Evidence is the set of information that serves as input to the runtime's mechanism for making decisions based on security policy. Evidence indicates to the runtime that code has a particular characteristic. Common forms of evidence include digital signatures and the location from which code originates, but evidence can also be custom designed to represent other information that is meaningful to the application.
Trusted application domain hosts can present evidence about an application domain that enables the runtime to decide what permissions to grant the application domain. This information enables the runtime to evaluate machine and user policy and return the set of permissions to grant to the application domain. If the host does not have permission to provide evidence, the application domain will get the permissions that have been granted to the host.
The runtime gets evidence about assemblies from trusted application domain hosts or directly from the loader. Some evidence, such as where the code originates from, needs to come from the application domain host because only the host knows this information. Other evidence, such as an assembly's digital signature, is inherent in the code itself, so it can come from the loader or a trusted host. Typically, when code is loaded, each assembly's digital signature is validated by the runtime. If the digital signature is valid, the host passes the signature information as evidence to the runtime's policy mechanism. In addition, an assembly or a host can provide custom evidence as a resource that is part of the assembly. Administrators and developers can define these new types of evidence and extend security policy to recognize and use it.
The following types of evidence can be presented by the host:
Evidence | Description |
---|---|
Publisher | Software publisher signature, i.e., the AuthentiCode™ signer of the code. |
Site | Site of origin, such as www.microsoft.com. |
Strong Name | Cryptographically strong name of assembly. |
URL | URL of origin. |
Zone | Zone of origin, such as Internet Zone. |
Custom | Application or system-defined. |
The runtime's policy mechanism combines the evidence from the host and the assembly and then uses the evidence to determine which code groups the code is a member of. Ultimately, code group membership together with requested permissions determine which permissions the code is granted.