Re: Security Policy Confusion...

From: Nicole Calinoiu (calinoiu)
Date: 10/27/04 

Date: Wed, 27 Oct 2004 07:51:25 -0400

Permissions granted by code groups within a policy level are unioned, not
intersected, by default. This means that your assembly will be granted the
sum of all permissions permitted within the policy level, not the most
restrictive permissions defined by any single group. Since your assembly
presumably meets the membership condition for at least one other code group
(most likely My_Computer_Zone or LocalIntranet_Zone), it would be receiving
the execution permission from that other group.

To prevent permissions from other groups being granted to assemblies that
meet the membership conditions for your group, mark your group as exclusive
(see
http://msdn.microsoft.com/library/en-us/cpguide/html/cpconadministrationwithcodegroupattributes.asp
for details).

For an overview of how the .NET Framework computes a given assembly's
permissions based on policy, see
http://msdn.microsoft.com/library/en-us/cpguide/html/cpconcomputingallowedpermissionset.asp.

HTH,
Nicole

"DT" <dt@nospam.co.uk> wrote in message
news:417ec11a$0$87823$65c69314@mercury.nildram.net...
> Hi,
>
> In an effort to learn about the .NET security settings I tried a simple
> experiment. I created a noddy console application and assigned it a
> strong name. I then extracted the public key token from the assembly.
> This was all on my local disk. I then tried stop the console application
> be executed be giving it the permission set of 'Nothing' using the .NET
> configuration tool.
>
> Here are the steps I took
>
> 1) I created a new code group in the user code groups section under all
> code.
> 2) I then set the condition type to 'Strong Name' and supplied the token
> from my assembly.
> 3) I then set the permission set to 'Nothing'
>
> Once I'd completed this I tried to run the console application again, and
> it runs fine? I expected it to be denied execution rights?
>
> Can anybody help me in making sense of my mistakes / misunderstanding?
>
> Any url's to articles would be a great help!
>
> many thanks
>
> DT
>
>
>

Relevant Pages

  • Re: Security Policy Confusion...
    ... >Permissions granted by code groups within a policy level ...
    (microsoft.public.dotnet.security)
  • Re: Reason behind implicit FullTrust LinkDemand?
    ... The removal of permissions from the Internet Zone or the ... time to protect the System* assemblies from this attack. ... the security holes are patched. ... The knew the LinkDemand would be a fix. ...
    (microsoft.public.dotnet.security)
  • Reason behind implicit FullTrust LinkDemand?
    ... The .NET Framework assemblies ... One may counter argue that the implicit FullTrust ... LinkDemand just forces users to grant full trust to code that doesn't really ... permissions describing custom actions allowed or not in the system. ...
    (microsoft.public.dotnet.security)
  • Re: security/strong name/zones clarification needed
    ... Was this also true in the Intranet Zone? ... >child code-group with full permissions granted to any ... >> needs to host the CLR, it creates an AppDomain, but due ... All my assemblies are strong named. ...
    (microsoft.public.dotnet.security)
  • Re: security/strong name/zones clarification needed
    ... several but not publicly documented) about child code-group permissions ... a strong-name, or Authenticode signature evidence. ... This problem would also crop up in the AppDomain case also. ... All my assemblies are strong named. ...
    (microsoft.public.dotnet.security)