locked
Checking CAS rights on an application from another RRS feed

  • Question

  • hello,

     

    im currently on an internship and i need to write a launcher / updater for the main software for this company. this wasn't realy hard untill i got to the rights check. the main application is in .net and is generaly run in companys from an internal server. quite a few companies have trouble with this due to the application just throwing an error and crashing becouse it didn't have the rights to preform a certain action. the role of the launcher here is to check what rights the main application has to make sure it doesn't crash and if its missing some write this to a log file or display it on the screen.

     

    my question is: is there any way to see what the main program is allowed to do acording to CAS from the launcher?

     

    PS: launcher is writen in c++

    Monday, July 19, 2010 8:00 AM

Answers

  • Hi,

      Thanks for your post.

      I am not quite sure about your scenario. What do you mean by "the main application is run from the company's internal server". Could you give some more elaborations on how this main application is used and how your launcher/updater is supposed to be used?

      On the other hand, we should be familiar with the Code Access Security CAS first. The CAS is Microsoft's solution to prevent untrusted code from performing privileged actions. It is based on evidence. When the CLR loads an assembly, it will obtain evidence from the assembly and use this to identify what code group this assembly belongs to. A code group is assigned a permission set. When code wants to perform a privileged action, it will perform a code access demand. This will cause the CLR to walk up the call stack and examine the permission set granted to the assemblies of each method in the call stack. The code groups and permission sets are determined by the administrator of the machine who defines the security policy.


      We can use Mscorcfg.msc or caspol.exe to config the CAS policy. I am not sure about your words "acording to CAS from the launcher". But I don't think we could get a explict static list of what a program can do according to CAS before its execution. Because we don't fully know the the runtime behaviors of the program, we cannot know what privileged action it would take or when it would take. Even the CLR runtime enforces the CAS security at runtime.


    Please mark the right answer at right time.
    Thanks,
    Sam
    • Edited by SamAgain Tuesday, July 20, 2010 6:29 AM refine
    • Marked as answer by E.reimerink Tuesday, July 20, 2010 1:06 PM
    Tuesday, July 20, 2010 6:29 AM

All replies

  • Hi,

      Thanks for your post.

      I am not quite sure about your scenario. What do you mean by "the main application is run from the company's internal server". Could you give some more elaborations on how this main application is used and how your launcher/updater is supposed to be used?

      On the other hand, we should be familiar with the Code Access Security CAS first. The CAS is Microsoft's solution to prevent untrusted code from performing privileged actions. It is based on evidence. When the CLR loads an assembly, it will obtain evidence from the assembly and use this to identify what code group this assembly belongs to. A code group is assigned a permission set. When code wants to perform a privileged action, it will perform a code access demand. This will cause the CLR to walk up the call stack and examine the permission set granted to the assemblies of each method in the call stack. The code groups and permission sets are determined by the administrator of the machine who defines the security policy.


      We can use Mscorcfg.msc or caspol.exe to config the CAS policy. I am not sure about your words "acording to CAS from the launcher". But I don't think we could get a explict static list of what a program can do according to CAS before its execution. Because we don't fully know the the runtime behaviors of the program, we cannot know what privileged action it would take or when it would take. Even the CLR runtime enforces the CAS security at runtime.


    Please mark the right answer at right time.
    Thanks,
    Sam
    • Edited by SamAgain Tuesday, July 20, 2010 6:29 AM refine
    • Marked as answer by E.reimerink Tuesday, July 20, 2010 1:06 PM
    Tuesday, July 20, 2010 6:29 AM
  • the main application is installed on a central server and then run from multiple desktops inside the company (intranet). the idea is that we want to make it easier for the companys to know what to do if thier permission policies arn't set right instead of having to call us. the idea is that this launcher should check what is posible and if not enough rights are availible tell the user that it needs to run caspol to put the settings right for the main aplication.

     

    getting a static list is what i hoped but since i found nothing about it searching the net and you also dont think its posible it seems we will need to try this in another way.

     

    is it maby posible to check if an exe is fulltrust or not?

    if not ill mark your previus reply as awnser.

    Tuesday, July 20, 2010 7:26 AM