NGWS SDK Documentation  

This is preliminary documentation and subject to change.
To comment on this topic, please send us email at ngwssdk@microsoft.com. Thanks!

Overriding granted permission

Assert, deny, and permit-only (collectively overrides) may be used to alter the effective granted permissions of code at the current stack frame. Assert a permission to stop stack walk check and succeed if the demand reaches the frame. Deny a permission to stop stack walk and fail. Permit-only is a form of deny where the set of permissions that should only succeed is specified – it is equivalent to deny of all permissions not specified.

   void CodeAccessPermission.Assert ();
   void CodeAccessPermission.Deny ();
   void CodeAccessPermission.PermitOnly ();

Overrides are effective until the invoking method returns and the stack frame is freed. Only one assert, one deny, one permit-only can be effective at a time for a given stack frame, however an override with a permission set may assert (deny, etc.) many permission types at the same time. Subsequent assert, deny, permit-only will replace any previous. To remove the effect or an override, do an override on an empty permission set (or in case of permit-only, a permission set of all permissions granted the code).

While rare in practice, up to one assert, one deny, one permit-only may co-exist on a stack frame. The following rules describe the aggregate effect. Consider the case of a demand for permission P on a stack frame with assert A, deny D, and permit-only O: here is how the permission demand happens at each frame.

  1. If P intersects D – check permission is in the deny set – fail the demand.
  2. If O is set, then if P is not a safe subset of O – demand permission is not allowed by permit-only – fail the demand.
  3. If P is a safe subset of A – demand permission is allowed by the assert – the demand succeeds.
  4. If P is not a safe subset of the grant set – demand permission is not allowed by the grant – fail the demand.
  5. If at top stack frame then succeed, else continue to the next caller frame up the stack from step 1.