Global Security Settings When Building a ROM Image

There are a number of platform security related settings that can be applied to a ROM image.

These settings are specified using keywords and appropriate values in the .oby and .iby files that are passed to rombuild.

Note that these keywords are interim, and apply from version Symbian OS v9.0. It is expected that such keywords will become redundant at some future date, and may be removed in a future version of Symbian OS.

Enabling the enforcement of platform security

The enforcement of platform security can be explicitly enabled or disabled when the ROM image is built. You do this by adding the platsecenforcement keyword into the .oby and/or .iby files that you pass to rombuild.

If platform security enforcement is enabled, then the appropriate action for a failed platform security check occurs.

If platform security enforcement is disabled, then the system behaves as though all platform security checks pass.

For the syntax, see the platsecenforcement keyword in the RomStatement in the rombuild obey file structure in Obey files.

Enforcing the location of binaries into the \Sys\Bin\ directory

You can configure the system to enforce the location of binary executables into the \Sys\Bin\ directory. You do this by adding the platsecenforcesysbin keyword into the .oby and/or .iby files that you pass to ROMBUILD.

If enforcement is enabled, then rombuild places all executables in Z:\Sys\Bin\, ignoring any file path specified in the .oby files. In addition, the loader will only look for files in, and load files from, the \Sys\Bin\ directory. The loader will ignore any other specified path.

If enforcement is disabled, then executables are placed in the location as defined by the file path in the .oby file.

For the syntax, see the platsecenforcesysbin keyword in the RomStatement in the rombuild obey file structure in Obey files.

Enabling process isolation

You can configure the system to disable insecure APIs inherited from EKA1. These are APIs whose use is intended to be restricted. The kernel provides run-time checks for their correct usage.

This is called process isolation and you enable it by adding the platsecprocessisolation keyword into the .oby and/or .iby files that you pass to rombuild.

For the syntax, see the platsecprocessisolation keyword in the RomStatement in the rombuild obey file structure in Obey files.

See also the list of APIs Affected by the platsecprocessisolation Keyword.

Enabling diagnostic messages

You can configure the system to enable or disable platform security diagnostic messages. You do this by adding the platsecdiagnostics keyword into the .oby and/or .iby files that you pass to rombuild.

If diagnostic messages are enabled, then a message may be emitted when a platform security check fails. Diagnostic messages are sent to the systems debug port, in the same way as the RDebug::Print() API. On reference hardware this debug port is usually one of the serial ports. On the Emulator it is sent to a file; the default name for this file is EPOCWIND.OUT in the Windows temporary directory.

If diagnostic messages are disabled, then no message is emitted when a platform security check fails.

For the syntax, see the platsecdiagnostics keyword in the RomStatement in the rombuild obey file structure in Obey files.