Metadata Validity Rules

Metadata Validity Rules

A record of the DeclSecurity metadata table has three entries: Action, the security action code; Parent, the metadata item to which the security record is attached; and PermissionSet, the blob containing the XML descriptor of the permission set. The metadata validity rules for the DeclSecurity metadata records are as follows:

• [run time] The Action entry must hold a valid security action code in the range 0x1 through 0xF.

• The Parent entry must hold a valid reference to the Assembly, TypeDef, or Method tables.

• If the Parent entry references a TypeDef record, this record must not define an interface.

• If the Parent entry references a TypeDef or Method record, the metadata item referenced in the Parent entry must have its respective HasSecurity flag set (0x00040000 for TypeDef records, 0x4000 for Method records).

• [run time] The PermissionSet entry must hold a valid offset in the #Blob heap. The blob at this offset must contain a legal XML representation of the permission set, Unicode-encoded.