SecurityAction Enum
Definition
Important
Some information relates to prerelease product that may be substantially modified before it’s released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Caution
Code Access Security is not supported or honored by the runtime.
Specifies the security actions that can be performed using declarative security.
public enum class SecurityAction
[System.Obsolete("Code Access Security is not supported or honored by the runtime.", DiagnosticId="SYSLIB0003", UrlFormat="https://aka.ms/dotnet-warnings/{0}")]
public enum SecurityAction
public enum SecurityAction
[System.Serializable]
public enum SecurityAction
[System.Serializable]
[System.Runtime.InteropServices.ComVisible(true)]
public enum SecurityAction
[<System.Obsolete("Code Access Security is not supported or honored by the runtime.", DiagnosticId="SYSLIB0003", UrlFormat="https://aka.ms/dotnet-warnings/{0}")>]
type SecurityAction =
type SecurityAction =
[<System.Serializable>]
type SecurityAction =
[<System.Serializable>]
[<System.Runtime.InteropServices.ComVisible(true)>]
type SecurityAction =
Public Enum SecurityAction
- Inheritance
- Attributes
Fields
Name | Value | Description |
---|---|---|
Demand | 2 | All callers higher in the call stack are required to have been granted the permission specified by the current permission object. |
Assert | 3 | The calling code can access the resource identified by the current permission object, even if callers higher in the stack have not been granted permission to access the resource (see Using the Assert Method). |
Deny | 4 | The ability to access the resource specified by the current permission object is denied to callers, even if they have been granted permission to access it (see Using the Deny Method). |
PermitOnly | 5 | Only the resources specified by this permission object can be accessed, even if the code has been granted permission to access other resources. |
LinkDemand | 6 | The immediate caller is required to have been granted the specified permission. Do not use in the .NET Framework 4. For full trust, use SecurityCriticalAttribute instead; for partial trust, use Demand. |
InheritanceDemand | 7 | The derived class inheriting the class or overriding a method is required to have been granted the specified permission. |
RequestMinimum | 8 | The request for the minimum permissions required for code to run. This action can only be used within the scope of the assembly. |
RequestOptional | 9 | The request for additional permissions that are optional (not required to run). This request implicitly refuses all other permissions not specifically requested. This action can only be used within the scope of the assembly. |
RequestRefuse | 10 | The request that permissions that might be misused will not be granted to the calling code. This action can only be used within the scope of the assembly. |
Examples
This example shows how to notify the CLR that code in called methods has only IsolatedStoragePermission, and also demonstrates how to write and read from isolated storage.
using namespace System;
using namespace System::Security;
using namespace System::Security::Permissions;
using namespace System::IO::IsolatedStorage;
using namespace System::IO;
static void WriteIsolatedStorage()
{
try
{
// Attempt to create a storage file that is isolated by
// user and assembly. IsolatedStorageFilePermission
// granted to the attribute at the top of this file
// allows CLR to load this assembly and execution of this
// statement.
Stream^ fileCreateStream = gcnew
IsolatedStorageFileStream(
"AssemblyData",
FileMode::Create,
IsolatedStorageFile::GetUserStoreForAssembly());
StreamWriter^ streamWriter = gcnew StreamWriter(
fileCreateStream);
try
{
// Write some data out to the isolated file.
streamWriter->Write("This is some test data.");
streamWriter->Close();
}
finally
{
delete fileCreateStream;
delete streamWriter;
}
}
catch (IOException^ ex)
{
Console::WriteLine(ex->Message);
}
try
{
Stream^ fileOpenStream =
gcnew IsolatedStorageFileStream(
"AssemblyData",
FileMode::Open,
IsolatedStorageFile::GetUserStoreForAssembly());
// Attempt to open the file that was previously created.
StreamReader^ streamReader = gcnew StreamReader(
fileOpenStream);
try
{
// Read the data from the file and display it.
Console::WriteLine(streamReader->ReadLine());
streamReader->Close();
}
finally
{
delete fileOpenStream;
delete streamReader;
}
}
catch (FileNotFoundException^ ex)
{
Console::WriteLine(ex->Message);
}
catch (IOException^ ex)
{
Console::WriteLine(ex->Message);
}
}
// Notify the CLR to only grant IsolatedStorageFilePermission to called methods.
// This restricts the called methods to working only with storage files that are isolated
// by user and assembly.
[IsolatedStorageFilePermission(SecurityAction::PermitOnly, UsageAllowed = IsolatedStorageContainment::AssemblyIsolationByUser)]
int main()
{
WriteIsolatedStorage();
}
// This code produces the following output.
//
// This is some test data.
using System;
using System.Security.Permissions;
using System.IO.IsolatedStorage;
using System.IO;
// Notify the CLR to only grant IsolatedStorageFilePermission to called methods.
// This restricts the called methods to working only with storage files that are isolated
// by user and assembly.
[IsolatedStorageFilePermission(SecurityAction.PermitOnly, UsageAllowed = IsolatedStorageContainment.AssemblyIsolationByUser)]
public sealed class App
{
static void Main()
{
WriteIsolatedStorage();
}
private static void WriteIsolatedStorage()
{
// Attempt to create a storage file that is isolated by user and assembly.
// IsolatedStorageFilePermission granted to the attribute at the top of this file
// allows CLR to load this assembly and execution of this statement.
using (Stream s = new IsolatedStorageFileStream("AssemblyData", FileMode.Create, IsolatedStorageFile.GetUserStoreForAssembly()))
{
// Write some data out to the isolated file.
using (StreamWriter sw = new StreamWriter(s))
{
sw.Write("This is some test data.");
}
}
// Attempt to open the file that was previously created.
using (Stream s = new IsolatedStorageFileStream("AssemblyData", FileMode.Open, IsolatedStorageFile.GetUserStoreForAssembly()))
{
// Read the data from the file and display it.
using (StreamReader sr = new StreamReader(s))
{
Console.WriteLine(sr.ReadLine());
}
}
}
}
// This code produces the following output.
//
// Some test data.
Option Strict On
Imports System.Security.Permissions
Imports System.IO.IsolatedStorage
Imports System.IO
' Notify the CLR to only grant IsolatedStorageFilePermission to called methods.
' This restricts the called methods to working only with storage files that are isolated
' by user and assembly.
<IsolatedStorageFilePermission(SecurityAction.PermitOnly, UsageAllowed:=IsolatedStorageContainment.AssemblyIsolationByUser)> _
Public NotInheritable Class App
Shared Sub Main()
WriteIsolatedStorage()
End Sub
Shared Sub WriteIsolatedStorage()
' Attempt to create a storage file that is isolated by user and assembly.
' IsolatedStorageFilePermission granted to the attribute at the top of this file
' allows CLR to load this assembly and execution of this statement.
Dim s As New IsolatedStorageFileStream("AssemblyData", FileMode.Create, IsolatedStorageFile.GetUserStoreForAssembly())
Try
' Write some data out to the isolated file.
Dim sw As New StreamWriter(s)
Try
sw.Write("This is some test data.")
Finally
sw.Dispose()
End Try
Finally
s.Dispose()
End Try
' Attempt to open the file that was previously created.
Dim t As New IsolatedStorageFileStream("AssemblyData", FileMode.Open, IsolatedStorageFile.GetUserStoreForAssembly())
Try
' Read the data from the file and display it.
Dim sr As New StreamReader(t)
Try
Console.WriteLine(sr.ReadLine())
Finally
sr.Dispose()
End Try
Finally
t.Dispose()
End Try
End Sub
End Class
' This code produces the following output.
'
' Some test data.
Remarks
Caution
Code Access Security (CAS) has been deprecated across all versions of .NET Framework and .NET. Recent versions of .NET do not honor CAS annotations and produce errors if CAS-related APIs are used. Developers should seek alternative means of accomplishing security tasks.
The following table describes the time that each security action takes place and the targets that it supports.
Important
In .NET Framework 4, runtime support has been removed for enforcing the Deny, RequestMinimum, RequestOptional, and RequestRefuse permission requests. These requests should not be used in code that is based on .NET Framework 4 or later. For more information about this and other changes, see Security Changes.
You should not use LinkDemand
in .NET Framework 4. Instead, use the SecurityCriticalAttribute to restrict usage to fully trusted applications, or use Demand
to restrict partially trusted callers.
Declaration of security action | Time of action | Targets supported |
---|---|---|
LinkDemand (do not use in the .NET Framework 4) |
Just-in-time compilation | Class, method |
InheritanceDemand |
Load time | Class, method |
Demand |
Run time | Class, method |
Assert |
Run time | Class, method |
Deny (obsolete in the .NET Framework 4) |
Run time | Class, method |
PermitOnly |
Run time | Class, method |
RequestMinimum (obsolete in the .NET Framework 4) |
Grant time | Assembly |
RequestOptional (obsolete in the .NET Framework 4) |
Grant time | Assembly |
RequestRefuse (obsolete in the .NET Framework 4) |
Grant time | Assembly |
For additional information about attribute targets, see Attribute.