FullTrust on the LocalIntranet
We released the first beta of .NET 3.5 SP 1 this morning, and it includes a change to the default grant set for applications launched from the LocalIntranet zone. The quick summary is that as of .NET 3.5 SP1, applications run from a network share will receive a grant set of FullTrust by default, making them act the same as if they were launched off of your computer directly. Since this is an issue that I know a lot of people run into, I hope that this change makes it easier to use and deploy managed applications. For people who want to keep their machines working the same as they did for previous .NET Framework releases, you can set the DWORD registry value LegacyMyComputerZone to 1 in the HKLM\Software\Microsoft\.NETFramework registry key.
With the high-level summary out of the way, let's take a look under the hood to see what changed to make this possible :-)
The core of this change is a modification in how we assign evidence to network launched applications. When we see an .exe launched directly off a network share, rather than giving that .exe Zone evidence of LocalInranet, we instead give the .exe Zone evidence of MyComputer. This causes the .exe to match the default MyComputer code group rather than the LocalIntranet group, and in default CAS policy that code group grants FullTrust. (This also explains why the opt-out registry value is named LegacyMyComputerZone)
In addition to the entry point .exe of the application, we'll also extend this MyComputer evidence to any assembly loaded from the same directory as the .exe. So, if you place any managed .dll's immediately next to your .exe, those will also all be given FullTrust by default in .NET 3.5 SP1.
Since we're only including assemblies loaded from the same directory as the entry point application, things will just work for most applications, however more complicated programs that need to load assemblies from different subdirectories or other network shares may not see all of their assemblies get fully trusted by default. For these more types of applications, ClickOnce deployment is the recommended way to elevate to FullTrust.
We've specifically disabled this change for any hosted applications. So this means that if your program uses the CorBindToRuntime API to host the CLR, we won't start trusting assemblies it loads from a share. Similarly, hosts like Internet Explorer will not start trusting controls that it loads into the browser.
To summarize the under the hood changes, assemblies which will now receive Zone evidence of MyComputer and therefore be fully trusted by default are:
- Any managed .exe which is launched directly from a network share
- Any assembly in that .exe's process which is loaded from the same directory as the .exe itself was.
Assemblies which will not see this change include:
- Assemblies loaded from a subdirectory of the share where the .exe was launched from
- Assemblies loaded from shares other than the one where the main .exe was launched
- Any assembly loaded on a machine with the LegacyMyComputer registry value set to 1
- Any assembly loaded into a CLR host, including assemblies loaded into Internet Explorer as controls.
- Any assembly loaded from shares by an application that was launched from the "real" MyComputer zone.
