Copying Files from Network to Local

[Jerad Rose]

I have a fairly simple C# console app which copies files from a network
folder to a local folder. When the app resides on my local C: drive, it
runs just fine. However, when the app resides on a network drive, copying
the same files from the same source drive and to the same destination drive,
it gives me the following exception:

System.Security.SecurityException: Request for the permission of type
System.Security.Permissions.FileIOPermission, mscorlib, Version=1.0.5000.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089 failed.
at System.Security.CodeAccessSecurityEngine.CheckHelper(PermissionSet
grantedSet, PermissionSet deniedSet, CodeAccessPermission demand,
PermissionToken permToken)
at System.Security.CodeAccessSecurityEngine.Check(PermissionToken
permToken,CodeAccessPermission demand, StackCrawlMark& stackMark, Int32
checkFrames, Int32 unrestrictedOverride)
at System.Security.CodeAccessSecurityEngine.Check(CodeAccessPermission
cap, StackCrawlMark& stackMark)
at System.Security.CodeAccessPermission.Demand()
at System.IO.DirectoryInfo..ctor(String path)

It seems as if it is assuming the rights of the remote server from which it
is running, even though the app is obviously running as a local process --
this makes absolutely no sense to me. Why does the app assume a totally
different set of permissions just because it resides in a different
location? To me, it seems like the permissions should only be driven by the
process from which it is running, and the identity that is active when
running the application.

Can someone explain to me why I am getting this error, and how I can get
around it so that I can have this app site on a network directory, and copy
files from that same directory to a local directory?

Thanks in advance.

Jerad

 

[Nicholas Paldino [.NET/C# MVP]]

Jerad,

You will want to look at Code Access Security. The rights that you have
are not only based on the identity that launched the process, but the the
code itself.

So, if code came from another place (a website, for example), and tried
to do something malicious, it couldn't even if it was running under you, as
administrator.

As a general rule, code that executes on your machine doesn't have any
limitations put on it. Code that is loaded from the network, or from a
website has less trust associated with it, and less permissions assigned to
it.

Now, you can change this, by identifying the code (by location, hash, or
strong name) and then assigning the appropriate permission set to the code.
However, this requires a conscious effort on your part. So in other words,
they let you shoot yourself in the foot if you want to, but you have to
agree to it, so you can't say it was anyone else's fault if something gets
wrecked. =)

You would do this in the .NET Framework configuration apps which are
found in Administrative Tools.

Hope this helps.

 

[Jerad Rose]

Thanks for your response, Nicholas. I did make an attempt to get this
working using Code Access Security (after getting your feedback), but I was
unsuccessful. Unfortunately, I am under a deadline that does not give me
the luxery of time required to figure this out, considering the learning
curve and the fact that I have no prior experience with developing with Code
Access Security. We ultimately ended up going the dirty route of a batch
file to do our installation. By the way, this was for a deployment
application for some C# interop components we developed for use by a VB6
application.

Thanks again for your time and response.

Jerad

Jerad,

You will want to look at Code Access Security. The rights that you
have are not only based on the identity that launched the process, but the
the code itself.

So, if code came from another place (a website, for example), and tried
to do something malicious, it couldn't even if it was running under you,
as administrator.

As a general rule, code that executes on your machine doesn't have any
limitations put on it. Code that is loaded from the network, or from a
website has less trust associated with it, and less permissions assigned
to it.

Now, you can change this, by identifying the code (by location, hash,
or strong name) and then assigning the appropriate permission set to the
code. However, this requires a conscious effort on your part. So in other
words, they let you shoot yourself in the foot if you want to, but you
have to agree to it, so you can't say it was anyone else's fault if
something gets wrecked. =)

You would do this in the .NET Framework configuration apps which are
found in Administrative Tools.

Hope this helps.


--
- Nicholas Paldino [.NET/C# MVP]
- (e-mail address removed)

I have a fairly simple C# console app which copies files from a network
folder to a local folder. When the app resides on my local C: drive, it
runs just fine. However, when the app resides on a network drive, copying
the same files from the same source drive and to the same destination
drive, it gives me the following exception:

System.Security.SecurityException: Request for the permission of type
System.Security.Permissions.FileIOPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
failed.
at System.Security.CodeAccessSecurityEngine.CheckHelper(PermissionSet
grantedSet, PermissionSet deniedSet, CodeAccessPermission demand,
PermissionToken permToken)
at System.Security.CodeAccessSecurityEngine.Check(PermissionToken
permToken,CodeAccessPermission demand, StackCrawlMark& stackMark, Int32
checkFrames, Int32 unrestrictedOverride)
at System.Security.CodeAccessSecurityEngine.Check(CodeAccessPermission
cap, StackCrawlMark& stackMark)
at System.Security.CodeAccessPermission.Demand()
at System.IO.DirectoryInfo..ctor(String path)

It seems as if it is assuming the rights of the remote server from which
it is running, even though the app is obviously running as a local
process -- this makes absolutely no sense to me. Why does the app
assume a totally different set of permissions just because it resides in
a different location? To me, it seems like the permissions should only
be driven by the process from which it is running, and the identity that
is active when running the application.

Can someone explain to me why I am getting this error, and how I can get
around it so that I can have this app site on a network directory, and
copy files from that same directory to a local directory?

Thanks in advance.

Jerad