Re: Can an Assembly INCREASE the permissions granted to it at run-time.

From: Joe Kaplan \(MVP - ADSI\) (joseph.e.kaplan_at_removethis.accenture.com)
Date: 03/23/04 

Date: Tue, 23 Mar 2004 16:45:03 -0600

You cannot get more permissions than you are granted.

You can decrease the permissions you are granted and you can use stack walk
modifiers such as Assert. Assert is used in the scenario when your code has
permissions to do something, but the calling assembly does not, and you want
to prevent the stack walk into their assembly where the demand will fail.
So, this allows code in the trusted assembly to do things that the program
as a whole may not be able to do.

You still need permissions to do the restricted thing and you need
permission to call Assert in this case, so you can't elevate your
permissions.

However, you do have to be careful of luring attacks with things like
Assert. Since you are doing something trusted and potentially allowing
upstream callers to call you without having the same permission, it is now
your responsibility to ensure that your code is called in a safe way.

The way you'll see the framework itself do this is that it often calls into
unmanaged code for certain services, but demands a different permission of
the calling assembly to get to that function.

Another thing to remember is that you are still always limited by the
Windows permissions that the code is running under too, so you can never
exceed those restrictions. CAS restricts further the permissions of the
code and changes the way permissiosn are granted so that they are based on
information about the code itself and not the user running the code.

HTH,

Joe K.
"Novice" <6tc1@qlink.queensu.ca> wrote in message
news:b80e4a77.0403231351.24fa189c@posting.google.com...
> I have been reading about .NET security off and on for about a month
> now and I'm a bit confused by this excerpt from one document I was
> reading.
>
> The document concerns the grant set that is given to an assembly when
> it is loaded by the CLR. The statement is:
> The code itself can use a permission request to influence the
> permissions that are granted.
>
> I can understand how the code could DECREASE the permission set that
> is granted to it (through the use of imperative or declarative
> security checks), but I have no idea how code could request increased
> permissions.
>
> For example, I have a test application that writes a blank file to a
> directory (c:\temp) on my machine. If I give that assembly full trust
> it will
> write the file to my directory even if it is being accessed over the
> internet. However, if I don't "trust" the assembly, it will not be
> able to write the file to that directory. And I don't know of anyway
> that I could code the assembly such that it could request additional
> permissions at run-time. If this were possible I would imagine it
> would take the form of the user being presented with a dialog box that
> says something like:
>
> Currently this application does not have permission to write to
> "c:\temp" - do you wish to give this applicatin that permission?
>
> Is there a way to do this?
>
> Thanks,
> Novice

Relevant Pages

  • RE: SecurityException "Request Failed"
    ... >LinkDemand extremely likely to fail. ... >>Does the invoked method have all the asserted permissions ... The stack walk will hit your assert, ...
    (microsoft.public.dotnet.security)
  • Re: CAS newbie
    ... It appears that you may need to assert more than ... If you are impersonating, then you will likely need to implement Kerberos ... Joe Kaplan-MS MVP Directory Services Programming ... code group to give full trust permissions to that dll. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Security Settings to load Winform using unmanaged code in IE?
    ... try removing assembly declarations and see ... This posting is provided "AS IS" with no warranties, and confers no rights ... > The comment on Assert is important when insecure code is called - My ... > code DOES Assert privieleges when permissions are required. ...
    (microsoft.public.dotnet.security)
  • Re: enumerate runtime permissions
    ... That's a creative way to figure out my permissions! ... going to try to assert all permissions, and obviously the runtime would not ... >> new application domain and wanted for it to print out its grant set, ... > the grant set. ...
    (microsoft.public.dotnet.security)
  • Re: Remoting from a control hosted in IE
    ... Asserting permissions almost certainly won't help with this, ... and client (the control) subscribes to this event. ... > but what permissions and where do I assert them - I have no clue. ... An error occurred while processing the request on ...
    (microsoft.public.dotnet.security)