RE: CAS, No Touch Deployment and Flags="UnmanagedCode"

From: Shawn Farkas [MS] (shawnfa_at_online.microsoft.com)
Date: 12/30/04 

Date: Thu, 30 Dec 2004 18:57:07 GMT

Hi Greg,

Try using caspol -rsg <your assembly> to figure out what code groups are
being matched. That will be the first step toward debugging this problem.

-Shawn

-Shawn
http://blogs.msdn.com/shawnfa
--
This posting is provided "AS IS" with no warranties, and confers no rights.
 

Note:
For the benefit of the community-at-large, all responses to this message
are best directed to the newsgroup/thread from which they originated.
--------------------
> From: "Greg Robinson" <greg@cds-am.net>
> Subject: CAS, No Touch Deployment and Flags="UnmanagedCode"
> Date: Wed, 22 Dec 2004 11:57:59 -0500
> Lines: 42
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Newsreader: Microsoft Outlook Express 6.00.2900.2180
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
> X-RFC2646: Format=Flowed; Original
> Message-ID: <#J1lkdE6EHA.3120@TK2MSFTNGP12.phx.gbl>
> Newsgroups: microsoft.public.dotnet.security
> NNTP-Posting-Host: uslec-66-255-38-123.cust.uslec.net 66.255.38.123
> Path:
cpmsftngxa10.phx.gbl!TK2MSFTFEED02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12
phx.gbl
> Xref: cpmsftngxa10.phx.gbl microsoft.public.dotnet.security:8533
> X-Tomcat-NG: microsoft.public.dotnet.security
>
> We No Touch Deploy our assemblies from a web server. So, our app runs
from
> the download cache.
>
> We have a custom URL code group on each machine with FullTrust.
>
> On the web server, our assemblies are stored in a folder called, lets say
> "Folder1". The code url condition type points to the web server\Folder1.
> The permission set is FullTrust.
>
> All works well.
>
> Today, I created a new web folder, call it "Folder2" and copied all of
the
> assemlbies in "Folder1" to "Folder2".
>
> I created a new code group, FullTrust, different URL (points to Folder2).
>
> When deploying our assemblies from Folder2, I am getting a CAS exception
> inside one of the download assemblies:
>
> The state of the failed permission was:
> <IPermission class="System.Security.Permissions.SecurityPermission,
> mscorlib, Version=1.0.5000.0, Culture=neutral,
> PublicKeyToken=b77a5c561934e089"
> version="1"
> Flags="UnmanagedCode"/>
>
> I think this is happening on a p/invoke API call.
>
> My question is why does this work from one web folder and not another,
when
> they contain the exact same assemblies and the client has FullTrust for
both
> URLs?
>
> If I
> CASPOL -s off
>
> all works fine. So, I know it's a CAS issue, but why?
>
>
>
>
>
>
>

Relevant Pages

  • Re: Compile to GAC from VS
    ... Security Policy (CASPOL) to avoid GACing your dlls. ... have never have to delete my Shadow Copy folder to read latest build. ... Whenever I have the problems you mentioned, I click it and all assemblies ...
    (microsoft.public.vsnet.vstools.office)
  • Re: Locking down CAS policy
    ... they use the $AppDirUrl$ and $CodeGen$ url membership condition - if you want to base everything on strong name - you have to strong name all your pages, code behinds and App_Code files....this can be accomplished by modifying the element to specify a keyfile... ... you shouldn't mock with the existing code groups - they grant the ... "ASP.Net" permission set to code running in you app dir and the temp ... I've used the Evaluate Assembly utility to check the assemblies in ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Locking down CAS policy
    ... you shouldn't mock with the existing code groups - they grant the "ASP.Net" permission set to code running in you app dir and the temp assembly directory. ... I've used the Evaluate Assembly utility to check the assemblies in the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Locking down CAS policy
    ... there are the assemblies located that get dynamically generated by asp.net ... Dominick Baier, DevelopMentor ... the Machine Policy. ... And the only thing i did to that was remove the code groups other than ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Security Policy Confusion...
    ... Permissions granted by code groups within a policy level are unioned, ... To prevent permissions from other groups being granted to assemblies that ...
    (microsoft.public.dotnet.security)