70-536 - 11 - Application Security

Front 1

How to determine which code groups grant permissions to an assembly?

Back 1

- Configuration tool
- Runtime Security Policy
- Evaluate Assembly
- Select File, Type of evaluation, policy level to evaluate

Front 2

What is "Walking-the-call-stack" check?

Back 2

It ensures that an assembly that does not have a required permission cannot use one that does to illegaly perform an operation

Front 3

What exception is thrown if an assembly is trying to peform an action which is not allowed?

Back 3

System.Security.SecurityException

Front 4

What is a Permission Set?
Name them

Back 4

Is a set of permission which can be created and applied programmatically by creating and adding individual permission objects to a PermissionSet. Nothing, Execution, Internet, LocalIntranet, Eveything, FullTrust

Front 5

What is a Security Policy?

Back 5

Defines how assembly evidence is evaluated to determine the permissions that are granted to the assembly

Front 6

What is an evidence?

Back 6

Evidence is a collection class that holds two sets. Host evidence and assembly evidence. The host evidence describes the origin can include URL, Hash, Publisher, Site etc. Assembly evidence is custom user- or developer provided evidence. It is used by the runtime to determine which code groups the assembly belongs

Front 7

What is a CAS permission?

Back 7

A permission is a CAS access control entry. Like FileDialog, Isolated Storage File etc. Every permission can have different attributes, like Read or Write etc. It is used in sets lik the PermissionSet LocalIntranet

Front 8

Can CAS controll fully trusted and unmanaged code?

Back 8

No, only partly trusted managed code.

Front 9

What is a permission set? List some of the default permission sets. What is the nothing permission set?

Back 9

A permission set is a collection of permissions.
- Full Trust, Internet etc.
Nothing - No permission to an assembly. The assembly is not even allowed to run. Permission sets are assigned to Code groups

Front 10

What are code groups?

Back 10

Its a logical grouping of code that has a specified condition for membership. Any code that meets the membership condition (Evidence types, URL, Site, Publisher...) is included in the group. The code group has a permission set

Front 11

Explain the logic behing Permission, PermissionSet, Code Group, Evidence, Security Policy and an Assembly.

Back 11

The Code group groups code logically which match a special condition. This condition is the Evidence type provided by the assembly. Can be by origin or signature. The code group then gets a permission set which consists of 0 or more permissions. The Security Policy groups those groups for User, Machine, Enterprise, Application Domain.

Front 12

How to add a new code group and assign a NEW permission set

Back 12

Open mscorcfg.msc and go to
"Runtime Security Policy" choose a Securit Policy and right click on ALL_CODE and a new code group. Choose a condition to logically group the code and click next and create a new permission set

Front 13

What is caspol.exe?

Back 13

Code Access Security Policy command line tool.

Front 14

What are the 3 reasons to use CAS declarations?

Back 14

1. Least Priviledge
2. Application doesn't run application if not enough rights are assigned
3. To verify that the application can run with the limited CAS permissions and can therefore run in partially trusted environment

Front 15

What CAS declarations has to be made to debug an assembly

Back 15

[assembly:UIPermission(SecurityAction.RequestMinimum, Unrestricted = true]

Front 16

What a the CAS declaration classes and what is the base class? What is the namespace?

Back 16

CAS declaration classes are declared before the namespace declaration/class in a source code file. Each class has unique members but they all have Action and Unrestricted members as they derive from the CodeAccessSecurityAttribute class. System.Security.Permission

Front 17

What are the 3 types for Assembly security actions?

Back 17

SecurityAction.RequestMinimum - Requires a permission, if not it throws a SecurityException
SecurityAction.RequestOptional -
"Refuse except" - does not throw an exception before the actual action.
SecuritAction.RequestRefuse - Refuses the permission assigned to the application. No excpetion before action

Front 18

WHat is the best practise for security declarations in assemblies?

Back 18

Use SecurityAction.RequestOPtional and SecurityAction.RequestMinimum. So an exception is thrown before the assembly is loaded when it doesn't have enough rights and it refuses all other right and hence it can't be missused by other assemblies

Front 19

What are the 6 Types of Permission Requests? What is the base class?

Back 19

Assert - The calling code can access the resource identified by the current permission object, even if callers higher in the stack have not been granted permission to access the resource
Demand - Throws exception if caller and all callers higher in the stack lack the specified permission.
Deny - Causes the runtime to reduce the method's access by removing the specified permission
InheritanceDemand - Instructs the runtime to throw an exception if the assembly inheriting from the class lacks the specified permission
LinkDemand - Causes the runtime to throw an exception if the immediate caller but no callers higher in the stack, lack the specified permission
PermitOnly - Instructs the runtime to reduce the method's access by removing all permissions except for the specified permissions

CodeAccessPermission

Front 20

What is the difference between declarative and imperative Security for classes and methods?

Back 20

Declarative security performs security checks prior to running the code but imperative security the code checks itselfs the permissions and handles the results/exception

Front 21

How to analyse granted permissions with imperative security?

Back 21

use the static method System.Security.SecurityManager.
IsGranted(myPermission)

Front 22

Avoid redundant demands?

Back 22

Most classes in .NET use demands to ensure the callers have the permissions. Like StreamWriter

Front 23

Can declarative security creteria be dynamic?

Back 23

No, it must be static. Use imperative declarations instead

Front 24

How to imperatvely limit a permission? deny access to c:\windows

Back 24

FileIOPermission myPermission = new FileIOPermission(FileIOPermissionAccess.AllAccess,
@"c:\Windows");
myPermission.Deny();

Front 25

What must the assembly have to use the SecurityAction.Assert action and how often can you use assert in a method?

Back 25

1. SecurityPermissionFlag.Assertion as well as being the privilege being asserted.
2. Only once, use Permission sets instead

Front 26

How to use permission sets for imperative security?

Back 26

PermissionSet mySet = new PermissionSet(PermissionState.None);
mySet.Add(new FileIOPermission(FileIOPermissionAccess.Read, @"C:\Windows"));
mySet.Demand();