dotnet security: Enabling App Domain Policy to run an executable -- dotnet security

You're in the

dotnet security

group:

Enabling App Domain Policy to run an executable

Jason Collum
8/30/2004 12:51:26 PM

dotnet security: I have looked over the internet and found some code to create an application
domain policy, create a permission set based on "LocalIntranet", add
additional permissions, union membership conditions with the permission set,
and try to execute another application. My code can be found below. Even
after giving the FileIOPermission unrestricted access to the app domain
policy, the other application is still throwing the securityexception
because the FileIOPermission failed. Can someone please shed some light on
why this is happenning and maybe help me figure out how to get it to work?

Code Example:
namespace ApplicationLauncher
{
class Launch
{
static void Main (string[] args)
{
if (args.Length < 1)
{
System.Console.WriteLine("Usage: Launch <assembly>");
return;
}

string fileName = args[0];

System.AppDomain ad = System.AppDomain.CreateDomain("AppLaunch");

System.Security.Policy.PolicyLevel domainPolicy =
System.Security.Policy.PolicyLevel.CreateAppDomainLevel();

System.Security.Policy.AllMembershipCondition allCodeMC = new
System.Security.Policy.AllMembershipCondition();
System.Security.PermissionSet internetPermissionSet =
domainPolicy.GetNamedPermissionSet("LocalIntranet");
System.Security.Policy.PolicyStatement internetPolicyStatement = new
System.Security.Policy.PolicyStatement(internetPermissionSet);

System.Security.Policy.CodeGroup allCodeInternetCG = new
System.Security.Policy.UnionCodeGroup(allCodeMC, internetPolicyStatement);
domainPolicy.RootCodeGroup = allCodeInternetCG;
ad.SetAppDomainPolicy(domainPolicy);

string[] newArgs = new string[args.Length-1];
System.Array.Copy(args, 1, newArgs, 0, args.Length-1);
ad.ExecuteAssembly(fileName, null, newArgs);
}
}
}

Re: Enabling App Domain Policy to run an executable

Jason Collum
8/30/2004 4:32:33 PM

What if I changed the line of code to look like the following?

System.Security.Policy.PolicyStatement internetPolicyStatement = new
System.Security.Policy.PolicyStatement(internetPermissionSet);

System.Security.Policy.PolicyStatement internetPolicyStatement = new
System.Security.Policy.PolicyStatement(internetPermissionSet,
System.Security.Policy.PolicyStatementAttribute.All);

Thank you for your time.

[quoted text, click to view]
cpmsftngxa10.phx.gbl!TK2MSFTNGXA06.phx.gbl!cpmsftngxa06.phx.gbl!TK2MSFTNGP08
..phx.gbl!TK2MSFTNGP09.phx.gbl
[quoted text, click to view]

RE: Enabling App Domain Policy to run an executable

shawnfa NO[at]SPAM online.microsoft.com (
8/30/2004 8:52:58 PM

Hi Jason,

The code you posted below looks correct to me. One thing that you might be running into is that the permission grant at each policy level
are calculated seperately, and then intersected together to get the final grant. This means that you cannot use AppDomain policy to elevate an
assembly's permissions above and beyond what the machine policy would have given anyway. My first guess is that this is your problem.

-Shawn
http://blogs.msdn.com/shawnfa

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Note: For the benefit of the community-at-large, all responses to this message are best directed to the newsgroup/thread from which they
originated.
--------------------
[quoted text, click to view]

Re: Enabling App Domain Policy to run an executable

shawnfa NO[at]SPAM online.microsoft.com (
8/31/2004 7:20:10 PM

If I was correct in my guess in the last post, then you'll still run into the same problem. There's no way to use a policy level to elevate permissions
beyond what other levels allow. AppDomain policy is best use to sandbox assemblies into a permission set lower than what the machine
permission set is currently allowing them.

-Shawn
http://blogs.msdn.com/shawnfa

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Note: For the benefit of the community-at-large, all responses to this message are best directed to the newsgroup/thread from which they
originated.
--------------------
[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the dotnet security group.

home · blog · groups

Questions? Comments? Contact the dn