RE: Can an Assert issued following a Deny override it?

From: Novice (6tc1ATqlinkDOTqueensuDOTca)
Date: 08/24/04 

Date: Tue, 24 Aug 2004 11:23:04 -0700

I have tried this and it is the case, that a fully trusted assembly can use
an assert after a fully trusted assembly (higher up in the call stack) has
issued a Deny on a particular permission (like FileIO for example).

However, I still don't know how to configure my security policy such that I
restrict the ability of an assembly to use the Assert method.

Any suggestions???

Thanks,
Novice

"Novice" wrote:

> Another poster wrote:
> ------------------
> Additionally, assuming I have FullTrust, and I write the .dll that doesn't
> have correct public key (so you try to block me from the file), all I have to
> do is do an Assert on that permission, and the Assert will be found in the
> callstack before your deny, allowing me access to the directory.
> ------------------
> Is it the case that you can override an existing Deny that my application has
> already specified?
>
> I.E. if I write an application and the first line of code I put is a "Deny"
> on File IO to the C drive and then I invoke code (exp a method) in your
> assembly - you can subsequently write an Assert that will override the Deny
> that has already been processed (and yes this assumes your assembly has full
> trust)?
>
> Thanks,
> Novice
>
> PS If the above is true - what permission in .Net would stop someone from
> being able to override a previously issued Deny?

Relevant Pages

  • Re: Identity Permission and Code Access Permission classes
    ... since the security check will hit the assert before it hits the deny. ... Identity Permission and Code Access Permission classes ... >>>> if it had the above PublicKey. ...
    (microsoft.public.dotnet.security)
  • Can an Assert issued following a Deny override it?
    ... do is do an Assert on that permission, and the Assert will be found in the ... Is it the case that you can override an existing Deny that my application has ... on File IO to the C drive and then I invoke code in your ...
    (microsoft.public.dotnet.security)
  • Re: Identity Permission and Code Access Permission classes
    ... do is do an Assert on that permission, and the Assert will be found in the ... Are you saying you can override an existing Deny that my application has ... Note also, that stack walk modifiers do not discriminate between different kinds of code, if you do a Deny for that FileIO permission, no ...
    (microsoft.public.dotnet.security)
  • RE: Can an Assert issued following a Deny override it?
    ... Can an Assert issued following a Deny override it? ... >on File IO to the C drive and then I invoke code in your ...
    (microsoft.public.dotnet.security)
  • Re: AppDomain and SecurityPermission
    ... In practice, Deny just stops the stackwalk, but it does not change the assembly grant set [and assembly can assert everything that it was granted]. ... > I want to make sure that an assembly I load into a AppDomain i create can't ...
    (microsoft.public.dotnet.security)