Can an appdomain be restricted to one directory?

Question

I am developing a plugin host. The plugins should have as little trust as they need, however I want to have the possibility for a plugin to read and write files.

Can the AppDomain where the assembly will be loaded be restricted to have access to only one directory for reading and writing?

Other options and ways to go about this are also appreciated like for example easy ways to stream file data from the host to the plugin (reading) and from the plugin to the host (writing).

If its relevant: I am using the MAF infrastructure for the plugins. http://msdn.microsoft.com/en-us/library/bb384200.aspx

What do you mean, "an appdomain in C#"? AppDomains are part of the .NET Framework, not part of C#. — John Saunders, May 19 '10 at 22:44
possible duplicate of [Restrict plugin access to file system and network via appdomain](http://stackoverflow.com/questions/1357231/restrict-plugin-access-to-file-system-and-network-via-appdomain) — Gonzalo, May 19 '10 at 22:51
yes, I meant .Net, i'm just so used to c# they are almost equivalents to me :) As for the duplicate question, sorry I failed to see that one before I posted. Its almost what I need so I may be able to adapt it. — Caerbanog, May 19 '10 at 22:57

score 6 · Accepted Answer · answered May 20 '10 at 00:47

namespace ConsoleApplication
{
    #region Imports

    using System;
    using System.IO;
    using System.Security;
    using System.Security.Permissions;

    #endregion

    public class Plugin : MarshalByRefObject
    {        
        public string TestRead(string path)
        {
            try
            {
                File.ReadAllBytes(path);
                return "Done";
            }
            catch (SecurityException)
            {
                return "Access Denied";
            }
        }
    }

    public class Program
    {
        static void Main(string[] args)
        {
            var setup = new AppDomainSetup();

            setup.ApplicationBase = 
                AppDomain.CurrentDomain.SetupInformation.ApplicationBase;

            var perm = new PermissionSet(PermissionState.None);

            perm.AddPermission(
                new SecurityPermission(
                    SecurityPermissionFlag.Execution));

            perm.AddPermission(
                new FileIOPermission(
                    FileIOPermissionAccess.Read, "c:\\public\\"));

            var pluginDomain = 
                AppDomain.CreateDomain("PluginDomain", null, setup, perm);

            var plugin = 
                pluginDomain.CreateInstanceAndUnwrap(
                    typeof(Plugin).Assembly.FullName,
                    typeof(Plugin).FullName) as Plugin;

            Console.WriteLine(plugin.TestRead("c:\\public\\test.txt"));
            Console.WriteLine(plugin.TestRead("c:\\secret\\test.txt"));
            Console.ReadKey();
        }
    }
}

Can an appdomain be restricted to one directory?

1 Answers1

Linked