Changing Trust for a Zone Using the Adjust Security Wizard

for RuBoard

If an increase of trust to a specific assembly or publisher is not sufficient for the policy change scenario you have in mind, the Adjust Security Wizard offers a quick and easy way to make very wide reaching security policy changes. With this Wizard, you can change the level of trust all assemblies from a whole zone, such as the Internet, receive.

CAUTION

Because this Wizard offers such an easy way to make sweeping policy changes, it also makes it easy to open a security vulnerability. Be careful and very certain of what you are doing before setting the Internet, Intranet, Restricted Site, or Trusted Site zones to the FullTrust setting!

The following are typical scenarios in which this Wizard is used.

• Scenario You or your corporation decides not to allow assemblies from the intranet zone to run.

  Wizard action:

  1. Start the Adjust Security Wizard by either right-clicking the Runtime Security Policy node or selecting the Adjust Zone Security task.

  2. Select Make Changes to This Computer (default).

  3. Select the intranet zone and reduce the slider to the Nothing position.

  4. Finish and commit the changes.

• Scenario There is tight control over all code that gets installed on your intranet. You are confident that it needs more access to protected resources than what the default policy grants and, furthermore, that all installed intranet code can be trusted.

  Wizard action:

  1. Start the Wizard and select Make Changes to This Computer.

  2. Select the Intranet zone and increase the slider setting to the Full Trust position.

  3. Finish and accept the policy changes.

• Scenario You decide to lower the level of trust given to all code running from the intranet just for your user context; you do not want to interfere with the settings other users have for their user security policy.

  Wizard action:

  1. Start the Wizard and select Make Changes for the Current User Only.

  2. Select the intranet zone and decrease the slider setting to the Nothing position.

  3. Finish and accept the policy change.

• Scenario You decide to change default policy and enable code running from the Internet. You want this code to run within tight security constraints.

  Wizard action:

  1. Start the Wizard and select Make Changes to This Computer.

  2. Select the Internet zone and increase the slider setting to the Internet position.

  3. Finish and accept the policy changes.

The individual Wizard options are now explained in more detail.

Choosing to Make Changes to the Machine or User Policy

The first Wizard page that you will see is identical to, and serves the same purpose as, the start page on the Trust Assembly Wizard (as shown in Figure 18.5). Here, you can choose whether the Wizard should be applied to machine-wide security policy or just the user-level security policy. For most policy changes, you will want to abide by the default (by choosing Make Changes to This Computer). That option will imply a change of zone security settings for all users on that machine. However, if you choose to make user policy level changes, the zone security changes will only be applied against user security policy.

NOTE

If the security policy has been changed to contain a level final attribute at a policy level above the one you are applying the Wizard to, the security policy may never evaluate the policy level to which you apply the Wizard. For example, when choosing the option to make changes to your computer, the machine-wide security policy is modified. However, if the enterprise policy level contains a level final attribute, the Wizard's changes may never be effective. Thus, if applying the Wizard does not show any results, you may want to analyze policy levels above the one you applied to the Wizard for the level final code group property. (See "Manipulating the Security Policy Tree DirectlyBasic Techniques" later in this chapter for more detail.)

Choosing a Level of Trust for a Zone

After selecting the scope of policy change, you will be presented with the page shown in Figure 18.9. To adjust the level of trust for a given zone, simply click the zone name and then adjust the slider.

Figure 18.9. Changing the trust given to all assemblies from a specific zone.

Comparable to the slider settings for the Trust Assembly Wizard, each slider setting corresponds to the amount of trust the default policy gives to assemblies from MyComputer zone, LocalIntranet zone, and Restricted site zone. The Internet slider setting is the odd one out here. It corresponds to the suggested permission level for assemblies from the Internet. However, you need to explicitly enable assemblies from the Internet; default security policy does not grant any permissions to assemblies from the Internet.

• FullTrust slider setting All code running with this level of trust will not be subject to security checks of the .NET Framework security system. The only security settings that act on code with this level of trust are the operating system's security settings for the user under whose context the code is running. The corresponding permission set expressing this level of trust is the FullTrust permission set.

CAUTION

The FullTrust setting is the only slider setting that does not enforce a strict security context on code running from the respective zone. It opens access to all resources not protected by operating system security settings. Please be absolutely certain that you want to give that level of trust to all assemblies from the respective zone. If you want to only give full trust to a subset of assemblies from a zone, either use the Trust Assembly Wizard or manipulate the policy tree directly (as will be explained later in this chapter).

• 2 ^nd slider position (just under FullTrust) This slider position corresponds to the level of trust that the default policy grants to all assemblies from the intranet zone. This setting will not allow assemblies to access the file system or registry directly, among other things, but will still enable full user interface interaction, as well as the capability to connect back to the site of origin of the assembly. Assemblies executing at this level of trust are still strongly checked and prevented from doing substantial harm.

• 3 ^rd slider position (just above Nothing) This slider setting represents the level of trust given by the default policy to all assemblies from the Internet zone. In addition to the restrictions already active in the previous slider setting, assemblies will also not be able to have full user interface access, nor will they be able to have read access to select environment variables . However, they can still connect back to their site of origin. This level of trust represents a safe security context for any assembly to run it. Access to protected resources is minimized.

• 4 ^th slider position (Nothing setting) This slider setting represents the level of trust (or rather lack of) given to the restricted site zone in default policy. Assemblies will not receive any permission to access protected resources (such as the file system or registry), nor will they receive the permission to even execute. This slider position should be used if you want to exclude assemblies from a certain zone to run on your machine.

TIP

Of course, the ultimate form of computer security is not to run any code. The slider Wizard allows you to do just that for all code from a specific zone. If you have no need to run assemblies from a specific zone (such as the intranet), you should strongly consider just setting the slider for that zone to Nothing.

The Wizard will match the currently set level of trust for a given zone to a slider setting. If you want to return to the default policy setting for that zone, simply click the Default button.

NOTE

If security policy has changed significantly from the default policy, the level of permissions that a specific zone receives may not exactly match one of the four slider settings anymore. In such cases, the Wizard will not be able to display the slider and simply gives you the option to return to the default policy for the zone. If you do decide to return to the default policy setting for that zone, the slider will reappear with the setting corresponding to default policy. Be aware, however, that this will delete any policy customizations that may have been done for that zone.

After you have adjusted the trust for a zone or zones, all that remains to do is to accept these changes and finish the Wizard. Security policy is changed, persisted , and effective immediately for all assemblies loaded after the change has been made.

TIP

You can change settings for multiple zones in one Wizard session. Consequently, if you need to adjust security for two or more zones, you can get this done in one pass through this Wizard.

for RuBoard