|
Code Access Security Policy
Through this feature, the framework will control the
code from performing any privileged actions that are vulnerable or which may
compromise security. Code Access Security provides various levels of trusted
access to the code based on its origination and identity. By default, framework
has some predefined levels of permission which it uses to grant permissions for
the codes to execute. You can read more about this here.
Thus, by this feature we have another layer of security
mechanism in place which can reduce the threats.
We can use a tool called Caspol.exe to modify these
settings to grant or deny access to a resource.
Now, to make our code to execute successfully, we can
use this tool and tell the framework that the code originating from the share
can be fully trusted so that Code Access Security can allow the execution.
Resolution
Login to your server. Go to RUN. Type cmd to open
command prompt. Browse to C:\WINDOWS\Microsoft.NET\Framework\v2.0.XXXXX>
folder and execute the below command.
caspol -m -ag 1 -url file:\\ShareServer\Test\*
FullTrust
OUTPUT
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>caspol
-m -ag 1 -url file:\\ShareServer\Test\* FullTrust
Microsoft
(R) .NET Framework CasPol 2.0.50727.3053
Copyright
(c) Microsoft Corporation. All rights reserved.
Added
union code group with "-url" membership condition to the Machine
level.
Success
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>
Do an IISRESET to see the changes working.
The below command can be used to check the list of code
groups. You can see our share appended at the last.
List Groups
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>caspol
-lg
Microsoft
(R) .NET Framework CasPol 2.0.50727.3053
Copyright
(c) Microsoft Corporation. All rights reserved.
Security
is ON
Execution
checking is ON
Policy
change prompt is OFF
Level
= Machine
Code
Groups:
1.
All code: Nothing
1.1. Zone - MyComputer: FullTrust
1.1.1. StrongName -
0024000004800000940000000
6020000002400005253413100040
0000100010007D1FA57C4AED9F0A32E84AA0FAEFD0DE9
E8FD6AEC8F87FB03766C834C99921EB23BE
79AD9D5DCC1DD9AD236132102900B723CF980957FC4E17
7108FC607774F29E8320E92EA05ECE4E82
1C0A5EFE8F1645C4C0C93C1AB99285D622CAA652C1DFAD63D
745D6F2DE5F17E5EAF0FC4963D261C8
A12436518206DC093344D5AD293:
FullTrust
1.1.2. StrongName - 000000000000000004
00000000000000: FullTrust
1.2. Zone - Intranet: LocalIntranet
1.2.1. All code: Same site Web
1.2.2. All code: Same directory FileIO - 'Read, PathDiscovery'
1.3. Zone - Internet: Internet
1.3.1. All code: Same site Web
1.4. Zone - Untrusted: Nothing
1.5. Zone - Trusted: Internet
1.5.1. All code: Same site Web
1.6. Url - file:\\ShareServer\Test\*: FullTrust
Success
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>
The below command can be used to remove a group from the
code group.
Remove Group
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727
>caspol -rg 1.6
You can learn more about using the tool here.
|