Improving Web Application Security: Threats and - CGISecurity

Chapter 9: Using Code Access Security with ASP.NET 227ASP.NET Policy FilesEach trust level is mapped to an individual XML policy file and the policy file liststhe set of permissions granted by each trust level. Policy files are located in thefollowing directory:%windir%\Microsoft.NET\Framework\{version}\CONFIGTrust levels are mapped to policy files by the elements inMachine.config, which are located just above the element, as shown in thefollowing example.Note No policy file exists for the full-trust level. This is a special case that simply indicates theunrestricted set of all permissions.ASP.NET policy is fully configurable. In addition to the default policy levels,administrators can create custom permission files and configure them using the element, which is described later in this chapter. The policy file associatedwith the custom level must also be defined by a element inMachine.config.ASP.NET PolicyCode access security policy is hierarchical and is administered at multiple levels.Policy can be created for the enterprise, machine, user, and application domain levels.ASP.NET code access security policy is an example of application domain-levelpolicy.