C# Security : Code Access Security

The CodeAccessPermission types that are enforced throughout the (entire) .NET Framework are listed by category in at below. Collectively, these are intended to cover all the means by which a program can do mischief!

Core permissions
Type	Enables	Intranet?	Internet?
SecurityPermission	Advanced operations, such as calling unmanaged code	Execute, assert	Execute only
ReflectionPermission	Use of reflection	Emit only
EnvironmentPermission	Reading/writing command-line environment settings	Read username
RegistryPermission	Reading or writing to the Windows Registry
UIPermission	Creating windows and interacting with the clipboard	Unrestricted	Safe windows; own clipboard
PrintingPermission	Accessing a printer	Default printing	Safe printing

SecurityPermission accepts a SecurityPermissionFlag argument. This is an enum that allows any combination of the following:

AllFlags

Assertion

BindingRedirects

ControlAppDomain

ControlDomainPolicy

ControlEvidence

ControlPolicy

ControlPrincipal

ControlThread

Execution

Infrastructure

NoFlags

RemotingConfiguration

SerializationFormatter

SkipVerification

UnmanagedCode

The significant members of this enum are Execution, without which code will not run at all; ControlAppDomain, which allows the creation of new application domains; and UnmanagedCode, which allows you to call native methods.

I/O and data permissions
Type	Enables	Intranet?	Internet?
FileIOPermission	Reading/writing files and directories
FileDialogPermission	Reading/writing to a file chosen through an Open or Save dialog	Unrestricted	Open only
IsolatedStorageFilePermission	Reading/writing to own isolated storage	Unrestricted	Limited to 512 KB
ConfigurationPermission	Reading of application configuration files
SqlClientPermission, OleDbPermission, OdbcPermission	Communicating with a database server using the SqlClient, OleDb, or Odbc classes
DistributedTransactionPermission	Participation in distributed transactions

FileDialogPermission controls access to the OpenFileDialog and SaveFileDialog classes. These classes are defined in Microsoft.Win32 (for use in WPF applications) and in System.Windows.Forms (for use in Windows Forms applications). For this to work, UIPermission is also required. FileIOPermission is not also required, however, if you access the chosen file by calling OpenFile on the OpenFileDialog or SaveFileDialog object.

Networking permissions
Type	Enables	Intranet?	Internet?
DnsPermission	DNS lookup	Unrestricted	-
WebPermission	WebRequest-based network access	-	-
SocketPermission	Socket-based network access	-	-
SmtpPermission	Sending mail through the SMTP libraries	-	-
NetworkInformationPermission	Use of Ping	-	-
AspNetHostingPermission	Allows custom ASP.NET hosting	-	-

Encryption permissions
Type	Enables	Intranet?	Internet?
DataProtectionPermission	Use of the Windows data protection methods	-	-
KeyContainerPermission	Public key encryption and signing	-	-
StorePermission	Access to X.509 certificates	-	-

Diagnostics permissions
Type	Enables	Intranet?	Internet?
EventLogPermission	Reading or writing to the Windows event log	-	-
PerformanceCounterPermission	Use of Windows performance counters	-	-

How the CLR Allocates Permissions

The CLR grants permissions to .NET assemblies based on a complex set of rules and mappings, defined by the computer's .NET Framework configuration. You can imagine there's an engine on the computer that accepts assembly evidence as input and emits a permission set as output. Assembly evidence is a collection of information describing the properties of an assembly relevant to security, such as where it came from and its strong name.

By default, assemblies on your local hard drive execute with the "FullTrust" permission set. This has no code access security restrictions, so all Demands on CodeAccessPermission types succeed. Assemblies that run from a network drive or UNC path, however, execute with the limited "LocalIntranet" permission set, and assemblies that run from a URI execute with the even more limited "Internet" permission set.

"FullTrust," "LocalIntranet," and "Internet" are named permission sets defined in the computer's Runtime Security Policy.

The decision as to what named permission set to award a given assembly is determined by a code group (also in the computer's Runtime Security Policy). A code group maps a membership condition (e.g., "Zone = Local Intranet") to a named permission set (e.g., "LocalIntranet").

Code groups themselves can exist at three levels: Enterprise, Machine, and User. During .NET Framework installation, the three default code groups are created at the Machine level. These can be overridden, however, by the user—or by Enterprise-level settings imposed by a network domain administrator. An example of this might be to change the "LocalIntranet" set to create a brand-new code group, or to add certain trusted sites to an existing code group.