RestrictedMemberAccess

re: RestrictedMemberAccess

shawnfa — Thu, 05 Nov 2009 18:10:48 GMT

Hi Jamebo,

What you're running into is that the demand triggered when B reflects onto A is for A's grant set + RestrictedMemberAccess. That works out to FullTrust + RestrictedMemberAccess = FullTrust.

The full trust demand will not fail when it sees B's frame on the stack, as you correctly noted B is in the GAC and fully trusted. However, when the demand continues up the stack it will eventually hit the AppDomain boundary. The domain itself is medium trust, so the demand for full trust fails there.

What you would need to do in this situation is have B Assert for FullTrust before doing the reflection in order to prevent the demand from proceeding beyond B's frame and hitting the AppDomain.

-Shawn

re: RestrictedMemberAccess

Jamebo — Fri, 30 Oct 2009 09:45:46 GMT

HI, Shawn:

Thank you for your great post to explain the details. I faced a problem in RestrictedMemberAccess flag.

Case 1:

Appdomain Boundary (MediumTrust + RestrictedMemberAccess ) -> Assembly A with FullTrust (in GAC)

-> Assembly B with MediumTrust + RestrictedMemberAccess

The result is okay as RestrictedMemberAccess described.

Case 2:

Install Assembly B into GAC, then it is:

Appdomain Boundary (MediumTrust + RestrictedMemberAccess ) -> Assembly A with FullTrust (in GAC)

-> Assembly B with Full Trust (in GAC)

An Security exception will be thrown : Demand falied for

<PermissionSet class="System.Security.PermissionSet"version="1" Unrestricted="true"/>.

Why? In case 2, Assembly B has same grant set with Assembly A. It should be okay for RestrictedMemberAccess. Could you please give me some comments?

Thanks

-Jamebo

David DeWinter » Using LINQ to SQL and EF in Sharepoint under Medium Trust

David DeWinter » Using LINQ to SQL and EF in Sharepoint under Medium Trust — Thu, 23 Apr 2009 06:35:32 GMT

PingBack from http://blogs.rev-net.com/ddewinter/2009/04/22/using-linq-to-sql-and-ef-in-sharepoint-under-medium-trust/