Question about Code Access Security (CAS).

Question

Hi guys,

I am studying the Code Access Security of .NET 2.0. My current understanding is as below:

The basic mechanism of the CAS is for the CLR to collect certain evidences from the assembly, and then use the evidence and policy to work out a permission set for the assembly's code. And the assembly's code can do nothing beyond that permission set.

Evidence is used to classify certain assembly into certain code group, and permission set is given on a code group granularity.

There're several types of evidence can be collected by the CLR at runtime.

It is easy to determine evidence such as Application Directory, GAC, Hash, Strong Name.

But how to determine evidence such as Publisher, Site, Zone, URL? Where are these evidence data stored? Are they part of the assembly's metadata? I don't think that evidence like Zone or Site should be part of the metadata.

Many thanks.

Answer 1

The following page does the best that I can find of explaining how this information is obtained

• http://msdn.microsoft.com/en-us/library/7y5x1hcd(VS.80).aspx

The summary is that much of this information is not on the assembly itself but provided by the hosting environment of the CLR. Examples of hosts include

• The Browser
• ASP.Net
• Shell Host (normal applications)

These host themselves provide the information about Site, Zone, etc ... to the CLR for a given assembly.