C# Prevent class instance of AppDomain assembly from file access

Question

I want to load an assembly which contains a single class that implements an Interface. The Interface just has one Method: "Run()".

I want to load the class inside a totally restricted AppDomain and prevent the instance from file or Registry access.

This is my Layout:

Signed Main Project - Loads Assembly, creates an instance and executes the Method Run()
Signed C# Library - Just contains the IProvider Interface definition
External C# Library - Implements my Interface in the class MyProvider

This is the code I use to load the external library, create an instance and execute the interface method:

        Evidence ev = new Evidence();
        ev.AddHostEvidence(new Zone(SecurityZone.Internet));
        PermissionSet permSet = SecurityManager.GetStandardSandbox(ev);

        StrongName fullTrustAssembly = typeof(Program).Assembly.Evidence.GetHostEvidence<StrongName>();

        AppDomainSetup adSetup = new AppDomainSetup()
        {
            ApplicationBase = Path.GetFullPath(Environment.CurrentDirectory)
        };

        AppDomain newDomain = AppDomain.CreateDomain("Sandbox", ev, adSetup, permSet, fullTrustAssembly);

        Assembly asm = newDomain.Load(System.IO.File.ReadAllBytes("ExternalLib.dll"));
        var instance = asm.CreateInstance("ExternalLib.MyProvider", true);

        IProvider provider = instance as IProvider;

        //Should not work, because my Assembly is accessing a file/Registry or something else
        string result = provider.Run("Test");

I want the last line to throw an Exception, because the ExternalLib.dll implements the interface but is accessing my file system or changing the Registry etc

Any Ideas on how to accomplish this?

http://stackoverflow.com/questions/1520113/restrict-plug-in-assembly-code-access or http://stackoverflow.com/questions/1357231/restrict-plugin-access-to-file-system-and-network-via-appdomain — Steve Coleman, Oct 09 '14 at 20:22

score 4 · Accepted Answer · edited May 23 '17 at 12:09

4

You can remove permissions from the PermissionSet, e.g.:

permSet.RemovePermission(typeof(FileIOPermission));
permSet.RemovePermission(typeof(RegistryPermission));

Or you can create a PermissionSet with no permissions and then add the ones that you want, as outlined here:

PermissionSet permSet = new PermissionSet(PermissionState.None);
permSet.AddPermission(new SecurityPermission(SecurityPermissionFlag.Execution));

edited May 23 '17 at 12:09

Community

1
1

answered Oct 09 '14 at 20:23

Mrchief

75,126
20
142
189

Thanks for the quick answer. I think my problem was, that I was not using a static function call or not using the Activator class. Thanks :) – DoubleVoid Oct 09 '14 at 20:55

C# Prevent class instance of AppDomain assembly from file access

1 Answers1