Permissions Sample

Sample Overview

This sample demonstrates using the Code Access Security Policy tool (caspol.exe) to change machine-level settings, and creating and using a custom permissions object.

Sample Source and Build Output Locations

The sample source is found in sscli\samples\howto\security\permissions.

The files included with the sample are:

• permissions directory
  • exclusive.bat
    • Used after setpolicy.bat to demonstrate the difference between turning the Exclusive permission on or off.
  • exclusive.sh
    • Same as the batch file, but to be used on UNIX system-based platforms.
  • names.txt
    • Text file accessed by the namestore assembly to store names.
  • permissions_sample.html
    • This documentation.
  • setpolicy.bat
    • Used to change the code access security policy at the User level from FullTrust to Everything. This allows the permission sample to demonstrate various behaviors that will not occur under FullTrust.
  • setpolicy.sh
    • Same as the batch file, but to be used on UNIX system-based platforms.
  • authorized directory
    • authorized.cs
      • The source code for the authorized application. The application will be granted the authorization to assert the custom myperm permission.
    • authorized.snk
      • The source for the assembly key for the authorized application. The public key from this file is used to grant permissions to the application.
  • myperm directory
    • myperm.cs
      • The source code for the myperm custom permissions assembly. This assembly will be installed in the global assembly cache during build.  It must be in the global assembly cache for the Code Access Security Policy tool to correctly register it for use as a custom permission.
    • myperm.snk
      • The key file for the myperm assembly.
    • myperm.xml
      • An XML serialization of the myperm assembly. Used by the Code Access Security Policy tool to install the custom permission.
  • namestore directory
    • namestore.cs
      • The source code for the namestore intermediate assembly. This is used by both the authorized and unauthorized applications to access the names.txt file.  The constructor for the NameStore object issues a Demand for the myperm permissions object.
    • namestore.snk
      • The key file for the namestore assembly.
  • unauthorized directory
    • unauthorized.cs
      • The source code for the unauthorized application.
    • unauthorized.snk
      • The key file for the unauthorized application. This key is different from that for the authorized application and it will not be granted permission for the myperm custom permission.

The build output location is %TARGETCOMPLUS%\samples\security\permissions.  The following is a list of files output from the build of this sample:

• authorized.exe
  • An executable assembly that will be authorized to use the custom permission.
• myperm.dll
  • A library assembly that implements a custom permission.
• namestore.dll
  • A library assembly that is used by both the authorized and unauthorized applications.
• unauthorized.exe
  • An executable assembly that will not be authorized to use the custom permission.

Building the Sample

All samples are built from the buildall script. 

You can also build all the samples by switching to the root of the sample directory, sscli\samples, and typing build -c.

You can build this specific sample by switching to the sample directory and typing build -c.

Running the Sample

These steps require that the Shared Source CLI (SSCLI) be already built and functional.

1. Run env.bat or source the env.csh or env.sh script files depending on your platform.
2. Switch directories to the %TARGETCOMPLUS%\samples\howto\security\permissions directory and run both the authorized and unauthorized application assemblies before any security permissions have been changed.  Both executable assemblies should run identically and allow access to the names.txt file for both reading and modifying.

       clix authorized.exe
       clix unauthorized.exe

3. Run the setpolicy.bat file on Microsoft Windows®.  On UNIX system-based operating systems, source the setpolicy.sh file.  This will change the default user permissions from FullTrust to Everything.  The Everything permission is more restrictive than FullTrust and will demonstrate the desired functionality.  The script will also install the myperm custom permission and set the authorized application as allowed to assert the myperm custom permission.
4. Run the authorized application assembly using the clix launcher. It should allow access to both read and modify the names.txt file.
5. Run the unauthorized application assembly using the clix launcher. It should fail to start and generate a security exception from the NameStore instance constructor.
6. Run the exclusive.bat batch file on Windows, or source the exclusive.sh file on UNIX system-based platforms. This will change the permissions behavior to Exclusive which means that no default permissions will be granted.
7. Run the authorized application.  It will be allowed to read the names.txt file but not modify it. This is because the GetNames() method asserts the FileIOPermission for the calling application, but the AddName method does not and will fail.
8. When you finish running the sample, reset the security environment to the default state using the Code Access Security Policy tool:

clix %targetcomplus%\caspol -q -reset

Copyright (c) 2002 Microsoft Corporation. All rights reserved.