Improving Web Application Security: Threats and - CGISecurity

Chapter 8: Code Access Security in Practice 189Policy Evaluation at a Policy LevelAn individual policy file at each specific level consists of a hierarchical arrangementof code groups. These code groups include membership conditions that are used todetermine which assemblies they apply to, and permission sets that are used todetermine the permissions that should be granted to matching assemblies. Ahierarchical structure enables multiple permission sets to be assigned to an assembly,and it allows security policy to support simple AND and OR logic. For example,consider the sample security policy shown in Figure 8.3.All Codeps:NothingZone:MyComputerps:FullTrustZone: LocalIntranetps:LocalIntranetPublisher:Company2ps:Comp2PSetURL:https://a.b.c.comps:ABCPSetPublisher:Company1ps:Comp1PSetLogical ANDFigure 8.3Hierarchical code groups at a single policy levelNote The All Code code group is a special code group that matches all assemblies. It forms theroot of security policy and in itself grants no permissions, because it is associated with thepermission set named Nothing.