With .NET something called CAS(Code Access Security) is introduced. This is a great way for you to make sure that the user is actually running your code, and that no one has made changes to it. But from a software distribution kind of view it is another issue to think about when you are relasing the product.
I’m gonna talk a bit about the scenarion where you have client/server environment where the client is running your app from a share on the server, and I’m assuming that your assemblies are “strong named”
In this scenarion the code needs to be trusted on the client computer to be able to run your application. Another option is to turn off CAS on the client, but that’s not what we want to tell the customer, right .
On the client you need to set up a code group for your applications code. You can do this from the MS .NET configuration tool (located in administrative tools), or you can do it by command using the commandline tools caspol.exe. (as in CodeAccessSecurityPolicy ;-)) I’m not going to go in detail on how to set up code group, but from caspol you could do something like below to create a code group for your application.
________________________________________________________________________
Caspol -enterprise -addgroup 1. -strong -file \\\bin\Your.Assembly.dll -noname -noversion FullTrust -n CodeGroupName –LevelFinal on
________________________________________________________________________
This will create a code group on the enterprise level. Strongname is selected as condition type. You are getting the public key from an assembly in the network share, you are giving the code full trust on the client computer, the name of the code group is CodeGroupName, you have given the code group the LevelFinal attribute.
Giving the code group the level final attribute will prevent policy levels below this level from being evaluated. On the enterprise level this must be done, or the default machine level policies will prevent the enterprise level policies from being applied.
Giving FullTrust to the code group is not the best solution in most cases, you can create your own permission sets where you can give select what you code should have access to do. But in some cases where assemblies for instance are called from C++ code, giving “full trust” to you code might be the only solution. (C# folks might prefer to call C++ C—these days)
It’s is highly recommended that you create a new code group and use the strong name membership condition when trusting code (in this client/server network share scenario). But there are also other options. These options should only be used for troubleshooting or as workarounds. Only turn .NET Security off for troubleshooting purposes
__________________________________________________________________________
Turn .NET Security off:
Caspol –s off
Give full trust to the Local Intranet Zone:
.NET Configuration tool:
1. Right-click on the LocalIntranet_Zone policy
2. Select the permission set tab
3. change the permission set to Full Trust
Or from caspol:
caspol.exe -machine -chggroup LocalIntranet_Zone FullTrust
Give full trust to the central configuration path
.NET Configuration tool:
1. Create a new code group
2. Select URL as condition type, and set the url to the central configured folder: etc: file://
3. set permission set to “full trust”(or your permission set)
4. Remember to set the option “policy levels below this level will not be evaluated”(Level Final attribute)
How to distribute these policies to the clients is another problem, especially if the client user is not local administrator. I’m going to talk a little bit about this another day.
