Modifying a CDS Security Architecture

Double click on a system in the Framework Navigator to open the graphical editor. Initially the editor will be blank and the palette will be on the right.

Creating domains, resources and entrypoints

To create a CDS security architecture item click once on the item in the palette. Click a second time in the editor to create a new item of the selected type. The mouse pointer in the editor will change to indicate what action is available at the time. The pointer will change into an 'X' when it is over an area in the editor where the selected item can not be created. For example if the selected tool is a 'Base Domain' and the mouse is over an existing domain, the pointer will be an 'X' because a base domain can not be created as a sub-domain of an existing domain. In addition if the pointer is over a domain in the editor, the domain will be highlighted to indicate the new item will be created as a child of that domain.

Note that:

Base Domain, Base Resource, Network Resource, and User Domain items only can be created as top level items.
Domain, Resource and Entrypoint items can be created both at the top level and as child items.
Only domain items can have children.
Control Resources must be attached to a domain. To create a control resource, first select the control resource tool, then click on the domain to attach the control resource and click the mouse again.
Domains with control resources can not have children, so if a domain has children a control resource can not be attached.

Granting access

To grant access, select the access tool. Click on the source domain or resource, then click on the target domain or resource. By default, the selection of the source and target will define the type of access,ie., if the access is a read or write, but this can be changed using the properties view. To grant access from an outer resource to a domain that is a child of another domain, create the access directly from the outer resource to the inner domain and the correct accesses will be granted. The default access definitions will be set automatically and can be changed using the properties view.

Transitioning domains

An entrypoint and enter are used to transition to a different domain when a new process is started. The entrypoint is the executable used to start the new process and must be created before the enter can be created.

To specify transition from one domain to another, select the enter tool. Click on the source domain and then click on the target domain. A dialog will display prompting for the entrypoint to use for the transition. The default enter definition will be set automatically and can be changed on the properties view.

Deleting items

To delete an item from the security architecture select the item and press the 'Delete' key on the keyboard or right click and select the 'Delete' option. There is complete undo/redo functionality so any operation can be undone if it was a mistake.