5

I'm currently trying to create a very very simple sandbox.

Some class A has a method Execute which is invoked in another AppDomain than the caller.

Problem is I've execution permission only and reflection is possible anyway.

This is the code sample:

[Serializable]
public class A : MarshalByRefObject
{
    public void Execute()
    {
        typeof(A).GetConstructor(Type.EmptyTypes).Invoke(null); // Fine - Why?
        typeof(B).GetConstructor(Type.EmptyTypes).Invoke(null); // Fine - Why?
    }
}

public class B
{

}

class Program
{
    static void Main(string[] args)
    {
        PermissionSet set = new PermissionSet(PermissionState.None);

        SecurityPermission security = new SecurityPermission(SecurityPermissionFlag.Execution);
        set.AddPermission(security);

        Evidence evidence = new Evidence();
        AppDomainSetup setup = new AppDomainSetup();
        setup.ApplicationBase = "C:";

        AppDomain domain = AppDomain.CreateDomain
        (
            "hello",
            evidence,
            setup,
            set
        );

        A a = (A)domain.CreateInstanceAndUnwrap(Assembly.GetExecutingAssembly().FullName, typeof(A).FullName);
        a.Execute();
    }
}

UPDATE

Great! Finally I did it.

Thanks to your advices I've revised my code and I'd like to share it with you, since I had a hard time understanding how to don't use CAS but use same kind of permissions in the new .NET 4.x and above security model, and the way of sandboxing using an AppDomain. That's it:

using System;
using System.Reflection;
using System.Security;
using System.Security.Permissions;
using System.Security.Policy;

namespace ConsoleApplication1
{
    [Serializable]
    public class A : MarshalByRefObject
    {
        public void Execute()
        {
        B b = new B();

        // BOMB! ERROR! Security demand: reflection forbidden!
        b.GetType()
                .GetMethod("ExecuteInB", BindingFlags.Instance | BindingFlags.NonPublic)
                    .Invoke(b, null);
        }
    }

    public class B
    {
        private void ExecuteInB()
        {

        }
    }

    class Program
    {
        static void Main(string[] args)
        {
            PermissionSet set = new PermissionSet(PermissionState.None);

            SecurityPermission security = new SecurityPermission(PermissionState.None);
            security.Flags = SecurityPermissionFlag.Execution;
            set.AddPermission(security);

            Evidence evidence = new Evidence();
            AppDomainSetup setup = new AppDomainSetup();
            setup.ApplicationBase = "C:";

            AppDomain domain = AppDomain.CreateDomain
            (
                "hola",
                evidence,
                setup,
                set
            );

            A a = (A)domain.CreateInstanceAndUnwrap("ConsoleApplication1", "ConsoleApplication1.A");
            a.Execute();
        }
    }
}

3 Answers 3

11

Reflection permission is demanded when invoking an inaccessible member. A and B are public types with public constructors, and so are accessible. You could invoke those constructors without reflection, so there is no demand when you attempt to do so with reflection.

Moreover, using reflection for discovery is always legal; you can interrogate an object and ask it for a list of its private members, even without reflection permission being granted. It is only when you attempt to cause an invocation of the private member that the permission is demanded.

0
2

From MSDN Library: ReflectionPermission controls access to non-public types and members through the System.Reflection APIs. Without ReflectionPermission, code can use reflection to access only the public members of objects.

0
1

Have you checked your code on .net 3.5? .NET 4 has a new security model where the grant sets do no longer affect the sansbox. I was seriously bitten by this when I wanted to test code intended to run in medium trust contexts on a full trust .net process.

A possible solution is to force the CLR to use the legacy security model and then explicitly deny ReflectionPermission in the new AppDomain.

Sorry for the partial answer, I'm on mobile right now but will check back tomorrow. Hope this gets you started.

8
  • On top of that, I think you cant deny public reflection, only private reflection is affected. Feb 9, 2012 at 21:07
  • No, I didn't in 3.5. I know about this security change, but I don't find how to achieve this result w/o using permissions. Feb 9, 2012 at 21:42
  • Neither did I, so I did use NetFx40_LegacySecurityPolicy. Eric is right wrt to the effect of ReflectionPermission. I would love to present you a better solution than this, but unfortunately I have none. Keep us posted when you find something new. Feb 10, 2012 at 7:22
  • Sadly I won't be able to dig more on this until this evening (GMT+1). But as far as I know, Microsoft has never said permissions are obsolete. CAS is obsolete, but anyway, this AppDomain.CreateDomain overload is the recommended now for creating sandboxes in .NET 4 and above (now I'm @ work, I can't use my time to look for the MSDN article, but I'm absolutely sure about this). The point is Microsoft has declared CAS obsolete and they talk a lot about a "new security model" but there's few documentation about "how to use this new model" [...] Feb 10, 2012 at 8:37
  • [...] and they talk about using OS-level restrictions with Windows Restriction Policies, but I don't find how to implement Restriction Policies in order to restrict code-level things... Feb 10, 2012 at 8:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.