' (up, rp, tp) f"+
−
      using p1 p2 p2' vd cf2sf f_in grant Rmdir os parent vs'+
−
      apply (rule_tac s = s in enrich_search_check')+
−
      by (simp_all add:dir_is_empty_def split:option.splits)+
−
    thus ?thesis using p1' p2' p3' parent +
−
      apply (simp add:Rmdir split:option.splits) +
−
      using grant Rmdir p1 p2 p3+
−
      by simp+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (Mkdir p f inum)+
−
  from os obtain pf where pf_in_s: "is_dir s pf" and parent: "parent f = Some pf"+
−
    by (auto simp:Mkdir)+
−
  have pf_in: "is_dir s' pf" using pf_in_s alive+
−
    apply (erule_tac x = "O_dir pf" in allE)+
−
    by simp+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:Mkdir)+
−
  have f_not_in: "f \<notin> current_files s'" using os alive'+
−
    apply (erule_tac x = "E_file f" in allE)+
−
    by (auto simp:Mkdir)+
−
  have inum_not_in: "inum \<notin> current_inode_nums s'"+
−
    using os alive' +
−
    apply (erule_tac x = "E_inum inum" in allE)+
−
    by (simp add:Mkdir)+
−
  have "os_grant s' e" using p_in pf_in parent f_not_in os inum_not_in+
−
    by (simp add:Mkdir hungs)+
−
  moreover have "grant s' e"  +
−
  proof-+
−
    from grant parent obtain up rp tp uf rf tf +
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p2: "sectxt_of_obj s (O_dir pf) = Some (uf, rf, tf)" +
−
      apply (simp add:Mkdir split:option.splits)+
−
      by (case_tac a, case_tac aa, blast)+
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:Mkdir co2sobj.simps cp2sproc_def split:option.splits)+
−
    from vd os pf_in_s have "\<exists> sf. cf2sfile s pf = Some sf"+
−
      by (auto dest!:is_dir_in_current current_file_has_sfile simp:Mkdir)+
−
    hence p2': "sectxt_of_obj s' (O_dir pf) = Some (uf, rf, tf)" using p2 cf2sf pf_in pf_in_s+
−
      apply (erule_tac x = pf in allE)+
−
      apply (erule exE, frule_tac s = s in is_dir_in_current, simp)+
−
      apply (drule is_dir_not_file, drule is_dir_not_file)+
−
      apply (auto simp:cf2sfile_def split:option.splits)+
−
      apply (case_tac pf, simp_all)+
−
      by (simp add:sroot_def root_sec_remains vd vs')+
−
    have "search_check s' (up, rp, tp) pf"+
−
      using p1 p2 p2' vd cf2sf pf_in grant Mkdir pf_in_s parent vs'+
−
      apply (rule_tac s = s in enrich_search_check')+
−
      apply (simp_all split:option.splits)+
−
      done+
−
    thus ?thesis using p1' p2' parent +
−
      apply (simp add:Mkdir split:option.splits) +
−
      using grant Mkdir p1 p2 +
−
      apply simp +
−
      done+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (LinkHard p f f')+
−
  from os obtain pf where pf_in_s: "is_dir s pf" and parent: "parent f' = Some pf"+
−
    by (auto simp:LinkHard)+
−
  have pf_in: "is_dir s' pf" using pf_in_s alive+
−
    apply (erule_tac x = "O_dir pf" in allE)+
−
    by simp+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:LinkHard)+
−
  have f'_not_in: "f' \<notin> current_files s'" using os alive'+
−
    apply (erule_tac x = "E_file f'" in allE)+
−
    by (auto simp:LinkHard)+
−
  have f_in: "is_file s' f" using os alive+
−
    apply (erule_tac x = "O_file f" in allE)+
−
    by (auto simp:LinkHard)+
−
  have "os_grant s' e" using p_in pf_in parent os f_in f'_not_in+
−
    by (simp add:LinkHard hungs)+
−
  moreover have "grant s' e"+
−
  proof-+
−
    from grant parent obtain up rp tp uf rf tf upf rpf tpf+
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p2: "sectxt_of_obj s (O_file f) = Some (uf, rf, tf)" +
−
      and p3: "sectxt_of_obj s (O_dir pf) = Some (upf, rpf, tpf)" +
−
      apply (simp add:LinkHard split:option.splits)+
−
      by (case_tac a, case_tac aa, case_tac ab, blast) +
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:LinkHard co2sobj.simps cp2sproc_def split:option.splits)+
−
    from vd os pf_in_s have "\<exists> sf. cf2sfile s f = Some sf"+
−
      by (auto dest!:is_file_in_current current_file_has_sfile simp:LinkHard)+
−
    hence p2': "sectxt_of_obj s' (O_file f) = Some (uf, rf, tf)" +
−
      using p2 cf2sf f_in os parent +
−
      apply (erule_tac x = f in allE)+
−
      apply (erule exE, clarsimp simp:LinkHard)+
−
      apply (frule_tac s = s in is_file_in_current, simp)+
−
      apply (auto simp:cf2sfile_def split:option.splits)+
−
      apply (case_tac f, simp)+
−
      by (drule_tac s = s in root_is_dir', simp add:vd, simp+)+
−
    from vd os pf_in_s have "\<exists> sf. cf2sfile s pf = Some sf"+
−
      by (auto dest!:is_dir_in_current current_file_has_sfile simp:LinkHard)+
−
    hence p3': "sectxt_of_obj s' (O_dir pf) = Some (upf, rpf, tpf)" using p3 cf2sf pf_in pf_in_s+
−
      apply (erule_tac x = pf in allE)+
−
      apply (erule exE, frule_tac s = s in is_dir_in_current, simp)+
−
      apply (drule is_dir_not_file, drule is_dir_not_file)+
−
      apply (auto simp:cf2sfile_def split:option.splits)+
−
      apply (case_tac pf, simp_all)+
−
      by (simp add:sroot_def root_sec_remains vd vs')+
−
    have "search_check s' (up, rp, tp) f"+
−
      using p1 p2 p2' vd cf2sf f_in grant LinkHard os parent vs'+
−
      apply (rule_tac s = s in enrich_search_check)+
−
      by (simp_all split:option.splits)+
−
    moreover have "search_check s' (up, rp, tp) pf"+
−
      using p1 p3 p3' vd cf2sf pf_in grant LinkHard os parent vs'+
−
      apply (rule_tac s = s in enrich_search_check')+
−
      apply (simp_all split:option.splits)+
−
      done+
−
    ultimately show ?thesis using p1' p2' p3' parent +
−
      apply (simp add:LinkHard split:option.splits) +
−
      using grant LinkHard p1 p2 p3+
−
      apply simp +
−
      done+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (Truncate p f len)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:Truncate)+
−
  have f_in: "is_file s' f" using os alive+
−
    apply (erule_tac x = "O_file f" in allE)+
−
    by (auto simp:Truncate)+
−
  have "os_grant s' e" using p_in f_in by (simp add:Truncate)+
−
  moreover have "grant s' e"+
−
  proof-+
−
    from grant obtain up rp tp uf rf tf +
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p2: "sectxt_of_obj s (O_file f) = Some (uf, rf, tf)" +
−
      apply (simp add:Truncate split:option.splits)+
−
      by (case_tac a, case_tac aa, blast)+
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:Truncate co2sobj.simps cp2sproc_def split:option.splits)+
−
    from os have f_in': "is_file s f" by (simp add:Truncate)+
−
    from vd os have "\<exists> sf. cf2sfile s f = Some sf"+
−
      by (auto dest!:is_file_in_current current_file_has_sfile simp:Truncate)+
−
    hence p2': "sectxt_of_obj s' (O_file f) = Some (uf, rf, tf)" using f_in f_in' p2 cf2sf+
−
      apply (erule_tac x = f in allE)+
−
      apply (auto dest:is_file_in_current simp:cf2sfile_def split:option.splits)+
−
      apply (case_tac f, simp)+
−
      apply (drule_tac s = s in root_is_dir', simp add:vd, simp+)+
−
      done+
−
    have "search_check s' (up, rp, tp) f"+
−
      using p1 p2 p2' vd cf2sf f_in' grant Truncate f_in+
−
      apply (rule_tac s = s in enrich_search_check)+
−
      by (simp_all split:option.splits)+
−
    thus ?thesis using p1' p2' +
−
      apply (simp add:Truncate split:option.splits) +
−
      using grant Truncate p1 p2+
−
      by (simp add:Truncate grant p1 p2)+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (CreateMsgq p q)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:CreateMsgq)+
−
  have q_not_in: "q \<notin> current_msgqs s'" using os alive'+
−
    apply (erule_tac x = "E_msgq q" in allE)+
−
    by (simp add:CreateMsgq)+
−
  have "os_grant s' e" using p_in q_not_in by (simp add:CreateMsgq)+
−
  moreover have "grant s' e" +
−
  proof-+
−
    from grant obtain up rp tp +
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      apply (simp add:CreateMsgq split:option.splits)+
−
      by (case_tac a, blast)+
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:CreateMsgq co2sobj.simps cp2sproc_def split:option.splits)+
−
    show ?thesis using p1' +
−
      apply (simp add:CreateMsgq split:option.splits) +
−
      using grant CreateMsgq p1+
−
      by simp+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)+
−
next+
−
  case (RemoveMsgq p q)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:RemoveMsgq)+
−
  have q_in: "q \<in> current_msgqs s'" using os alive+
−
    apply (erule_tac x = "O_msgq q" in allE)+
−
    by (simp add:RemoveMsgq)+
−
  have "os_grant s' e" using p_in q_in by (simp add:RemoveMsgq)+
−
  moreover have "grant s' e" +
−
  proof-+
−
    from grant obtain up rp tp uq rq tq+
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p2: "sectxt_of_obj s (O_msgq q) = Some (uq, rq, tq)"+
−
      apply (simp add:RemoveMsgq split:option.splits)+
−
      by (case_tac a, case_tac aa, blast)+
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:RemoveMsgq co2sobj.simps cp2sproc_def split:option.splits)+
−
    from p2 have p2': "sectxt_of_obj s' (O_msgq q) = Some (uq, rq, tq)"+
−
      using os cq2sq vd+
−
      apply (erule_tac x = q in allE)+
−
      by (auto simp:RemoveMsgq co2sobj.simps cq2smsgq_def dest!:current_has_sms' split:option.splits)+
−
    show ?thesis using p1' p2' grant p1 p2+
−
      by (simp add:RemoveMsgq)+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)  +
−
next+
−
  case (SendMsg p q m)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:SendMsg)+
−
  have q_in: "q \<in> current_msgqs s'" using os alive+
−
    apply (erule_tac x = "O_msgq q" in allE)+
−
    by (simp add:SendMsg)+
−
  have m_not_in: "m \<notin> set (msgs_of_queue s' q)" using os alive'+
−
    apply (erule_tac x = "E_msg q m" in allE)+
−
    by (simp add:SendMsg q_in)+
−
  have "os_grant s' e" using p_in q_in m_not_in+
−
    by (simp add:SendMsg)+
−
  moreover have "grant s' e" +
−
  proof-+
−
    from grant obtain up rp tp uq rq tq+
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p2: "sectxt_of_obj s (O_msgq q) = Some (uq, rq, tq)"+
−
      apply (simp add:SendMsg split:option.splits)+
−
      by (case_tac a, case_tac aa, blast)+
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:SendMsg co2sobj.simps cp2sproc_def split:option.splits)+
−
    from p2 have p2': "sectxt_of_obj s' (O_msgq q) = Some (uq, rq, tq)"+
−
      using os cq2sq vd+
−
      apply (erule_tac x = q in allE)+
−
      by (auto simp:SendMsg co2sobj.simps cq2smsgq_def dest!:current_has_sms' split:option.splits)+
−
    show ?thesis using p1' p2' grant p1 p2+
−
      by (simp add:SendMsg)+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)  +
−
next+
−
  case (RecvMsg p q m)+
−
  have p_in: "p \<in> current_procs s'" using os alive+
−
    apply (erule_tac x = "O_proc p" in allE)+
−
    by (auto simp:RecvMsg)+
−
  have q_in: "q \<in> current_msgqs s'" using os alive+
−
    apply (erule_tac x = "O_msgq q" in allE)+
−
    by (simp add:RecvMsg) +
−
  have m_in: "m = hd (msgs_of_queue s' q)" +
−
    and sms_not_empty: "msgs_of_queue s' q \<noteq> []"+
−
    using os sms_remain+
−
    by (auto simp:RecvMsg)+
−
  have "os_grant s' e" using p_in q_in m_in sms_not_empty os+
−
    by (simp add:RecvMsg)+
−
  moreover have "grant s' e" +
−
  proof-+
−
    from grant obtain up rp tp uq rq tq um rm tm+
−
      where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
      and p2: "sectxt_of_obj s (O_msgq q) = Some (uq, rq, tq)"+
−
      and p3: "sectxt_of_obj s (O_msg q m) = Some (um, rm, tm)"+
−
      apply (simp add:RecvMsg split:option.splits)+
−
      by (case_tac a, case_tac aa, case_tac ab, blast)+
−
    from p1 have p1': "sectxt_of_obj s' (O_proc p) = Some (up, rp, tp)"+
−
      using os cp2sp+
−
      apply (erule_tac x = p in allE)+
−
      by (auto simp:RecvMsg co2sobj.simps cp2sproc_def split:option.splits)+
−
    from p2 have p2': "sectxt_of_obj s' (O_msgq q) = Some (uq, rq, tq)"+
−
      using os cq2sq vd+
−
      apply (erule_tac x = q in allE)+
−
      by (auto simp:RecvMsg co2sobj.simps cq2smsgq_def dest!:current_has_sms' split:option.splits)+
−
    from p3 have p3': "sectxt_of_obj s' (O_msg q m) = Some (um, rm, tm)"+
−
      using sms_remain cq2sq vd os p2 p2' p3 +
−
      apply (erule_tac x = q in allE)+
−
      apply (erule_tac x = q in allE)+
−
      apply (clarsimp simp:RecvMsg)+
−
      apply (simp add:cq2smsgq_def split:option.splits if_splits)+
−
      apply (drule current_has_sms', simp, simp)+
−
      apply (case_tac "msgs_of_queue s q", simp)+
−
      apply (simp add:cqm2sms.simps split:option.splits)+
−
      apply (auto simp add:cm2smsg_def split:option.splits if_splits)[1]+
−
      apply (case_tac "msgs_of_queue s q", simp)+
−
      apply (simp add:cqm2sms.simps split:option.splits)+
−
      apply (auto simp add:cm2smsg_def split:option.splits if_splits)[1]+
−
      done+
−
    show ?thesis using p1' p2' p3' grant p1 p2 p3+
−
      by (simp add:RecvMsg)+
−
  qed+
−
  ultimately show ?thesis using vs'+
−
    by (erule_tac valid.intros(2), simp+)  +
−
next+
−
  case (CreateSock p af st fd inum)+
−
  show ?thesis using grant+
−
    by (simp add:CreateSock)+
−
next+
−
  case (Bind p fd addr)+
−
  show ?thesis using grant+
−
    by (simp add:Bind)+
−
next+
−
  case (Connect p fd addr)+
−
  show ?thesis using grant+
−
    by (simp add:Connect)+
−
next+
−
  case (Listen p fd)+
−
  show ?thesis using grant+
−
    by (simp add:Listen)+
−
next+
−
  case (Accept p fd addr port fd' inum)+
−
  show ?thesis using grant+
−
    by (simp add:Accept)+
−
next+
−
  case (SendSock p fd)+
−
  show ?thesis using grant+
−
    by (simp add:SendSock)+
−
next+
−
  case (RecvSock p fd)+
−
  show ?thesis using grant+
−
    by (simp add:RecvSock)+
−
next+
−
  case (Shutdown p fd how)+
−
  show ?thesis using grant+
−
    by (simp add:Shutdown)+
−
qed  +
−
  +
−
lemma not_all_procs_prop2:+
−
  "p' \<notin> all_procs s \<Longrightarrow> p' \<notin> init_procs"+
−
apply (induct s, simp)+
−
by (case_tac a, auto)+
−
+
−
lemma not_all_procs_prop3:+
−
  "p' \<notin> all_procs s \<Longrightarrow> p' \<notin> current_procs s"+
−
apply (induct s, simp)+
−
by (case_tac a, auto)+
−
+
−
definition is_created_proc:: "t_state \<Rightarrow> t_process \<Rightarrow> bool"+
−
where+
−
  "is_created_proc s p \<equiv> p \<in> current_procs s \<and> (p \<in> init_procs \<longrightarrow> died (O_proc p) s)"+
−
+
−
lemma created_proc_clone:+
−
  "valid (Clone p p' fds # s) \<Longrightarrow> +
−
   is_created_proc (Clone p p' fds # s) tp = (if (tp = p') then True else is_created_proc s tp)"+
−
apply (drule vt_grant_os)+
−
apply (auto simp:is_created_proc_def dest:not_all_procs_prop2)+
−
using not_died_init_proc+
−
by auto+
−
+
−
lemma created_proc_exit: +
−
  "is_created_proc (Exit p # s) tp = (if (tp = p) then False else is_created_proc s tp)"+
−
by (simp add:is_created_proc_def)+
−
+
−
lemma created_proc_kill:+
−
  "is_created_proc (Kill p p' # s) tp = (if (tp = p') then False else is_created_proc s tp)"+
−
by (simp add:is_created_proc_def)+
−
+
−
lemma created_proc_other:+
−
  "\<lbrakk>\<And> p p' fds. e \<noteq> Clone p p' fds;+
−
    \<And> p. e \<noteq> Exit p;+
−
    \<And> p p'. e \<noteq> Kill p p'\<rbrakk> \<Longrightarrow> is_created_proc (e # s) tp = is_created_proc s tp"+
−
by (case_tac e, auto simp:is_created_proc_def)+
−
+
−
lemmas is_created_proc_simps = created_proc_clone created_proc_exit created_proc_kill created_proc_other+
−
(*+
−
+
−
+
−
+
−
+
−
       (p \<in> current_procs s \<longrightarrow> co2sobj (enrich_proc s p p') (O_proc p') = co2sobj (enrich_proc s p p') (O_proc p)) \<and>+
−
       (\<forall> obj. alive s obj \<longrightarrow> alive (enrich_proc s p p')  obj) \<and> +
−
       (\<forall> p'. p' \<in> current_procs s \<longrightarrow> cp2sproc (enrich_proc s p p') p' = cp2sproc s p) \<and>+
−
       (\<forall> f. f \<in> current_files s \<longrightarrow> cf2sfile (enrich_proc s p p') f = cf2sfile s f) \<and>+
−
       (Tainted (enrich_proc s p p') = (Tainted s \<union> (if (O_proc p \<in> Tainted s) then {O_proc p'} else {})))"*)+
−
+
−
lemma enrich_proc_dup_in:+
−
  "\<lbrakk>is_created_proc s p; p' \<notin> all_procs s; valid s\<rbrakk>+
−
   \<Longrightarrow> p' \<in> current_procs (enrich_proc s p p')"+
−
apply (induct s, simp add:is_created_proc_def)+
−
apply (frule vt_grant_os, frule vd_cons)+
−
apply (case_tac a, auto simp:is_created_proc_def dest:not_all_procs_prop3)+
−
done+
−
+
−
lemma enrich_proc_dup_ffd:+
−
  "\<lbrakk>file_of_proc_fd s p fd = Some f; is_created_proc s p; p' \<notin> all_procs s; valid s\<rbrakk>+
−
   \<Longrightarrow> file_of_proc_fd (enrich_proc s p p') p' fd = Some f"+
−
apply (induct s, simp add:is_created_proc_def)+
−
apply (frule vt_grant_os, frule vd_cons)+
−
apply (case_tac a, auto simp:is_created_proc_def proc_file_fds_def+
−
  dest:not_all_procs_prop3 split:if_splits option.splits)+
−
done +
−
+
−
lemma enrich_proc_dup_ffd':+
−
  "\<lbrakk>file_of_proc_fd (enrich_proc s p p') p' fd = Some f; is_created_proc s p; p' \<notin> all_procs s; valid s\<rbrakk>+
−
   \<Longrightarrow> file_of_proc_fd s p fd = Some f"+
−
apply (induct s, simp add:is_created_proc_def)+
−
apply (frule vt_grant_os, frule vd_cons)+
−
apply (case_tac a, auto simp:is_created_proc_def proc_file_fds_def+
−
  dest:not_all_procs_prop3 split:if_splits option.splits)+
−
done +
−
+
−
lemma current_fflag_in_fds:+
−
  "\<lbrakk>flags_of_proc_fd s p fd = Some flag; valid s\<rbrakk> \<Longrightarrow> fd \<in> current_proc_fds s p"+
−
apply (induct s arbitrary:p)+
−
apply (simp add:flags_of_proc_fd.simps file_of_proc_fd.simps init_oflags_prop2) +
−
apply (frule vd_cons, frule vt_grant_os, case_tac a)+
−
apply (auto split:if_splits option.splits dest:proc_fd_in_fds)+
−
done+
−
+
−
lemma current_fflag_has_ffd:+
−
  "\<lbrakk>flags_of_proc_fd s p fd = Some flag; valid s\<rbrakk> \<Longrightarrow> \<exists> f. file_of_proc_fd s p fd = Some f"+
−
apply (induct s arbitrary:p)+
−
apply (simp add: file_of_proc_fd.simps init_fileflag_valid) +
−
apply (frule vd_cons, frule vt_grant_os, case_tac a)+
−
apply (auto split:if_splits option.splits dest:proc_fd_in_fds)+
−
done+
−
+
−
lemma enrich_proc_dup_fflags:+
−
  "\<lbrakk>flags_of_proc_fd s p fd = Some flag; is_created_proc s p; p' \<notin> all_procs s; valid s\<rbrakk>+
−
   \<Longrightarrow> flags_of_proc_fd (enrich_proc s p p') p' fd = Some (remove_create_flag flag) \<or>+
−
       flags_of_proc_fd (enrich_proc s p p') p' fd = Some flag"+
−
apply (induct s arbitrary:p, simp add:is_created_proc_def)+
−
apply (frule vt_grant_os, frule vd_cons)+
−
apply (case_tac a, auto simp:is_created_proc_def proc_file_fds_def is_creat_flag_def+
−
  dest:not_all_procs_prop3 split:if_splits option.splits)+
−
done+
−
+
−
lemma enrich_proc_dup_ffds:+
−
  "\<lbrakk>is_created_proc s p; p' \<notin> all_procs s; valid s\<rbrakk>+
−
   \<Longrightarrow> proc_file_fds (enrich_proc s p p') p' = proc_file_fds s p"+
−
apply (auto simp:proc_file_fds_def)+
−
apply (rule_tac x = f in exI) +
−
apply (erule enrich_proc_dup_ffd', simp+)+
−
apply (rule_tac x = f in exI)+
−
apply (erule enrich_proc_dup_ffd, simp+)+
−
done+
−
+
−
lemma enrich_proc_prop:+
−
  "\<lbrakk>valid s; is_created_proc s p; p' \<notin> all_procs s\<rbrakk>+
−
   \<Longrightarrow> valid (enrich_proc s p p') \<and> +
−
       (\<forall> obj. alive s obj \<longrightarrow> alive (enrich_proc s p p') obj) \<and> +
−
       (\<forall> obj. enrich_not_alive s obj \<longrightarrow> enrich_not_alive (enrich_proc s p p') obj) \<and>+
−
       (files_hung_by_del (enrich_proc s p p') = files_hung_by_del s) \<and> +
−
       (\<forall> tp. tp \<in> current_procs s \<longrightarrow> cp2sproc (enrich_proc s p p') tp = cp2sproc s tp) \<and>+
−
       (\<forall> f. f \<in> current_files s \<longrightarrow> cf2sfile (enrich_proc s p p') f = cf2sfile s f) \<and> +
−
       (\<forall> q. q \<in> current_msgqs s \<longrightarrow> cq2smsgq (enrich_proc s p p') q = cq2smsgq s q) \<and> +
−
       (\<forall> tp fd f. file_of_proc_fd s tp fd = Some f \<longrightarrow> file_of_proc_fd (enrich_proc s p p') tp fd = Some f) \<and>+
−
       (\<forall> tp fd flags. flags_of_proc_fd s tp fd = Some flags \<longrightarrow> +
−
                      flags_of_proc_fd (enrich_proc s p p') tp fd = Some flags) \<and>+
−
       (\<forall> q. msgs_of_queue (enrich_proc s p p') q = msgs_of_queue s q) \<and>+
−
       (\<forall> tp fd. fd \<in> proc_file_fds s tp \<longrightarrow> cfd2sfd (enrich_proc s p p') tp fd = cfd2sfd s tp fd) \<and>+
−
       (cp2sproc (enrich_proc s p p') p' = cp2sproc s p) \<and>+
−
       (\<forall> fd. fd \<in> proc_file_fds s p \<longrightarrow> cfd2sfd (enrich_proc s p p') p' fd = cfd2sfd s p fd)"+
−
proof (induct s)+
−
  case Nil+
−
  thus ?case by (auto simp:is_created_proc_def)+
−
next+
−
  case (Cons e s)+
−
  hence vd_cons: "valid (e # s)" and created_cons: "is_created_proc (e # s) p"+
−
    and all_procs_cons: "p' \<notin> all_procs (e # s)" and vd: "valid s" +
−
    and os: "os_grant s e" and grant: "grant s e"+
−
    by (auto dest:vd_cons vt_grant_os vt_grant)+
−
  from all_procs_cons have all_procs: "p' \<notin> all_procs s" by (case_tac e, auto)+
−
  from Cons have pre: "is_created_proc s p \<Longrightarrow> valid (enrich_proc s p p') \<and>+
−
     (\<forall>obj. alive s obj \<longrightarrow> alive (enrich_proc s p p') obj) \<and>+
−
     (\<forall>obj. enrich_not_alive s obj \<longrightarrow> enrich_not_alive (enrich_proc s p p') obj) \<and>+
−
     files_hung_by_del (enrich_proc s p p') = files_hung_by_del s \<and>+
−
     (\<forall>tp. tp \<in> current_procs s \<longrightarrow> cp2sproc (enrich_proc s p p') tp = cp2sproc s tp) \<and>+
−
     (\<forall>f. f \<in> current_files s \<longrightarrow> cf2sfile (enrich_proc s p p') f = cf2sfile s f) \<and>+
−
     (\<forall>q. q \<in> current_msgqs s \<longrightarrow> cq2smsgq (enrich_proc s p p') q = cq2smsgq s q) \<and>+
−
     (\<forall>tp fd f. file_of_proc_fd s tp fd = Some f \<longrightarrow> file_of_proc_fd (enrich_proc s p p') tp fd = Some f) \<and>+
−
     (\<forall>tp fd flags.+
−
         flags_of_proc_fd s tp fd = Some flags \<longrightarrow> flags_of_proc_fd (enrich_proc s p p') tp fd = Some flags) \<and>+
−
     (\<forall>q. msgs_of_queue (enrich_proc s p p') q = msgs_of_queue s q) \<and>+
−
     (\<forall>tp fd. fd \<in> proc_file_fds s tp \<longrightarrow> cfd2sfd (enrich_proc s p p') tp fd = cfd2sfd s tp fd) \<and>     +
−
     (cp2sproc (enrich_proc s p p') p' = cp2sproc s p) \<and>+
−
     (\<forall> fd. fd \<in> proc_file_fds s p \<longrightarrow> cfd2sfd (enrich_proc s p p') p' fd = cfd2sfd s p fd)"+
−
    using vd all_procs by auto+
−
  have alive_pre: "is_created_proc s p \<Longrightarrow> (\<forall>obj. alive s obj \<longrightarrow> alive (enrich_proc s p p') obj)"+
−
    using pre by simp+
−
  hence curf_pre: "is_created_proc s p \<Longrightarrow> (\<forall>f. f \<in> current_files s \<longrightarrow> f \<in> current_files (enrich_proc s p p'))"+
−
    using vd apply auto+
−
    apply (drule is_file_or_dir, simp)+
−
    apply (erule disjE)+
−
    apply (erule_tac x = "O_file f" in allE, simp add:is_file_in_current)+
−
    apply (erule_tac x = "O_dir f" in allE, simp add:is_dir_in_current)+
−
    done+
−
  have "valid (enrich_proc (e # s) p p')"+
−
  proof-+
−
    from pre have pre': "is_created_proc s p \<Longrightarrow> valid (enrich_proc s p p')" by simp+
−
    have "is_created_proc s p \<Longrightarrow> valid (e # enrich_proc s p p')" +
−
      apply (frule pre')+
−
      apply (erule_tac s = s in enrich_valid_intro_cons)+
−
      apply (simp_all add:os grant vd pre)+
−
      done  +
−
    moreover have "\<And>f fds. \<lbrakk>valid (Execve p f fds # enrich_proc s p p'); is_created_proc s p; +
−
      valid (Execve p f fds # s); p' \<notin> all_procs s\<rbrakk>+
−
      \<Longrightarrow> valid (Execve p' f (fds \<inter> proc_file_fds s p) # Execve p f fds # enrich_proc s p p')"+
−
    proof-+
−
      fix f fds+
−
      assume a1: "valid (Execve p f fds # enrich_proc s p p')" and a2: "is_created_proc s p"+
−
        and a3: "valid (Execve p f fds # s)" and a0: "p' \<notin> all_procs s"+
−
      have cp2sp: "\<forall> tp. tp \<in> current_procs s \<longrightarrow> cp2sproc (enrich_proc s p p') tp = cp2sproc s tp"+
−
        and cf2sf: "\<forall> tf. tf \<in> current_files s \<longrightarrow> cf2sfile (enrich_proc s p p') tf = cf2sfile s tf"+
−
        and cfd2sfd: "\<forall> tp tfd. tfd \<in> proc_file_fds s tp \<longrightarrow> cfd2sfd (enrich_proc s p p') tp tfd = cfd2sfd s tp tfd"+
−
        and ffd_remain: "\<forall>tp fd f. file_of_proc_fd s tp fd = Some f \<longrightarrow> +
−
                                   file_of_proc_fd (enrich_proc s p p') tp fd = Some f"+
−
        and dup_sp: "cp2sproc (enrich_proc s p p') p' = cp2sproc s p"+
−
        and dup_sfd: "\<forall> fd. fd \<in> proc_file_fds s p \<longrightarrow> cfd2sfd (enrich_proc s p p') p' fd = cfd2sfd s p fd"+
−
        using pre a2 by auto+
−
      show "valid (Execve p' f (fds \<inter> proc_file_fds s p) # Execve p f fds # enrich_proc s p p')"+
−
      proof-+
−
        from a0 a3 have a0': "p' \<noteq> p" by (auto dest!:vt_grant_os not_all_procs_prop3)+
−
        from a3 have grant: "grant s (Execve p f fds)" and os: "os_grant s (Execve p f fds)"+
−
          by (auto dest:vt_grant_os vt_grant simp del:os_grant.simps)+
−
        have f_in: "is_file (enrich_proc s p p') f" +
−
        proof-+
−
          from pre a2+
−
          have a4: "\<forall> obj. alive s obj \<longrightarrow> alive (enrich_proc s p p') obj"+
−
            by (auto)+
−
          show ?thesis using a3 a4+
−
            apply (erule_tac x = "O_file f" in allE)+
−
            by (auto dest:vt_grant_os)+
−
        qed+
−
        moreover have a5: "proc_file_fds s p \<subseteq> proc_file_fds (Execve p f fds # enrich_proc s p p') p'" +
−
          using a3 a0'+
−
          apply (frule_tac vt_grant_os)+
−
          apply (auto simp:proc_file_fds_def)+
−
          apply (rule_tac x = fa in exI)+
−
          apply (erule enrich_proc_dup_ffd)+
−
          apply (simp_all add:vd all_procs a2)+
−
          done+
−
        ultimately have "os_grant (Execve p f fds # enrich_proc s p p') (Execve p' f (fds \<inter> proc_file_fds s p))"+
−
          apply (auto simp:is_file_simps enrich_proc_dup_in a2 vd all_procs a1 enrich_proc_dup_ffds)+
−
          done+
−
        moreover have "grant (Execve p f fds # enrich_proc s p p') (Execve p' f (fds \<inter> proc_file_fds s p))"+
−
        proof-+
−
          from grant obtain up rp tp uf rf tf +
−
            where p1: "sectxt_of_obj s (O_proc p) = Some (up, rp, tp)"+
−
            and p2: "sectxt_of_obj s (O_file f) = Some (uf, rf, tf)" +
−
            by (simp split:option.splits, blast)+
−
          with grant obtain pu nr nt where p3: "npctxt_execve (up, rp, tp) (uf, rf, tf) = Some (pu, nr, nt)"+
−
            by (simp split:option.splits del:npctxt_execve.simps, blast)+
−
          have p1': "sectxt_of_obj (Execve p f fds # enrich_proc s p p') (O_proc p') = Some (up, rp, tp)"+
−
            using p1 dup_sp a1 a0'+
−
            apply (simp add:sectxt_of_obj_simps)+
−
            by (simp add:cp2sproc_def split:option.splits)+
−
          from os have f_in': "is_file s f"  by simp +
−
          from vd os have "\<exists> sf. cf2sfile s f = Some sf"+
−
            by (auto dest!:is_file_in_current current_file_has_sfile)+
−
          hence p2': "sectxt_of_obj (Execve p f fds # enrich_proc s p p') (O_file f) = Some (uf, rf, tf)" +
−
            using f_in p2 cf2sf os a1+
−
            apply (erule_tac x = f in allE)+
−
            apply (auto dest:is_file_in_current simp:cf2sfile_def sectxt_of_obj_simps split:option.splits)+
−
            apply (case_tac f, simp)+
−
            apply (drule_tac s = s in root_is_dir', simp add:vd, simp+)+
−
            done +
−
          from dup_sfd a5 have "\<forall>fd. fd \<in> proc_file_fds s p \<longrightarrow> +
−
            cfd2sfd (Execve p f fds # enrich_proc s p p') p' fd = cfd2sfd s p fd"+
−
            apply (rule_tac allI)+
−
            apply (erule_tac x = fd in allE, clarsimp)+
−
            apply (drule set_mp, simp)+
−
            apply (auto simp:cfd2sfd_execve proc_file_fds_def a1)+
−
            done+
−
          hence "inherit_fds_check (Execve p f fds # enrich_proc s p p') (up, nr, nt) p' (fds \<inter> proc_file_fds s p)"+
−
            using grant os p1 p2 p3 vd+
−
            apply (clarsimp)+
−
            apply (rule_tac s = s and p = p and fds = fds in enrich_inherit_fds_check_dup)+
−
            apply simp_all+
−
            done+
−
          moreover have "search_check (Execve p f fds # enrich_proc s p p') (up, rp, tp) f"+
−
            using p1 p2 p2' vd cf2sf f_in f_in' grant p3 f_in a1+
−
            apply (rule_tac s = s in enrich_search_check)+
−
            apply (simp_all add:is_file_simps)+
−
            apply (rule allI, rule impI, erule_tac x = fa in allE, simp)+
−
            apply (drule_tac ff = fa in cf2sfile_other')+
−
            by (auto simp:a2 curf_pre)+
−
          ultimately show ?thesis +
−
            using p1' p2' p3+
−
            apply (simp split:option.splits)+
−
            using grant p1 p2+
−
            apply simp+
−
            done+
−
        qed+
−
        ultimately show ?thesis using a1+
−
          by (erule_tac valid.intros(2), auto)+
−
      qed+
−
    qed+
−
    moreover have "\<And>tp fds. \<lbrakk>valid (Clone tp p fds # s); p' \<noteq> p; p' \<notin> all_procs s\<rbrakk> \<Longrightarrow> +
−
      valid (Clone tp p' (fds \<inter> proc_file_fds s tp) # Clone tp p fds # s)"+
−
      apply (frule vt_grant_os, frule vt_grant, drule not_all_procs_prop3)+
−
      apply (rule valid.intros(2))+
−
      apply (simp_all split:option.splits add:sectxt_of_obj_simps)+
−
      apply (auto simp add:proc_file_fds_def)[1]+
−
      apply (auto simp:inherit_fds_check_def sectxt_of_obj_simps sectxts_of_fds_def inherit_fds_check_ctxt_def)+
−
      done+
−
    moreover have "\<And>f flags fd opt. \<lbrakk>valid (Open p f flags fd opt # enrich_proc s p p'); +
−
      is_created_proc s p; valid (Open p f flags fd opt # s); p' \<notin> all_procs s\<rbrakk>+
−
       \<Longrightarrow> valid (Open p' f (remove_create_flag flags) fd None # Open p f flags fd opt # enrich_proc s p p')"+
−
    proof-+
−
      fix f flags fd inum+
−
      assume a1: "valid (Open p f flags fd inum # enrich_proc s p p')" and a2: "is_created_proc s p"+
−
        and a3: "valid (Open p f flags fd inum # s)" and a4: "p' \<notin> all_procs s"+
−
      show "valid (Open p' f (remove_create_flag flags) fd inum # Open p f flags fd inum # enrich_proc s p p')"+
−
      proof (cases "+
−
        apply (rule_tac valid.intros(2))+
−
        apply (simp_all add:a1)+
−
+
−
+
−
+
−
+
−
+
−
      sorry +
−
    moreover have "\<And>fd. \<lbrakk>valid (CloseFd p fd # enrich_proc s p p'); is_created_proc s p; +
−
      valid (CloseFd p fd # s); p' \<notin> all_procs s; fd \<in> proc_file_fds s p\<rbrakk>+
−
      \<Longrightarrow> valid (CloseFd p' fd # CloseFd p fd # enrich_proc s p p')"+
−
    proof-+
−
      fix fd+
−
      assume a1: "valid (CloseFd p fd # enrich_proc s p p')" and a2: "is_created_proc s p" +
−
        and a3: "p' \<notin> all_procs s" and a4: "valid (CloseFd p fd # s)"+
−
        and a5: "fd \<in> proc_file_fds s p"+
−
      from a4 a3 have a0: "p' \<noteq> p" by (auto dest!:vt_grant_os not_all_procs_prop3)+
−
      have "p' \<in> current_procs (enrich_proc s p p')" +
−
        using a2 a3 vd+
−
        by (auto intro:enrich_proc_dup_in)+
−
      moreover have "fd \<in> current_proc_fds (enrich_proc s p p') p'"      +
−
        using a5 a2 a3 vd pre'+
−
        apply (simp)+
−
        apply (drule_tac s = "enrich_proc s p p'" and p = p' in file_fds_subset_pfds)+
−
        apply (erule set_mp)+
−
        apply (simp add:enrich_proc_dup_ffds)+
−
        done+
−
      ultimately show "valid (CloseFd p' fd # CloseFd p fd # enrich_proc s p p')"+
−
        apply (rule_tac valid.intros(2))+
−
        apply (simp_all add:a1 a0 a2 pre')+
−
        done+
−
    qed+
−
    ultimately show ?thesis using created_cons vd_cons all_procs_cons+
−
      apply (case_tac e)+
−
      apply (auto simp:is_created_proc_simps split:if_splits)+
−
      done+
−
  qed+
−
  moreover have "\<forall>obj. alive (e # s) obj \<longrightarrow> alive (enrich_proc (e # s) p p') obj"+
−
    sorry+
−
  moreover have "\<forall>obj. enrich_not_alive (e # s) obj \<longrightarrow> enrich_not_alive (enrich_proc (e # s) p p') obj"+
−
    sorry+
−
  moreover have "files_hung_by_del (enrich_proc (e # s) p p') = files_hung_by_del (e # s)"+
−
    sorry+
−
  moreover have "\<forall>p. p \<in> current_procs (e # s) \<longrightarrow> cp2sproc (enrich_proc (e # s) p p') p = cp2sproc (e # s) p"+
−
    sorry+
−
  moreover have "\<forall>f. f \<in> current_files (e # s) \<longrightarrow> cf2sfile (enrich_proc (e # s) p p') f = cf2sfile (e # s) f"+
−
    sorry+
−
  moreover have "\<forall>q. q \<in> current_msgqs (e # s) \<longrightarrow> cq2smsgq (enrich_proc (e # s) p p') q = cq2smsgq (e # s) q"+
−
    sorry+
−
  moreover have "\<forall>p fd f. file_of_proc_fd (e # s) p fd = Some f \<longrightarrow> +
−
    file_of_proc_fd (enrich_proc (e # s) p p') p fd = Some f"+
−
    sorry+
−
  moreover have "\<forall>p fd flags. flags_of_proc_fd (e # s) p fd = Some flags \<longrightarrow>+
−
        flags_of_proc_fd (enrich_proc (e # s) p p') p fd = Some flags"+
−
    sorry+
−
  moreover have "\<forall>q. msgs_of_queue (enrich_proc (e # s) p p') q = msgs_of_queue (e # s) q"+
−
    sorry+
−
  moreover have "\<forall>p fd. fd \<in> proc_file_fds (e # s) p \<longrightarrow> +
−
    cfd2sfd (enrich_proc (e # s) p p') p fd = cfd2sfd (e # s) p fd"+
−
    sorry+
−
  ultimately show ?case+
−
    by auto+
−
qed+
−
  +
−
+
−
lemma enrich_proc_valid:+
−
  "\<lbrakk>valid s; is_created_proc s p; p' \<notin> all_procs s\<rbrakk> \<Longrightarrow> valid (enrich_proc s p p')"+
−
by (auto dest:enrich_proc_prop)+
−
+
−
lemma enrich_proc_valid:+
−
  "\<lbrakk>valid s; is_created_proc s p; p' \<notin> all_procs s\<rbrakk> \<Longrightarrow> "+
−
+
−
+
−
    +
−