C# 4 and .NET 4

564 ❘ ChaPTer 21 security
➤
➤
Internet specifi es the default policy for code of unknown origin. This is the most restrictive policy
listed. For example, code executing in this permission set has no fi le IO capability, cannot read or
write event logs, and cannot read or write environment variables.
Everything grants all the permissions that are listed under this set, except the permission to skip code
verifi cation. The administrator can alter any of the permissions in this permission set. This is useful
when the default policy needs to be tighter.
Note that you can change the defi nitions of only the Everything permission
set — the other sets are fi xed and cannot be changed. Of course, you can also create
your own permission set.
Demanding Permissions Programmatically
An assembly can demand permissions declaratively or programmatically. The following code snippet
demonstrates how permissions can be demanded with the method DemandFileIOPermissions() . If you
import the namespace System.Security.Permissions , you can check for permissions by creating a
FileIOPermission object, and calling its Demand() method. This verifi es if the caller of the method, here
the caller of the method DemandFileIOPermissions , has the required permissions. In case the Demand()
method fails, an exception of type SecurityException is thrown. It ’ s okay not to catch the exception and
let it be handled by the caller.
using System;
using System.Security;
using System.Security.Permissions;
[assembly: AllowPartiallyTrustedCallers()]
namespace Wrox.ProCSharp.Security
{
[SecuritySafeCritical]
public class DemandPermissions
{
public void DemandFileIOPermissions(string path)
{
var fileIOPermission = new FileIOPermission(PermissionState.Unrestricted);
fileIOPermission.Demand();
}
}
}
//...
code snippet DemandPermissionDemo/DemandPermissions.cs
FileIOPermission is contained within the System.Security.Permissions namespace, which is home to
the full set of permissions and also provides classes for declarative permission attributes and enumerations
for the parameters that are used to create permissions objects (for example, creating a FileIOPermission
specifying whether read - only or full access is needed).
To catch exceptions thrown by the CLR when code attempts to act contrary to its granted permissions,
you can catch the exception of the type SecurityException , which provides access to a number of useful
pieces of information, including a human - readable stack trace ( SecurityException.StackTrace ) and a
reference to the method that threw the exception ( SecurityException.TargetSite ). SecurityException
even provides you with the SecurityException.PermissionType property, which returns the type of
Permission object that caused the security exception to occur.
www.it-ebooks.info