Presented By: Ahmed ALSUM PhD Student CS 895:.Net Security Old Dominion University College of Science Department of Computer Science

Outline

What’s a Permission Permissions limit what an assembly can do ◦ –run if code not verifiable? ◦ –access file system? ◦ –access the network? ◦ –access certain environment variables? ◦ –call native code (COM objects, DLLs)? ◦ –access files or printers without asking user?

Security Code Access Security Code may require permissions to run Security policy determines what code is allowed to run ◦ By machine  Where did this code come from?  Who authored it? ◦ By user If no permission then a SecurityException is thrown

Security Code Access Security Can specify the permissions needed by code ◦ Declarative, with attributes ◦ Imperative  Create a permission object, then call Demand() By default, the CLR will ensure that all code in call chain has the necessary permissions

Security Code Access Security Security check Varying levels of trust Behavior constrained by least trustworthy component Assembly A1 Assembly A2 Assembly A3 Assembly A4 G1 G4 G3 G2 P P P Call Chain

Security Code Access Security Can override security checks ◦ Assert() lets you and the code you call perform actions that you have permission to do, but your callers may not. ◦ Deny() lets you prevent downstream code from performing certain actions ◦ PermitOnly() is like Deny(), but you specify the only permissions the downstream code will have.

Security Permissions Code access permissions ◦ Protect resources and operations ◦ Ex. DnsPermission, EnvironmentPermission, WebPermission Identity permissions ◦ Characteristics of an assembly‘s identity ◦ Ex. URLIdentityPermission, ZoneIdentityPermission Role-based permissions ◦ Discover a user‘s role or identity ◦ Ex. PrincipalPermission Custom permissions ◦ Design and implement your own classes

Permissions classes Resources AccessedRequired Permissions DPAPI encryptionDataProtectionPermission DNS directoryDnsPermission Environment variablesEnvironmentPermission Event logEventLogPermission File dialogFileDialogPermission File systemFileIOPermission Isolated file storageIsolatedStoragePermission Key containersKeyContainerPermission Message queuesMessageQueuePermission Network information and traffic statisticsNetworkInformationPermission OLE DB data sourcesOleDbPermission Performance countersPerformanceCounterPermission

Permissions classes Resources Accessed Required Permissions PrintersPrintingPermission ReflectionReflectionPermission RegistryRegistryPermission SecuritySecurityPermission SMTP serversSmtpPermission SocketsSocketsPermission SQL Server notificationsSqlNotificationPermission SQL ServerSqlClientPermission Stores containing X.509 certificatesStorePermission User interfaces and clipboardUIPermission Web services (and other HTTP Internet resources)WebPermission

Namespace: System.Security CodeAccessPermission Defines the underlying structure of all code access permissions  When you inherit from CodeAccessPermission, you must also implement the IUnrestrictedPermission interface.  The following CodeAccessPermission members must be overridden: Copy, Intersect, IsSubsetOf, ToXml, FromXml, and Union.  You must also define a constructor that takes a PermissionState as its only parameter.  You must apply the SerializableAttribute attribute to a class that inherits from CodeAccessPermission. Custom Permission Example

Namespace: System.Security.Permissions CodeAccessSecurityAttribute The security information declared by a security attribute is stored in the metadata of the attribute target and is accessed by the system at run time. Security attributes are used only for declarative security. All permission attributes derived from this class must have only a single constructor that takes a SecurityAction as its only parameter. Custom Attribute Example

Namespace: System.Security.Permissions PermissionState Enumeration Specifies whether a permission should have all or no access to resources at creation.  Unrestricted: Full access to the resource protected by the permission.  None: No access to the resource protected by the permission. Ex, the file permission constructor could create an object representing either no access to any files or all access to all files. Intermediate states can be set according to the specific permission semantics.

EnvironmentPermission Environment variable names are designated by one or more case- insensitive name lists separated by semicolons, with separate lists for read and write access to the named variables. EnvironmentPermission class controls access to system and user environment variables. EnvironmentPermission tmpVariable = new EnvironmentPermission( EnvironmentPermissionAccess.Read, "TEMP"); tmpVariable.Deny();

FileIOPermission Controls the ability to access files and folders. This permission distinguishes between: Read, Write, Append, and PathDiscovery. All these permissions are independent, meaning that rights to one do not imply rights to another. FileIOPermission fp = new FileIOPermission(PermissionState.None); fp.AllLocalFiles = FileIOPermissionAccess.Read; fp.Demand();

WebBrowserPermission It controls the ability to create the WebBrowser control. In the Windows Presentation Foundation (WPF), the Web browser control enables frames to navigate HTML. This permission uses the values of the WebBrowserPermission enumerations. WebBrowserPermission webBrowserPermission = new WebBrowserPermission(WebBrowserPermissionLevel.Unrestricted);

MediaPermission The MediaPermission describes a set of security permissions that controls the ability for audio, image, and video media to work in a partial-trust Windows Presentation Foundation (WPF) application.

RegistryPermission RegistryPermission describes protected operations on registry variables. Registry variables should not be stored in memory locations where code without RegistryPermission can access them. If the registry object is passed to an untrusted caller it can be misused. RegistryPermission f = new RegistryPermission( RegistryPermissionAccess.Read, "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProces sor\\0");

PrincipalPermission By passing identity information (user name and role) to the constructor, PrincipalPermission can be used to demand that the identity of the active principal matches this information. It implements the IPermission interface. This is because PrincipalPermission is not a code access permission; that is, it is not granted based on the identity of the executing assembly. Instead, it allows code to perform actions (Demand, Union, Intersect, and so on) against the current user identity.IPermissionDemandUnionIntersect AppDomain.CurrentDomain.SetPrincipalPolicy( PrincipalPolicy.WindowsPrincipal); PrincipalPermission principalPerm = new PrincipalPermission(null, "Administrators"); principalPerm.Demand();

Namespace: System.Net WebPermission WebPermission provides a set of methods and properties to control access to Internet resources. You can use a WebPermission to provide either restricted or unrestricted access to your resource, based on the PermissionState that is set when the WebPermission is created.PermissionState Regex myRegex = new WebPermission wp = new WebPermission(NetworkAccess.Connect,myRegex); wp.AddPermission(NetworkAccess.Accept, " wp.Demand();

Namespace: System.Data.OleDb OleDbPermission Enables the.NET Framework Data Provider for OLE DB to help make sure that a user has a security level sufficient to access an OLE DB data source

Namespace: System.Net DnsPermission Controls rights to access Domain Name System (DNS) servers on the network. The default permissions allow all local and Intranet zone applications to access DNS services, and no DNS permission for Internet zone applications. DnsPermission permission = new DnsPermission(PermissionState.Unrestricted); permission.Demand();

References Programming.NET Security, O’Reilly by Adam Freeman, Allen Jones.NET Framework Class Library - System.Security.Permissions Namespace URL: Framework Developer's Guide - Key Security Concepts URL:

QUESTIONS ?