Craig: removed category, added copyright template

2011-01-17T11:56:26Z

removed category, added copyright template

Craig: added backup link, tidied up formatting

2010-12-20T22:13:26Z

added backup link, tidied up formatting

Show changes

Admin: 2 revisions: import from developer.symbian.org

2010-12-18T16:04:14Z

2 revisions: import from developer.symbian.org

Satudahl at 11:46, 23 March 2010

2010-03-23T11:46:39Z

Satudahl: Created page with '=System Capabilities= {{Icode|Tcb}} Write access to executables and shared read-only resources Tcb allows write access to \sys and \resource directories. This is the most criti...'

2010-03-23T11:35:25Z

Created page with '=System Capabilities= {{Icode|Tcb}} Write access to executables and shared read-only resources Tcb allows write access to \sys and \resource directories. This is the most criti...'

New page

=System Capabilities=

{{Icode|Tcb}}

Write access to executables and shared read-only resources
Tcb allows write access to \sys and \resource directories. This is the
most critical capability as it allows write access to executables, which
contain the capabilities that define the security attributes of a process.
No third-party code should be allowed to do this. The TCB processes run
with at least this capability.

{{Icode|AllFiles}}

Read access to the entire file system and write access to other processes’
private directories

Similarly to Tcb, this capability is very strictly controlled and it is not
granted lightly. Nevertheless, phone manufacturers’ test software might
reasonably have it.

For instance, the backup and restore server might need it to backup
data on behalf of programs.

Unlike {{Icode|Tcb}}, {{Icode|AllFiles}} permits read and write in {{Icode|\private}}.

The system capability AllFiles can be used in the following
circumstances:
*By mobile phone manufacturers wishing to have a powerful shell or file manager. In this case, the user would be allowed to destroy or modify some servers’ private files. Symbian therefore highly discourages such a facility being made publicly available
*For test utilities to retrieve files in order to audit them to validate the behavior of a subsystem.

{{Icode|CommDD}}

Direct access to all communications equipment device drivers
This includes for example, WiFi, USB and serial device drivers.

{{Icode|DiskAdmin}}

Access to file system administration operations that affect more than
one file or directory (or overall file-system integrity and behavior, etc.)
This includes, for example, mounting and unmounting a drive partition.

{{Icode|Drm}}

Access to DRM-protected content

DRM agents use this capability to decide whether or not a program should
have access to protected content. Symbian OS trusts that software granted
Drm capability will respect the rights associated with this content.

{{Icode|MultimediaDD}}

Access to critical multimedia functions such as direct access to associated
device drivers and priority access to multimedia APIs

This includes sound, camera, video, etc.

{{Icode|NetworkControl}}

The ability to modify or access network protocol controls
Typically when an action can change the behavior of several existing and
future connections, it should be protected by NetworkControl.

For example, forcing all existing connections on a specific protocol to
be dropped or changing the priority of a call.

{{Icode|PowerMgmt}}

The ability to kill any process, to power-off unused peripherals and to
cause the mobile phone to go into stand-by, to wake up, or to power
down completely

Note that this doesn’t control access to anything and everything that
might drain battery power.

{{Icode|ProtServ}}

Allows a server process to register with a protected name
Protected names start with a ‘!’. The kernel will prevent servers without
ProtServ capability from using such a name, and, therefore, will prevent
protected servers from being impersonated. All servers in the TCE have
this capability.

{{Icode|ReadDeviceData}}

Read access to confidential network operator, mobile phone manufacturer
and device settings

Settings that are not confidential (such as the system clock) do not need
to be protected by this capability.
Examples of confidential device data include the list of installed
applications and the device lock PIN code.

{{Icode|SurroundingsDD}}

Access to logical device drivers that provide input information about
the surroundings of the mobile phone

Good examples of drivers that require this capability would be GPS
and biometrics device drivers. For complex multimedia logical device
drivers that provide both input and output functions, such as a sound
device driver, the MultimediaDD capability should be used where it is
impractical to separate the input from the output calls at its API level.

{{Icode|SwEvent}}

The ability to simulate key presses and pen input and to capture such
events from any program

Note that, when it has the user input focus, normal software does not
need SwEvent in order to be dispatched key and pen events.

{{Icode|TrustedUI}}

The ability to create a trusted UI session and, therefore, to display
dialogs in a secure UI environment

Trusted UI dialogs are rare. They must be used only when confidentiality
and security are critical: for instance for password dialogs.

Normal access to the user interface and the screen does not require this.
Code implementing a trusted UI dialog would need SwEvent capability.
Note that trusted UI dialogs are not implemented in Symbian OS v9.1.

{{Icode|WriteDeviceData}}

Write access to settings that control the behavior of the device
This setting is not always symmetrical with ReadDeviceData, i.e. just
because data important to maintaining the integrity of the system is
protected from being written, does not mean that it needs to be protected
against being read.

Examples of this type of setting are device lock settings, system time,
time zone, alarms, etc.

=User Capabilities=

{{Icode|LocalServices}}

Access to services over ‘short-link’ connections (such as Bluetooth or
infra-red). Such services will not normally incur cost for the user
The location of the remote service is assumed to be well known to
the user. A program with this capability can normally send or receive
information through a serial port, USB, IR and point-to-point Bluetooth
profiles. Examples of local services are synchronization of data with the
user’s PC, file transfer, etc. This capability does not allow use of IP or any
routable Bluetooth profiles, or spending of a user’s money by dialing a
telephone number.

{{Icode|Location}}

Access to data giving the location of the phone

This capability supports the management of a user’s privacy regarding the
mobile phone’s location.

{{Icode|NetworkServices}}

Access to remote services (such as over-the-air data services or Wi-Fi
network access), which might incur cost for the user
This capability allows access to a remote service without any restriction
on its physical location. Typically, this location is unknown to the user.
Voice calls, SMS and Internet services are good examples of such network
services. This capability controls access to services delivered via GSM,
CDMA and all IP transport protocols including IP over Bluetooth (‘PAN
profile’).

{{Icode|ReadUserData}}

Read access to confidential user data

This capability supports the management of a user’s privacy.

Typically contacts, messages and appointments are always seen as the
user’s confidential data. For other content, such as images or sounds,
there could be a choice to be made by the user.

{{Icode|UserEnvironment}}

Access to live data about the user and their immediate environment
This capability protects the user’s privacy.

Examples of services protected using this capability are audio, picture
and video recording, and biometrics (such as fingerprint) recording. Please
note that the location of the device is excluded from this capability and
is instead protected by using the dedicated capability Location.

{{Icode|WriteUserData}}

Write access to confidential user data

This capability supports the management of the integrity of user data.
Please note that this capability is not always symmetric with Read-
UserData. For instance, one might wish to prevent rogue software from
deleting music tracks but not wish to restrict read access to them.
Software developers creating programs (whether system servers or
applications) may use this capability to control access to their data when
it is stored in private directories.

It is not always obvious whether to treat data as confidential and the
choice will depend on the UI implementation.

← Older revision		Revision as of 11:56, 17 January 2011
Line 206:		Line 206:
	choice will depend on the UI implementation.		choice will depend on the UI implementation.

−	~~[[Category: Book]]~~	+	{{SymbianOSPlatformSecurity_Copyright}}

← Older revision	Revision as of 16:04, 18 December 2010
(No difference)

@@ Line 1: / Line 1: @@
 =System Capabilities=
@@ Line 200: / Line 202: @@
 It is not always obvious whether to treat data as confidential and the
 choice will depend on the UI implementation.

Symbian OS Platform Security/Appendix A: Capability Descriptions - Revision history

Craig: removed category, added copyright template

Craig: added backup link, tidied up formatting

Admin: 2 revisions: import from developer.symbian.org

Satudahl at 11:46, 23 March 2010

Satudahl: Created page with '=System Capabilities= {{Icode|Tcb}} Write access to executables and shared read-only resources Tcb allows write access to \sys and \resource directories. This is the most criti...'