Help me to understand Code Access Security. I don't get it. -- dotnet security

serge calderara
10/9/2006 11:39:02 PM

hi,

CAS has been introduced in order to offer the possibility to fine tune
access to ressources by your application in order to give it only the
necessary rights to prevent potential hacking..
CAS has a wide range of possibilities. for instance you are able to protect
the xecution of certain function in your code that is allowed to ruin only if
you are under a certain group.

CAS offer also the possibility to refuse to run an assembly if it does not
have a minimum of permission. For instance imagine that your asssembly need
to access to a File on the system, then it needs to get the fileIo
permission. If this permision is not set when you execute your assembly it
will not run.

CAS policy offer also the possibility to set some predifines security rules
depending on where you code is executed. Internet or Local machine. YOu can
check those groups from the CAS configuration tools in control panel.

Remember one think is that CAS come on top of NTFS rights, which means that
you cannot allow with CAS the rights to delete a file if the current logon
right prevent for it.

This is just a breif idea, but theire is a lot more which cannot details all
here.

Hope it helps s bit
Regards
serge

[quoted text, click to view]

Dominick Baier
10/10/2006 12:00:00 AM

IMO the best book ever about CAS was ".NET Framework Security" by Brian LaMachia
et al.

Unfortunately it is out of print now - but you may be able to find a used
copy...

---
Dominick Baier, DevelopMentor
http://www.leastprivilege.com

[quoted text, click to view]

serge calderara
10/10/2006 2:37:01 AM

i am actually using the MS press book to prepare my exam and I have to say
that they make great effort on this one...reaaly nice content and clear
example

[quoted text, click to view]

Dominick Baier
10/10/2006 1:01:30 PM

then you haven't seen the one i am talking about ;)

---
Dominick Baier, DevelopMentor
http://www.leastprivilege.com

[quoted text, click to view]

David++
10/12/2006 2:58:01 AM

[quoted text, click to view]

Hi Ken,

I've been recently having to delve into CAs issues. I believe, in my only
recently and quickly acquired knowledge, that security access in .NET is now
issued by means of what is known as 'Code Access security'. In other words,
in your .NET developed assemblies there will likely be 'parts of the code'
which require Security Permissions to operate. In other words, you could have
a Windows Form app which resides on a network share, one function in the app
may write a file to the share, thus requiring FileIO functionality, if this
permission (FileIO Permission) hasnt been granted to the assembly, then a
security exception will be raised, i.e. 'a part of the code just tried to do
something it wasnt allowed to do i.e write a file to the network.

I find the main problem with this heightened security (although it is there
to protect us of course) is to choose the best way in which to apply the
policies. Something which I intend to ask about in a post in a second or
two...

HTH in some ways,

David

Glenn
10/16/2006 4:00:49 PM

Ken

I too was lost until I found this MSDN webcast by Juval Lowy.

http://msdn.microsoft.com/security/understanding/webcasts/default.aspx

I remember someone at MS UK, a couple of years ago during a seminar on
ASP.NET security, mentioning CAS was one of the least under stood parts of
..NET.

Once you get the concepts it's pretty straightforward.

HTH

Glenn

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about dotnet security

dotnet security : Help me to understand Code Access Security. I don't get it.