Re: Locking down CAS policy

Hi,

you shouldn't mock with the existing code groups - they grant the "ASP.Net" permission set to code running in you app dir and the temp assembly directory.

Without them your app won't be able to run...

thats the error you are seeing.

---
Dominick Baier, DevelopMentor
http://www.leastprivilege.com

I'm trying to lock down our company's CAS policy by using only Strong
Name membership conditions.

I've copied over our intranet to a development server and removed all
code groups except for one. It is all code using the nothing
permission set. I have three child code groups, the two default
(ECMA_Strong_Name and Microsoft_Strong_Name) and a group for our
strong name key. All of the child groups are set for FullTrust.

I've used the Evaluate Assembly utility to check the assemblies in the
application's bin directory and all report "unrestricted". However,
when i try to run the application i get "Server Application
Unavailable". I check the application event logs on the server and it
reports "Request for the permission of type
'System.Web.AspNetHostingPermission, System, Version=2.0.0.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089' failed." suggesting
that there is still an assembly that hasn't been granted FullTrust.

Is there maybe another assembly that is getting generated at runtime
that doesn't fit into one of the three code groups i have set up? Is
there a way to find out which assembly is failing?



.

Relevant Pages

  • Re: Locking down CAS policy
    ... they use the $AppDirUrl$ and $CodeGen$ url membership condition - if you want to base everything on strong name - you have to strong name all your pages, code behinds and App_Code files....this can be accomplished by modifying the element to specify a keyfile... ... you shouldn't mock with the existing code groups - they grant the ... "ASP.Net" permission set to code running in you app dir and the temp ... I've used the Evaluate Assembly utility to check the assemblies in ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Locking down CAS policy
    ... there are the assemblies located that get dynamically generated by asp.net ... Dominick Baier, DevelopMentor ... the Machine Policy. ... And the only thing i did to that was remove the code groups other than ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • CAS trust policy file conflict between appdomains
    ... I'm having this problem with SharePoint Portal Server 2003... ... is when I make my changes, assemblies in another web application that's a ... it inherit the parent's security policy. ... create a custom permission set with a WebPermission & specifying the URL ...
    (microsoft.public.dotnet.security)
  • Re: Sandboxing AppDomain
    ... here is a more comprehensive code sample: ... That's because creating a permission set from a name doesn't actually ... The policy for the restricted app domain should restrict the permissions ... of all assemblies other than the "conductor" assembly described in #1. ...
    (microsoft.public.dotnet.security)
  • Re: Security Policy Confusion...
    ... Permissions granted by code groups within a policy level are unioned, ... To prevent permissions from other groups being granted to assemblies that ...
    (microsoft.public.dotnet.security)