Friday 7 September, 2007

.NET Security's Level Of Trust

Recently, I ran into an interesting problem. Its not too big but figuring it out is very frustrating and you hardly find straight forward answers. So, here it is...

PROBLEM:

When I ran my own created installer, which is well tested and works everywhere, I received an exception:

"Unable to create an instance of the type —> Exception has been thrown by the target of an invocation —> That assembly does not allow partially trusted callers."

SOLUTION:

As a Developer:

If you are a developer and don't want your customers to run into this problem, you need to mark your assemblies with the attribute AllowPartiallyTrustedCallersAttribute, the attribute should be declared at the assembly level (usually declared at Assemblyinfo.cs or Assemblyinfo.vb).

C#:
[assembly:AllowPartiallyTrustedCallers]

Visual Basic:
assembly:AllowPartiallyTrustedCallers

This allows partially trusted callers to use your assembly.

As a User:

If you have received an assembly or installer and you are receiving this error, then you need to change .NET security settings of your machine either for this application only or for the complete machine (depends on your requirement :-)).

To provide full trust to the applications running on your machine using .NET, following are the steps (to change security settings of complete machine):

1. Go to Control Panel --> Administrative Tools --> Microsoft .NET Framework 2.0 Configuration.
2. Go to .NET Framework 2.0 Configuration --> My Computer --> Runtime Security Policy.
3. Right click on Runtime Security Policy and click Adjust Security. Security Adjustment Wizard opens.
4. Select “Make changes to this computer”, and click Next.
5. Select My Computer and choose Full Trust, and click Next.
6. Click Finish.

After providing full trust to My Computer, you can then use the application.

Hope that would save some precious time of yours :)

- Mohit

1 comment:

Nico said...

Very useful tidbit you have here. But is there a version of marking the assembly at a higher security level than just allowing partially trusted callers? Like allowing more privileged users? And if so how would you grant those special privileges to users?
**************
Nico del Castillo
Microsoft Security Outreach Team
www.microsoft.com/hellosecureworld7