SecurityException thrown when app starts from remote folder

Question

I have an app written in C# that lies on a network share. When I run it from a local drive, everything works fine. When I start it from the remote share, calls like

try
{
    System.Reflection.Assembly.GetExecutingAssembly();
    System.IO.Directory.GetCurrentDirectory();
}

throw a SecurityException 'Request failed'.

What causes this, what is the difference between an app that is started locally and one that is started from a remote location?

Answer 1

This is due to CAS; code started from the local machine has much more trust than code in the intranet, which in turn has more trust that code from the internet.

IIRC, with the latest SP (3.5SP1?) if you have mapped the share (i.e. as F:) it is trusted; otherwise you will need to either:

a: apply a caspol change to all clients (yeuck)

b: use ClickOnce to deploy the app, and run the .application instead (yay!)

The point is that ClickOnce allows you to sign the app and state your security policy (even if you demand full trust).

Answer 2

Because your application is starting on a shared drive, different execution security policies applies.

This implies to learn how .NET Code Access Security is working.

http://msdn.microsoft.com/en-us/library/aa302422.aspx

A quick and dirty solution consists to go to .NET Framework Configuration, unfold RunTime Security Policy, unfold Machine, then Code Groups, then LocalIntranet Zone, do right click on it, choose Properties, then change Permission Set to FullTrust.

This will allow applications in the intranet zone (including application which runs from the shared network) to run as full trusted.

This is definitely not the recommended way to do. The best would be to learn how .NET Code Access Security is working and to apply a specific security policy depending on your application needs.

For example, you can give a strong name with your application by signing it, define a new code group with the public key and apply full trusted permission on that code group. Then you may sign all "approved" application with this same public key, so the same Code Access Security policy applies.

Answer 3

They changed this to some degree in .Net Framework 3.5 SP1. See .NET 3.5 SP1 Runs Managed Applications From Network Shares