Security Policy, Code Groups and Security Tools.

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Mark Broadbent (no-spam-please_at_no-spam-please.com)
Date: 05/20/04 

Date: Thu, 20 May 2004 18:45:00 +0100

Could someone who has active experience of assigning Security Policys please
clarify my follow comments...

Having gone through the MSDN documentation on this subject, my condensed
version of the way the security code permissions works is thus :-

1. An Assembly will be mapped to one or more Code Groups based upon the
membership conditions specified within each code group.

2. When an assembly belongs to multiple code groups, permissions assigned by
one code group can be overridden (increased) by permissions assigned by
another code group when they are both part of the same Policy level.

3. Code groups from a lower policy level cannot override (increase)
permissions set by an upper level (apart from when the permission hasnt yet
been set) *but* can reduce them.

4. The user policy level code groups cannot grant additional permissions to
an assembly *but* can only reduce them further.

5. When the Exclusive attribute is used on a code group, the code group will
become the only one within that policy level to apply permissions, although
the further policy levels code groups will be evaluated. When an application
belongs to more than one Exclusive code group it will not be run.

6. When the Level Final attribute is used on a code group, no other policy
levels code groups are evaluated *although* the current policy levels code
groups will.

7. When Level Final and Exclusive are used together then the codegroup on
that level will be the only one that will apply to the application through
all policy levels.

Couple of points.
a. Firstly is there any reason that the code groups are / can be nested,
from what I can see the answer is no -although I am assuming that it allows
for a more specific targetting of conditions.
b. Since the default Enterprise code group is All_Code -Full Trust and
changing it could effectly cause problems with the framework, I assume this
is left alone. Because this code group would override any additional code
groups within this policy, I am assuming that all Enterprise level code
groups should be marked as Exclusive.
c. Does Caspol utility expose any additional functionality than mscorcfg
utility (apart from the ability to do scripted config)?

Thanks in advance 

-- 
Br,
Mark Broadbent
mcdba , mcse+i
=============

Relevant Pages

  • Security Policy, Code Groups and Security Tools.
    ... membership conditions specified within each code group. ... When an assembly belongs to multiple code groups, permissions assigned by ... another code group when they are both part of the same Policy level. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: CAS Policy issue
    ... If enterprise-specified CAS restrictions are set at the enterprise policy level, neither the machine nor user levels will be able to override the restrictions to grant additional permissions. ... Any given code group can be marked as exclusive, which will prevent code that meets the code group membership conditions from being granted any additional permissions via other groups. ... I'd really like the option to prevent the control from loading at child B level, but it seems with child C full trust, this is not possible. ... If you're trying to troubleshoot CAS permission problems, I'd recommend resetting your CAS policy. ...
    (microsoft.public.dotnet.security)
  • Re: Problem with security
    ... Thanks but i set the exlusive attribute to the code group and it still ... didn't throw any security exception. ... granted (the the permissions granted at each policy level - machine, user, ...
    (microsoft.public.dotnet.framework)
  • Re: Creating code groups | Setup project
    ... add a class lib to the installer project - and include its primary output ... throw new ApplicationException("Failed to find the machine policy ... // add our named permission set to the machine policy level ... // now we need to create a code group that matches all assemblies ...
    (microsoft.public.dotnet.security)
  • Re: assign permission set
    ... policy it does so at some risk. ... If an msi install will work for you, ... The .NET Framework Configuration tool generates a Microsoft installer ... >> code shows how to programmatically replace the trusted zone code group. ...
    (microsoft.public.dotnet.security)