I've been cleaning up the System.Security.Permissions and System.Security.Policy classes for the last two weeks. Many small issues were fixed in the process, which in turns let us runs more useful samples.
Today I got to run the MSDN documentation sample for PermissionSet. This is a nice one because, like the previous sample, it involves only CAS Demand but it also use all set-operations, Intersect, IsSubsetOf and Union, between different permission types: FileDialogPermission and EnvironmentPermission.
Here the results on Linux:
<![CDATA[
Executing PermissionSetDemo
Adding permission to open a file from a file dialog box.
Demanding permission to open a file.
Demand succeeded.
Adding permission to save a file from a file dialog box.
Demanding permission to open and save a file.
Demand succeeded.
Adding permission to read environment variable USERNAME.
Demand succeeded.
Adding permission to read environment variable COMPUTERNAME.
Demand all permissions.
Demand succeeded.
Number of permissions = 2
IsSynchronized property = False
IsReadOnly property = False
SyncRoot property = <PermissionSet class="System.Security.PermissionSet"
version="1">
<IPermission class="System.Security.Permissions.FileDialogPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Unrestricted="true"/>
<IPermission class="System.Security.Permissions.EnvironmentPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Read="USERNAME"
Write="COMPUTERNAME"/>
</PermissionSet>
ContainsNonCodeAccessPermissions method returned False
Value of the permission set ToString =
<PermissionSet class="System.Security.PermissionSet"
version="1">
<IPermission class="System.Security.Permissions.FileDialogPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Unrestricted="true"/>
<IPermission class="System.Security.Permissions.EnvironmentPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Read="USERNAME"
Write="COMPUTERNAME"/>
</PermissionSet>
Second permission IsSubsetOf first permission = True
The intersection of the first permission set and the second permission set = <PermissionSet class="System.Security.PermissionSet"
version="1">
<IPermission class="System.Security.Permissions.EnvironmentPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Read="USERNAME"
Write="COMPUTERNAME"/>
</PermissionSet>
The union of permission set 3 and permission set 4 = <PermissionSet class="System.Security.PermissionSet"
version="1">
<IPermission class="System.Security.Permissions.EnvironmentPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Read="USERNAME"
Write="COMPUTERNAME"/>
<IPermission class="System.Security.Permissions.FileIOPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Append="/home/poupou/src/cas/msdnlib/SomeFile"
Read="/home/poupou/src/cas/msdnlib/SomeFile"
Write="/home/poupou/src/cas/msdnlib/SomeFile"/>
</PermissionSet>
The last permission set after removing FileIOPermission = <PermissionSet class="System.Security.PermissionSet"
version="1">
<IPermission class="System.Security.Permissions.EnvironmentPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Read="USERNAME"
Write="COMPUTERNAME"/>
</PermissionSet>
Permission set after SetPermission = <PermissionSet class="System.Security.PermissionSet"
version="1">
<IPermission class="System.Security.Permissions.EnvironmentPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Read="USERNAME"
Write="USERNAME"/>
</PermissionSet>
Result of ToFromXml = <PermissionSet class="System.Security.PermissionSet"
version="1">
<IPermission class="System.Security.Permissions.EnvironmentPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Read="USERNAME"
Write="USERNAME"/>
</PermissionSet>
<IPermission class="System.Security.Permissions.FileDialogPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Unrestricted="true"/>
<IPermission class="System.Security.Permissions.EnvironmentPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Read="USERNAME"
Write="COMPUTERNAME"/>
Permission set is unrestricted = True
Result of copy = <PermissionSet class="System.Security.PermissionSet"
version="1">
<IPermission class="System.Security.Permissions.EnvironmentPermission, mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
version="1"
Read="USERNAME"
Write="USERNAME"/>
</PermissionSet>
]]>
Results on Windows (MS runtime) are 100% compatible but not identical due to the ordering of the permissions and the path separators used.
PermissionSet turned out to be a bit more complex than anticipated as it must deal with permissions that do not implement the IUnrestrictedPermission interface (e.g. all identity permissions) which affects all set operations. Also PermissionSet.Demand must take care about non-CAS permissions, like PrincipalPermission and avoid the stack walk if possible.
Oops I almost forgot that I needed your help! The default policies used by the framework are really simple compared to what the .NET framework is capable of. I'd like to know if you, or your company, use any custom policies (entreprise, machine or user specific) or if you have coded any appdomain specific policies. If possible I'd like the XML policies files (cleaned) and/or details of the appdomain policy to plan for the CAS test suite. Thanks :-).
