Proving full-system security properties under multiple attacker models on capability machines