.net 4 partial trust an assembly from GAC

Question

I am trying to create a sandboxed app-domain. To achieve this, I am using the AppDomain.CreateDomain, giving the path to of the DLL to be sandboxed.

However, I noticed that if that DLL is in the GAC, then the DLL is fully trusted, thus if there will be a PermissionSet.Assert in there, it can receive unrestricted access.

So, I was wondering if there is a way to either

1. force the DLL to load from the path, and not from the GAC, thus it will be partial-trusted.
2. or - mark a certain DLL in the GAC to be partial trusted.

Thanks!

Answer 1

If both assemblies are fully signed, then the CLR is going to use the one in the GAC. If you leave the one in the targeted path unsigned, the CLR will use that one instead.

If that is not an option, then you need to use one of the CreateDomain overrides where you can define the permission set that the assembly will need. More information about the override can be found here: http://msdn.microsoft.com/en-us/library/ms130766.aspx.

An example of the usage as taken from http://davedewinter.com/2009/05/22/how-to-host-a-partial-trust-sandbox/...

static void RunInPartialTrust()
{
    AppDomainSetup setup = new AppDomainSetup
    {
        ApplicationBase = Environment.CurrentDirectory
    };

    PermissionSet permissions = new PermissionSet(null);
    permissions.AddPermission(new SecurityPermission(SecurityPermissionFlag.Execution));
    permissions.AddPermission(new ReflectionPermission(ReflectionPermissionFlag.RestrictedMemberAccess));
    AppDomain appDomain = AppDomain.CreateDomain(
        "Partial Trust AppDomain",
        null,
        setup,
        permissions
    );

    Program p = (Program)appDomain.CreateInstanceAndUnwrap(
        typeof(Program).Assembly.FullName,
        typeof(Program).FullName
    );

    p.PartialTrustMain();
}