|
security
newsgroups
|
|||||||||||||||||||||||
|
|||||||||||||||||||||||
Suppressing stack walks by PInvoke or IJWDo I have to do something special in order to suppress the stack walks by my PInvoke or IJW calls?
I plan to operate the .dlls only in a fully trusted environment. My first guess is to apply the [SuppressUmanagedCodeSecurity] attributes to: 1) my C# wrapper class since they can make PInvokes calls, 2) every Managed C++ class since they all can make IJW calls. Is this too much or too little? Jon wrote:
> Do I have to do something special in order to suppress the stack walks by my PInvoke or IJW calls? Applying the SuppressUnmanagedCodeSecurity attribute suppresses stack > > I plan to operate the .dlls only in a fully trusted environment. > > My first guess is to apply the [SuppressUmanagedCodeSecurity] attributes to: > 1) my C# wrapper class since they can make PInvokes calls, > 2) every Managed C++ class since they all can make IJW calls. > > Is this too much or too little? > > walks at run time, but not at link time. When P/Invoke code is JIT compiled, it will perform a stack walk on the caller, even if the SuppressUnmanagedCodeSecurity attribute has been applied to the P/Invoke class. All the attribute does is prevent stack walks at run time. It sounds like what you need to do is "assert" the UnmanagedCode permission for all callers of your P/Invoke code. Try this in a wrapper class: SecurityPermission perm = null; perm = new SecurityPermission(SecurityPermissionFlag.UnmanagedCode); perm.Assert(); // call to P/Invoke During the stack walk, that bit of code tells the security system that all callers have the UnmanagedCode permission (whether they do or not). It's *extremely* insecure, and should be used with the utmost care. Note that the P/Invoke assembly itself still needs to have the UnmanagedCode permission. If you're running this over the internet, that means creating a custom code group for your assembly. HTH, Dan
Distributed winforms application security
system.security.securityexception sspi in c# Web Services and Access Control High-strength crypto problems RSA Encrypt/Decrypt with OAEP. OAEP Decryption Error Pls Help! Passing credential between two web sites on same machin Securty around .NET setup program HTTP:500 Internal Server Error |
|||||||||||||||||||||||