Special Permissions in the SSCLI

Before digging into a pretty clever optimization that the SSCLI makes for certain special permission demands, I want to point out that everything I’m about to cover is an implementation detail. Although this optimization does occur today, we can and will change it for future versions of the CLR (and potentially service packs for the…

2

SSCLI Zone Mappings

My previous post is begging the question “so what is the SSCLI’s zone mapping policy?” It’s actually quite simple, the source for SecurityPolicy::QuickGetZone in clr\src\vm\securitypolicy.cpp shows that SSCLI maps a URL to: NoZone if the URL is NULL MyComputer if the URL is a file URL Internet for all other cases Which indicates that there is…

1

Custom Zones and the CLR

On the topic of zones and the CLR … Windows lets you define custom zones outside of the standard ones that the CLR knows about (see MSDN’s topic on Security Zones for more information).  However, because the CLR doesn’t know about them, generally any assembly loaded from one of those zones will not get any CAS…

4

What Happens When You Fully Sign a Test Signed Assembly

When an assembly is test signed, the public key used to verify its signature is different from the public key that makes up part of the assembly identity.  So what happens when you take an assembly which is registered as a test signed assembly on your machine and fully sign it? The key here (aren’t…

3

SSCLI v2

As Jason announces, v2.0 of the SSCLI is now available for download: http://msdn.microsoft.com/net/sscli. In addition to general CLR features like generics that are available in this download, some interesting security points to look at are: Transparency (sscli20\clr\src\vm\securitytransparentassembly.cpp) Revamped compressed stack (sscli20\clr\src\vm\newcompressedstack.cpp) New declarative security metadata format (sscli20\clr\src\vm\securitydeclarative.cpp) And of course our general security perf work…

5

Comparing Java and .NET Security

It’s been a while since I’ve last seen a comparison of Java and .NET security.  Nathaneal Paul and David Evans from the University of Virginia Computer Science Department recently finished their comparison, Comparing Java and .NET Security: Lessons Learned and Missed. In their paper, Nathaneal and David take a bottom up approach to examining the…

12

When is ReflectionPermission Needed?

Reflection and its interaction with security can sometimes be a bit of a confusing matter.  The easiest portion to figure out is the permissions needed to use Reflection.Emit.  In order to do anything with the reflection emit feature, you’ll need to have ReflectionPermission with the ReflectionEmit flag set.  In the default policy, you’ll have this…

11

Why == and the Equals Method Return Different Results for Floating Point Values

There’s a subtle difference between comparing floating point values with the Equals method and comparing them with the == operator.  (In all the code I show in this post, I use the Double class, however everything I say also applies to the Single class). When the following code is run, it compiles and produces the…

3

What’s the Deal with the ECMA Key?

The libraries laid out in the ECMA spec are all signed with a public key that looks pretty strange.  If you ildasm mscorlib.dll, System.dll, or any of the other framework libraries that are defined in the ECMA specs (see partition IV: Library  if you’re interested in which libraries these are), you’ll notice a peculiar looking public…

3

Same Site Socket Permission

Fairly frequently, people will want to know how to get same site socket permissions, in the same way that they can get same site web permission today. Unfortunately, the answer is that with the security objects shipped with the framework, there is no way to accomplish this. In order to figure out what coding must be…

0