code-access-security

.NET/Security: Limiting runtime-loaded assemblies from accessing certain APIs

In a shell application, I need to be able to load and execute other .NET assemblies at runtime, but without giving them full trust. Essentially, I want to limit them (the loaded assemblies) from touching any system resources (threading, networking, etc), with the only exception being isolated storage. However, assemblies which are from "...

GetDirectories call in msi CustomAction throws security exception ONLY when All Users

I have a custom action that I'm using to deploy some files that sit next to the msi in the handoff package. My custom action is passed the msi path via the OriginalDatabase parameter and I'm checking to see if there is a folder next to it. Nothing too crazy but was a pain in the butt to figure out. Installing single or multiple users fr...

Question about Code Access Security (CAS).

Hi guys, I am studying the Code Access Security of .NET 2.0. My current understanding is as below: The basic mechanism of the CAS is for the CLR to collect certain evidences from the assembly, and then use the evidence and policy to work out a permission set for the assembly's code. And the assembly's code can do nothing beyond that pe...

Question about the working paradigm of Code Access Security (CAS)

Hi friends, I wrote the following code to test the CAS: [SecurityPermission(SecurityAction.Demand,Flags=SecurityPermissionFlag.Execution)] static void Main(string[] args) { Console.WriteLine("hello, world!"); } In the .NET 2.0 Configuration, I use the strong name of the above assembly to create a code group an...

Restricting Certificate access from C# Code

The use case: I have a hosting platform (server) where multiple ASP.Net applications are hosted. I do not want to have application to have programmatic access to the certificates on the Server. Only the Components/libraries that are developed by the platform owners should be able to access those certificates. Is there any way in which...

How to set the trust level for processor ID in .net window application ?

I developing window application in C#. I created one installer with this windows application. It is running fine on nearly all computers. The window application takes the ID of processor & then based on that ID generates one unique key. On one computer it is giving the error "Windows installer failed to generate the key. Please contact y...

Issue with Code Access Security Policy - deploying a third party dll to bin

Okay, i think most of you guys out there use wspbuilder to build the wsp solutions and to deploy it. So here is my problem. I'm working on a SharePoint solution which makes use of a third party dll (Telerik for Asp.Net Ajax - Telerik.Web.UI.dll) for rich experience. Since Telerik dll is a common assembly i have to deploy it to the bin f...

Code Access Security is a joke?

I have just read about this article about Code Access Security. It has such an example in it: using System.Security.Permissions; public class MyFileAccessor { public MyFileAccessor(String path, bool readOnly) { path = MakeFullPath(path); // helper fcn FileIOPermissionAccess desiredAccess = readOnly ? FileIOPermissionA...

How can I secure my plugin so only paying users can use it?

I'm developing some (wordpress) plugins and I'm planning to have a license fee for whoever want's to use it. Therefor I need a way to make sure that this plugin is not uploaded to a server where anyone can download it and use it for free. So I was thinking of using an API key. Valid API key = user can use the plugin. Invalid = plugin d...

Protecting source code from theft during development

Is there any way to protect my code during development so that if a developer leaves my company they are unable to access files in my project? This is especially important with TFS where the project is downloaded locally, cached, and available for offline use. Ideally the code would be unreadable if they did not have a valid Active Di...