none
calling fully trusted assembly from a restricted appdomain

    Question

  • hi, here is what i have.

    MainApp using Screen (untrusted code), ServiceProvider (trusted code)

    while mainApp has to access io operation, i dont want Screen does unles it is using the trusted code (ServiceProvider).

    i couldnt get it work, any ideas?

    (restricted appdomain couldnt use trusted call)

    thx

    output:

    Screen
    Request for the permission of type 'System.Security.Permissions.FileIOPermission
    , mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' f
    ailed.
       at System.Security.CodeAccessSecurityEngine.Check(Object demand, StackCrawlMa
    rk& stackMark, Boolean isPermSet)
       at System.Security.CodeAccessPermission.Demand()
       at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, I
    nt32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions o
    ptions, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)
       at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access,
    FileShare share, Int32 bufferSize, FileOptions options)
       at System.IO.StreamWriter.CreateFile(String path, Boolean append)
       at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encodin
    g, Int32 bufferSize)
       at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encodin
    g)
       at System.IO.File.AppendAllText(String path, String contents, Encoding encodi
    ng)
       at System.IO.File.AppendAllText(String path, String contents)
       at ServiceProvider.Service.callService(String serviceName)


    this is main assembly:

    namespace MainApp
    {
        class Program
        {
            static void Main(string[] args)
            {
                try
                {
                    String pathToUntrusted= @"..\..\..\Screen\bin\Debug";
                    PermissionSet permissions = new PermissionSet(PermissionState.None);
                    permissions.AddPermission(new SecurityPermission(SecurityPermissionFlag.Execution));
                    PolicyStatement executeOnlyStatement = new PolicyStatement(permissions);            
                    UnionCodeGroup applicablePolicy = new UnionCodeGroup(new AllMembershipCondition(), executeOnlyStatement);
                    AppDomainSetup appDomainSetup = new AppDomainSetup();
                    appDomainSetup.ApplicationBase = Path.GetFullPath(pathToUntrusted);
                    AppDomain appDomain = AppDomain.CreateDomain("ScreenDomain", null, appDomainSetup);                
                    PolicyLevel policy = PolicyLevel.CreateAppDomainLevel();
                    policy.RootCodeGroup = applicablePolicy;
                    appDomain.SetAppDomainPolicy(policy);
                    IScreen screen = (IScreen)appDomain.CreateInstanceAndUnwrap("Screen", "Screen.Screen");
                    screen.OnLoad();
                    Console.ReadKey();
                    ServiceProvider.Service.callService("MainApp");
                    AppDomain.Unload(appDomain);
                }
                catch (Exception e)
                {
                    Console.WriteLine(e.Message);
                    Console.WriteLine(e.StackTrace);
                }
            }
        }
    }
    
    this trusted assembly:


    [assembly: AllowPartiallyTrustedCallers()]
    namespace ServiceProvider
    {
        public class Service
        {
            public static void callService(string serviceName)
            {
                try
                {
                    //new PermissionSet(PermissionState.Unrestricted).Assert();
                    File.AppendAllText("C:\\test.txt", "Called service Success:" + serviceName + "\n");
                }
                catch (Exception e)
                {
                    Console.WriteLine(serviceName);
                    Console.WriteLine(e.Message);
                    Console.WriteLine(e.StackTrace);
                }
            }
        }
    
        public interface IScreen
        {
            void OnLoad();
        }
    }
    
    
    this is unsafe one:


    namespace Screen
    {
        class Screen : MarshalByRefObject, IScreen
        {
            public Screen() { }
    
            public void OnLoad()
            {
                load();
                //voidDelegate loadScreen = new voidDelegate(load);
                //loadScreen.BeginInvoke(null, null);
            }
    
            private delegate void voidDelegate();
    
            public void load()
            {
                ServiceProvider.Service.callService("Screen");
            }
        }
    }
    
    Tuesday, January 05, 2010 1:15 PM

Answers

  • i have found a solution, this finally works :)

    //give extra permission
    
    permissions.AddPermission(new ReflectionPermission(ReflectionPermissionFlag.RestrictedMemberAccess));
    
    ..
    ..
    
     List<StrongName> snList = new List<StrongName>();
                    StrongName sn;
                    IEnumerator enumerator = typeof(IScreen).Assembly.Evidence.GetHostEnumerator();
                    while (enumerator.MoveNext())                {
    
                        sn = enumerator.Current as StrongName;
                        if (sn != null)
                            snList.Add(sn);
                    }
    
                    AppDomain appDomain = AppDomain.CreateDomain("ScreenDomain", null, appDomainSetup, permissions, snList.ToArray());                

    • Marked as answer by SamAgain Friday, January 15, 2010 3:18 AM
    Wednesday, January 06, 2010 2:35 PM