C#: What are Partially Trusted Callers?

Question

I haven't seen this clearly defined in one page: Partially Trusted Callers.

I am researching about APTCA and this is always mentioned, but MSDN does not have an article about it.

I only had a few clues, but I am not 100% sure.

• Are code executed from a network share qualify as "Partially Trusted Callers"? Even if we run it as an Administrator (Windows UAC)?
• What are the other ways a .NET App is ran as "Partially Trusted"?
• What are "Partially Trusted Callers" in the ASP.net environment?

I have encountered many articles that mention the business about Partially Trusted Callers, but no direct definition on what they are per se.

Answer 1

Any caller having a trust level other than FullTrust is a Partial Trust Caller.

From the MSDN library for the AllowPartiallyTrustedCallersAttribute Class:

Allows an assembly to be called by partially trusted code. Without this declaration, only fully trusted callers are able to use the assembly.

So if you are creating a library that will be consumed by any assembly without a FullTrust level, you must explicitly declare it using APTCA (AllowPartiallyTrustedCallersAttribute).

Then, how is it determined whenever an application is running as Full or Partial Trust?

The trust level is associated to an AppDomain and it is determined based in what is called an evidence. This is all part of the .NET Code Access Security. This article provides a great overview of its components. From there:

CAS identifies assemblies using evidence, there are a few elements by which an assembly can be identified, such as location, hash code and signature of the assembly. Evidence is the information that the runtime gathers about an assembly to determine which code group the assembly belongs to. Code groups in turn grant an assembly a permission set.

Permissions Sets are unique combinations of security configurations that determine what each user with access to a machine can do on that machine. There are several permission sets shipped with the .NET Framework as in the following table:

• FullTrust: Allow full access to all resources.
• Everything: Allow full access to all resources (group isn't added to assembly list)
• Internet: Grant Default rights.
• SkipVerification: Bypass all security verification
• Nothing: Denies all access including Execution
• Execution: Allows execution-only access.

Therefore, by examining the executing assembly, the CLR would determine whenever an application is either Full or a Partial Trust. And this has implications on what that application is allowed to do, such as access the filesystem, or which libraries it is allowed to call (those marked with APTCA if it is a Partial Trust application).

However, .NET 4 introduced significant changes in security:

By default, unhosted applications are not subject to managed security policy when run under v4.0. Effectively, this means any managed application that you launch from the command prompt or by double clicking the .exe in Windows Explorer will run fully trusted, as will all of the assemblies that it loads (including assemblies that it loads from a location other than the the directory where the executable lives).

As a matter of fact, most of CAS was deprecated except for sand-boxed applications such as ASP.NET and ClickOnce:

(...) in v4 of the CLR, CAS policy has been deprecated and policy decisions are instead left entirely up to the host of an application. However, the other security mechanisms that fell under the name CAS, which allow hosts to configure AppDomains to host sandboxed code and allow library authors to write a safe APTCA library exposing services to partial trust absolutely still exist and are supported.

So, following .NET 4 changes, ASP.NET 4 security also changed and ASP.NET applications are by default full trusted applications. This can however be changed in the configuration by setting the trustLevel attribute to a value different than Full.

So summing up, from .NET 4 and beyond, you can assume that your application runs as Full Trust by default, except you opt-in to CAS through LegacyCasPolicy in the configuration file. Quite the same applies for ASP.NET applications, unless you opt-in to set a different trust level.