Understanding CAS in the .NET Framework
If I have provided Evidence to the .net structure in which the group my assembly belongs to, can I falsely provide that I belong to the Trusted Zone code group?
I know what security policies, permission sets, but I do not understand how the infrastructure validates the data and then based on that evidence determines the group of code.
Any explanation would be appreciated.
Thanks:)
The strong name of the assembly, the code base, and other things can be evidence. It can certainly test these things. You manually trust the evidence-based assemblies. Basically, you tell the framework if the assembly has the following properties by giving it this permission. I see no way to provide false evidence. Can you give me an example?
PS. Yes, you could, for example, steal someone's key pair and sign your assembly with that. Like any other security system, it relies on a chain of trust. If you break part of the chain, you are spoiled. There is no real way that you can bypass these security things. Eventually, you can compromise the system with a buffer overflow or something and add your assembly to the full trust list.
a source to share
The various BCL methods that allow the caller to provide evidence are themselves protected by permission requirements. Typically, the caller usually requires at least SecurityPermission \ ControlEvidence, but often requires unrestricted permission to grant the permission (aka "full trust"). (Since SecurityPermission \ ControlEvidence is only granted to locally installed code in accordance with the default CAS policy, there is little practical difference in most situations.) The end result is that only highly trusted code can influence the granting of permission on any given assembly by controlling its proof.
If you think you have found an exception to this general rule, can you provide details?
a source to share