Geek Answers Handbook

Create a hosted CLR AppDomain with full trust permissions, including network rights

I need to host the .NET runtime in an unmanaged process. I have code that works to load the runtime through COM, and I can load assemblies in AppDomain and execute the code just fine.

However, I ran into problems with applications hosted on a network share and must change the application policy to make them execute, which is not an option. So what I would like to do is set the permission level for the main AppDomain application to run without restrictions.

Can someone provide an example of how to set the AppDomain policy level? I cannot figure out how to create the required classes from unmanaged code in order to create a PolicyLevel and related objects and set a policy. Basically, I don’t know what the / namespace links that I need to make this work from the C ++ code that I use.

Here is the code that I have at the moment:

/// Starts up the CLR and creates a Default AppDomain DWORD WINAPI ClrLoad(char *ErrorMessage, DWORD *dwErrorSize) { if (spDefAppDomain) return 1; //Retrieve a pointer to the ICorRuntimeHost interface HRESULT hr = CorBindToRuntimeEx( ClrVersion, //Retrieve latest version by default L"wks", //Request a WorkStation build of the CLR STARTUP_LOADER_OPTIMIZATION_MULTI_DOMAIN | STARTUP_CONCURRENT_GC, CLSID_CorRuntimeHost, IID_ICorRuntimeHost, (void**)&spRuntimeHost ); if (FAILED(hr)) { *dwErrorSize = SetError(hr,ErrorMessage); return hr; } //Start the CLR hr = spRuntimeHost->Start(); if (FAILED(hr)) return hr; CComPtr<IUnknown> pUnk; //Retrieve the IUnknown default AppDomain //hr = spRuntimeHost->GetDefaultDomain(&pUnk); //if (FAILED(hr)) // return hr; WCHAR domainId[50]; swprintf(domainId,L"%s_%i",L"wwDotNetBridge",GetTickCount()); hr = spRuntimeHost->CreateDomain(domainId,NULL,&pUnk); hr = pUnk->QueryInterface(&spDefAppDomain.p); if (FAILED(hr)) return hr; // // Create a new AppDomain PolicyLevel. //PolicyLevel polLevel = PolicyLevel:: CreateAppDomainLevel(); //// Create a new, empty permission set. // PermissionSet permSet = gcnew PermissionSet( PermissionState::Unrestricted); //// Add permission to execute code to the permission set. //permSet->AddPermission( gcnew SecurityPermission( SecurityPermissionFlag::Execution ) ); ////// Give the policy level root code group a new policy statement based ////// on the new permission set. ////polLevel->RootCodeGroup->PolicyStatement = gcnew PolicyStatement( permSet ); //// Give the new policy level to the application domain. //spDefAppdomain->SetAppDomainPolicy( polLevel ); return 1; }

I took the sample code (commented), which seems to do what I need, but I can’t figure out what lib / include links I need to make the type links for PermissionSet and PolicyLevel work.

Any ideas that are much appreciated ...

+7
source share
1 answer

I think you need to use the "non-trivial" method of creating AppDomain to get to any of this kindness:

  • CreateDomainSetup(IUnknown** pAppDomainSetup) , this will return an instance of IAppDomainSetup .
  • Fill it out accordingly (I think all policy materials are available there)
  • Use CreateDomainEx , passing your initialized installation instance as the second parameter
  • Profit?

Literature:

+2
source

More articles:


All Articles