Re: policy files and .Net Configuration tool?

From: Nicole Calinoiu (calinoiu)
Date: 06/12/05

  • Next message: ADITYA CHS: "ASP.NET Authuntication & Authorization" 
    Date: Sun, 12 Jun 2005 08:29:32 -0400

    "Christian" <Christian@discussions.microsoft.com> wrote in message
    news:3E57DC04-26E6-443A-B5BD-63A96C758F11@microsoft.com...
    > Thanks for clearing that up...
    >
    > That means that having policy files just make it able to have more
    > restrictions on assemblies running in IIS..
    >
    > I have a scenario where I just want to use CAS to make shure that the
    > calling assemblies are signed from me.. This means that I might as well
    > just
    > use the Configuration tool for this, right!

    Not sure about that. Usually one uses StrongNameIdentityPermission (or
    PublisherIdentityPermission, depending on what kind of signing you're using)
    demands for this. AFAIK, there's no way to set policy to prevent assemblies
    without a specified signature from calling into a given assembly.

    BTW, if you are thinking about using identity permissions demands for
    limiting callers, you should be aware that these are pretty trivially
    bypassed by highly/fully trusted code. In v. 1.x of the framework, this
    bypass requires deliberate action in most cases, but fully trusted code will
    automatically pass all identity permission demands in v. 2.0.

    >
    > Thangs again Nicole!
    > Regards
    > Christian
    >
    > "Nicole Calinoiu" wrote:
    >
    >> The policy established via the .NET configuration tools specifies the
    >> permission grants for all .NET assemblies run on the machine, not just
    >> those
    >> run via ASP.NET. ASP.NET adds another layer of policy that can be used
    >> to
    >> further restrict these permission grants. This policy is configured via
    >> the
    >> "policy files" to which you referred. Since this additional policy layer
    >> is
    >> applied by ASP.NET, it only affects applications run under ASP.NET.
    >>
    >>
    >>
    >> "Christian G." <Christian G.@discussions.microsoft.com> wrote in message
    >> news:525A3CE4-4B2B-4193-90D5-937E22A32B13@microsoft.com...
    >> > Code Access Security:
    >> > Can anybody tell me the different in using "policy files" referenced in
    >> > the
    >> > web.config file and setting up security in the ".Net Configuration
    >> > tool" ?
    >> >
    >> > Thanks in advance!
    >> > Christian
    >> >
    >>
    >>
    >>

  • Next message: ADITYA CHS: "ASP.NET Authuntication & Authorization"

    Relevant Pages

    • Re: HOWTO Install security with CASPOL for UserControls
      ... I stated that new assemblies would be added rapidly over ... It is possible to distribute policy modifications over a network by various ... grant additional permissions on top of existing custom policy, ... your controls) require unrestricted permissions on client machines. ...
      (microsoft.public.dotnet.security)
    • Re: Locking down CAS policy
      ... there are the assemblies located that get dynamically generated by asp.net ... Dominick Baier, DevelopMentor ... the Machine Policy. ... And the only thing i did to that was remove the code groups other than ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: Locking down CAS policy
      ... CAS policy has 3 levels - you are right that My_Computer in machine policy grants full trust - but there is another policy level called the appdomain level that is applied programmatically. ... You application doesn't even have enough permissions to read files (including assemblies) outside of the application directory ... put on the server that the app runs from, ... you shouldn't mock with the existing code groups - they grant the ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: Assembly could not be installed because existing policy would keep it from being used
      ... safe assemblies. ... Assembly 'MyAssembly' could not be installed because existing policy ... policies and they all seem to allow execution. ...
      (microsoft.public.sqlserver.security)
    • Re: Locking down CAS policy
      ... Dominick Baier, DevelopMentor ... CAS policy has 3 levels - you are right that My_Computer in machine ... read files (including assemblies) outside of the application ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Quantcast