Viewing Assembly Permissions

Introduction

In this article I will show you how you can view the Code Groups that an assembly belongs to and what permissions belong to the assembly. I will demonstrate the Caspol utility supplied with the .NET SDK.

When would you need to view access rights?

When a developer creates an assembly, he or she may require access to a resource or action that may usually be available to an assembly used by most users or clients. There may be times when the Administrator of a host for his or her own reasons has restricted the action or resource required by the developer's assembly. This restriction could cause the assembly to function improperly or fail all together when the security exception(s) is thrown. Viewing the requirements of the assembly could help you narrow down the problem and determine if the problems are security issues.

Code Groups and Permission Sets

Code Groups - Security Policies have several levels such as the Machine policy level, the User Policy level or the Application Domain Policy level. Within these policy levels is a hierarchy of code groups. The Code Groups then break down into child nodes of other groups (Strong name, URL, App directory, etc.). The condition of each Code Group is called the Membership Condition. Each Membership Condition must be met in order for an assembly 's code to be part that Code Group. Each Code Group contains a permission set.
Permission Sets - Each of the Policy Levels mentioned above: Machine, User, and Application Domain, supply the assembly with their combined permissions to create the assembly's Permission Set.

What is CASPol?

CASPol is a command line utility that is included with the .NET run time SDK. CASPol stands for Code Access Security Policy. It is used to administer policy changes as well as view existing permissions and Code Group hierarchy.

Your default view will be determined by your current access permissions (machine or user). Your default view if you do not currently have administrative permissions will be the Users view. In the samples below, I will explicitly specify either the Machine policy level or the User policy level. When both should be displayed together, the -all option will be used.

Viewing the Code Groups

To view the Code Groups we will use the CASPol utility. Using the -all option lets you see both the user and machine groups at the same time.

CASPol -all -resolvegroup hello.dll

The above command will show the code groups that a specific assembly file belongs to. In the above example I used a library called hello.dll. This could however be replaced with any assembly, even caspol.exe itself. The hello.dll is the module that was used in my article " Assemblies: The Ins and Outs - Part 2". There are no custom or added restrictions in the hello.dll assembly. An example of the commands output looks like:

Microsoft (R) .NET Framework CasPol 1.0.2204.21
Copyright (c) Microsoft Corp 1999-2000. All rights reserved.
Level = Machine
Code Groups:
1. All code: Nothing
1.1. Zone - MyComputer: FullTrust
Level = User
Code Groups:
1. All code: FullTrust
Success

The output above is brief and simple but is sufficient to demonstrate what you can expect to see when viewing the groups. In the example above, the first item we see is one of the policy levels. The first policy listed is the Machine policy. Then the Code Groups that our code belongs to are listed. At the Machine level our code belongs to the All Code group which uses the built-in permission set called Nothing, (Other non modifiable built-in permission sets include Execution, and FullTrust). The permission set called "Nothing", prohibits all resources, including the right to execute code. However, the All Code group has a subgroup called Zone. The Zone group requires that I meet the MyComputer Membership Condition, and if I do then the FullTrust permission set is used. FullTrust allows full access to all resources.

The next policy level listed is the User level. The User level specifies that I have FullTrust permissions to run all code.

Finally the program displays that it ran successfully.

Viewing the Permissions

If you are viewing an assembly's permission sets for diagnostic reasons than you may want to use the -all option with CASPol. You would want to do this because when the assembly is run, its being run by a user. When a user runs a program the machine and user policies are combined including the application domain's policy. Using the -all option lets you see both the user and machine permission sets at the same time.

CASPol -all -resolveperm hello.dll

The above command shows the Permission Sets that a specific assembly file belongs to. Again I used the library called hello.dll. This could however be replaced with any assembly. An example of the commands output looks like:

Microsoft (R) .NET Framework CasPol 1.0.2204.21
Copyright (c) Microsoft Corp 1999-2000. All rights reserved.
Resolving permissions for level = Machine
Resolving permissions for level = User
Grant =
<PermissionSet class="System.Security.PermissionSet" version="1">
<Unrestricted/>
<Permission class="System.Security.Permissions.StrongNameIdentityPermission,
mscorlib, Ver=1.0.2204.21, Loc='', SN=03689116d3a4ae33" version="1">
<PublicKeyBlob>
<Key>00240000048000009400000006020000002400005.......</Key>
</PublicKeyBlob>
<Name>hello</Name>
<Version>1.0.444.35256</Version>
</Permission>
<Permission class="System.Security.Permissions.URLIdentityPermission, mscorlib,
Ver=1.0.2204.21, Loc='', SN=03689116d3a4ae33" version="1">
<Url>file:///D:/Projects/hello.dll</Url>
</Permission>
<Permission class="System.Security.Permissions.ZoneIdentityPermission, mscorlib,
Ver=1.0.2204.21, Loc='', SN=03689116d3a4ae33" version="1">
<Zone>MyComputer</Zone>
</Permission>
</PermissionSet>
Success

In the example above, the first item we see are the policy levels. The output above combines both the Machine and User policies to display what permissions my code has been granted.

The Permission Set itself is set to Unrestricted allowing all permissions to be available. Next there are three specific sets of permissions being demanded:

StrongNameIdentityPermission - The hello.dll library contains a strong name (it is a Shared Assembly using public key cryptography). This permission contains the public key that must be matched for other code to make valid calls to this assembly. I shortened the cryptographic number for display.
URLIdentityPermission - This is the URL of where the code originated. If you are viewing one of your own assemblies, you will most likely see the path that you compiled to.
ZoneIdentityPermission - This permission determines if the calling code is from a specific zone. Only exact zone matches can be defined for this permission, and a URL can only belong to a single zone.

The -all option can also be abbreviated to just -a in the command.

Worth Mentioning

Another option that can be used with the CASPol utility is the -list option. The -list option shows the list of code groups followed by a list of named permission sets available in the most recent displayed policy. The output from the command below is for your entire current configuration, and not just for a single assembly. So this command is good for getting an overall look at your permissions.

CASPol -list

If the output from the above command is too long for your shell window, then try using the following command. This will save the output to text file called output.txt.

CASPol -list > output.txt

To shorten the output further you could use the following command to list all Code Groups for your current configuration:

CASPol -listgroups

This would display just the Code Groups and produce an output similar to the following:

Security is ON
Execution checking is OFF
Policy change prompt is ON
Level = Machine
Code Groups:
1. All code: Nothing
1.1. Zone - MyComputer: FullTrust
1.1.1. Honor SkipVerification requests: SkipVerification
1.2. Zone - Intranet: LocalIntranet
1.2.1. All code: Same site Socket and Web.
1.3. Zone - Internet: Internet
1.4. Zone - Untrusted: Nothing
1.5. Zone - Trusted: Internet
1.6. StrongName - 0024000004800000940000000......: Everything
Success

CASPol -listpset would also do the same as the previous command except that only the permission sets would be displayed.

Summary

The output from the hello.dll module was a very short example with very few restricted permissions. Using the CASPol utility to view restrictions for a specific assembly will allow you to discover what permissions your assembly needs to run. Using the CASPol -list command will allow you to get familiar with what permissions are available to you as a user or administrator.