<?xml version="1.0" encoding="utf-8"?>

<!-- Copyright (c) 2007-2010 Nokia Corporation and/or its subsidiary(-ies) All rights reserved. -->

<!-- This component and the accompanying materials are made available under the terms of the License 

"Eclipse Public License v1.0" which accompanies this distribution, 

and is available at the URL "http://www.eclipse.org/legal/epl-v10.html". -->

<!-- Initial Contributors:

    Nokia Corporation - initial contribution.

Contributors: 

-->

<!DOCTYPE concept

  PUBLIC "-//OASIS//DTD DITA Concept//EN" "concept.dtd">

<concept id="GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03" xml:lang="en"><title>Security

issues</title><shortdesc>This topic explains the security issues while performing a publish

and subscribe.</shortdesc><prolog><metadata><keywords/></metadata></prolog><conbody>

<ul>

<li id="GUID-4BF55D37-742E-527F-9148-57C12164DA1C"><p> <xref href="GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03.dita#GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03/GUID-D2D0BDDF-28A4-5168-B1C5-685E1964C730">Who can define a property?</xref> </p> </li>

<li id="GUID-A06C7B43-30B8-5606-B22C-EBB18DBA7554"><p> <xref href="GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03.dita#GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03/GUID-839C5063-3BA1-52E6-BFFE-CF3E18E605EC">Read and write access rights</xref> </p> </li>

<li id="GUID-EC225F1D-0B9D-537F-BFC7-10EFBD6B44AE"><p> <xref href="GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03.dita#GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03/GUID-65107093-7C73-5117-88F7-CFB585455CE3">Deletion rights</xref> </p> </li>

</ul>

<section id="GUID-D2D0BDDF-28A4-5168-B1C5-685E1964C730"><title>Who can define

a property?</title> <p>One of the most important attributes of a property

is the category to which it belongs. A category is represented by a UID value. </p> <p>The

general rule is that the (category) UID must be the same as the Security ID

(the SID) of the process in which the code that is performing the define operation

is running. In effect, this forms a data cage, preventing a process from defining,

or "occupying", another process's property. </p> <p>You define a property

using the overload of <codeph>RProperty::Define()</codeph> with the signature: </p> <codeblock id="GUID-B33CDB93-7EB1-5276-B260-AEAB28227FA7" xml:space="preserve">static TInt Define(TUint aKey, TInt aAttr, const TSecurityPolicy&amp; aReadPolicy, const TSecurityPolicy&amp; aWritePolicy, TInt aPreallocate);</codeblock> <p>This function was introduced in V9.1 of Symbian platform, and it does <i>not</i> allow

you to explicitly specify the category. Indeed, Symbian platform takes the

category to be the value of the process SID. </p> <ul>

<li id="GUID-B4257761-359B-5027-93A0-9122EA0D5F21"><p> <xref href="GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03.dita#GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03/GUID-3EBCF236-E88A-5A50-A94E-37FABCD89633">The situation before Version 9.1</xref> </p> </li>

<li id="GUID-56A0BBD6-F844-5C5B-8789-A3DF806E7D26"><p> <xref href="GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03.dita#GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03/GUID-05EB14D2-6BA2-5199-A97A-9368AA581922">Migration issues</xref> </p> </li>

<li id="GUID-DF9B3F9D-C0A2-536D-BBAA-86FE218A4F21"><p> <xref href="GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03.dita#GUID-DAF86036-CC40-5F26-9F15-2F2093F59C03/GUID-D4FAE1D0-4610-5AAD-802B-62535C6C11BB">Notes</xref> </p> </li>

</ul> <p id="GUID-3EBCF236-E88A-5A50-A94E-37FABCD89633"><b>The situation before Version

9.1</b> </p> <p>Before version 9.1 of Symbian platform, you had to explicitly

define a category using the overload of <codeph>RProperty::Define()</codeph> with

the signature: </p> <codeblock id="GUID-0D193896-AB7B-5787-A92C-2CB214C16496" xml:space="preserve">static TInt RProperty::Define(TUid aCategory, TUint aKey, TInt aAttr, const TSecurityPolicy&amp; aReadPolicy, const TSecurityPolicy&amp; aWritePolicy, TInt aPreallocate)</codeblock> <p>This function was introduced in V9.0 of Symbian platform. </p> <p>It

was also possible to specify a category, known as the system category, which

was reserved for system services. This category was identified by the <xref href="GUID-A85740BD-BC85-345E-B24A-92F68EA56270.dita"><apiname>KUidSystemCategoryValue</apiname></xref> UID;

a process required the <i>WriteDeviceData</i> capability, (<xref href="GUID-C607209F-6FC5-31DE-8034-E5B799B857A8.dita"><apiname>ECapabilityWriteDeviceData</apiname></xref>),

to use it. </p> <p>This overload is still available, but from V9.1 there are

restrictions that govern its use, and it is recommended that, if possible,

users of Property & Subscribe services should migrate to using the version

of <codeph>RProperty::Define()</codeph> that does not require the category

to be specified. </p> <p id="GUID-05EB14D2-6BA2-5199-A97A-9368AA581922"><b>Migration issues</b> </p> <p>Processes

that use the 9.0 version of <codeph>RProperty::Define()</codeph> must now

have the <i>WriteDeviceData</i> capability to define a property with an explicitly

specified category (including the system category), <i>provided that the SID

of the process is less than the value</i> <xref href="GUID-4A67D011-CBB6-396F-8104-7B3BECB84460.dita"><apiname>KUidSecurityThresholdCategoryValue</apiname></xref>. </p> <p>A

process that has a SID value <i>greater</i> than <xref href="GUID-4A67D011-CBB6-396F-8104-7B3BECB84460.dita"><apiname>KUidSecurityThresholdCategoryValue</apiname></xref>  <i>cannot

explicitly specify a category</i>. This is an absolute rule that cannot be

overridden regardless of the capabilities assigned to that process. </p> <p>The

logic here is that all new <filepath>.exe</filepath> s require a SID to be

assigned, and that this value will be greater than <xref href="GUID-4A67D011-CBB6-396F-8104-7B3BECB84460.dita"><apiname>KUidSecurityThresholdCategoryValue</apiname></xref>.

This means that an associated process is forced to define properties with

category values that are the same as the process SID. Older <filepath>.exe</filepath> s

are expected to have SID values that are less than <xref href="GUID-4A67D011-CBB6-396F-8104-7B3BECB84460.dita"><apiname>KUidSecurityThresholdCategoryValue</apiname></xref>,

and means that an associated process can continue to explicitly specify a

category, using the 9.0 version of <codeph>Define()</codeph>, but must have

the <i>WriteDeviceData</i> capability. </p> <p>Ideally, all older <filepath>.exe</filepath> s

should be migrated to use the 9.1 version of <codeph>Define()</codeph>. </p> <p>The

following diagram shows the "category space". </p> <fig id="GUID-ADCDE30C-7D9C-588D-9058-E5491AB626F3">

<image href="GUID-442D216B-117E-538C-A51F-0775BF37673E_d0e244320_href.png" placement="inline"/>

</fig> <p>The <xref href="GUID-4A67D011-CBB6-396F-8104-7B3BECB84460.dita"><apiname>KUidSecurityThresholdCategoryValue</apiname></xref> value

effectively forms a <i>threshold</i> value. Processes with a SID value below

this threshold can define a category that is different from their SID, provided

they have the <i>WriteDeviceData</i> capability. Processes with a SID value

above this threshold value can only define a category that is the same as

the SID - regardless of capability. </p> <p id="GUID-D4FAE1D0-4610-5AAD-802B-62535C6C11BB"><b>Notes</b> </p> <p>When we

refer to the SID of the process, we also mean the SID value assigned to the

associated <filepath>.exe</filepath> installed on the device. By older or

younger processes, we are referring to the age of the associated executables. </p> </section>

<section id="GUID-839C5063-3BA1-52E6-BFFE-CF3E18E605EC"><title>Read and write

access rights</title> <p>Access rights to a property are set when the property

is defined. </p> <p>The process defining the property can specify the rights

of access to that property. In particular, it can specify a security policy

to control read access (i.e. retrieval of the property) and a separate security

policy to control write access (i.e. publication of the property). </p> <p>Access

to a property is governed by a pair of security policies, instances of <xref href="GUID-81A285F6-3F87-3E77-9426-61BB16BC7109.dita"><apiname>TSecurityPolicy</apiname></xref> objects.

These define the combination of capabilities and/or vendor Id and/or Secure

Id that a process must possess before being allowed to write to, or read from,

a property. Any attempt to access a property by a thread whose owning process

does not have sufficient capability, will fail with <codeph>KErrPermissionDenied</codeph>. </p> <p>The

security policies are passed to the <xref href="GUID-C4776034-D190-3FC4-AF45-C7F195093AC3.dita#GUID-C4776034-D190-3FC4-AF45-C7F195093AC3/GUID-58C54D2A-91E0-359B-AA31-69C6C4050173"><apiname>RProperty::Define()</apiname></xref> function

when the property is defined. </p> </section>

<section id="GUID-65107093-7C73-5117-88F7-CFB585455CE3"><title>Deletion rights</title> <p>Only

the owning process, i.e. the process that defined the property, is allowed

to delete that property. </p> </section>