Restricting access to .net plan

Question

I have a web application that can load plugins through reflection. He currently uses Assembly.LoadFrom() and Activator.CreateInstance() to do this. Now plugins are loaded into the same AppDomain and have access to something in my application and to anything that my application can access.

What I'm looking for is a way to limit which classes and methods are available to the plugin for security. I want all my classes and methods to throw an exception when called if they are not white. I would highlight mainly all the functions of the API class and several data transfer objects.

I also do not want the plugin to be able to access the file system or database as it sees fit. I think I can do this with trust levels in a separate AppDomain.

Does anyone have any good ideas or resources? Is this something you can do with Code Access Security or the new Security-Transparent Code features in .net 4?

Answer 1

Using a separate AppDomain is the right approach if you want to apply general access restrictions. As for restricting access to your application-specific logic, just do not give out instances of your "service objects" of the application for plug-in objects. In addition, any objects of a reference type that are not MarshalByRef do not cross the boundaries of the AppDomain, so these objects are safe from access, even if there are discovered methods that try to return them.

Answer 2

I usually trust more, so I would go to a separate application domain,
but on your question, I think you're a little tired, and I.

If you really want to be safe, I would say, load the plugins into a separate process and give the plug-in interface an "interprocess" bridge just for what it needs ...

Thus, you are sure that you only choose what you want to connect the plugin to.

In addition, you can easily run this daemon process as a “weak” user who has limited access to system calls, the file system, and the environment.