511 Chương 13: Bảo mật >2Microsoft .NET Framework.6%C> ME!&<.IO).&( )( ` D< nNI*g&t.Microsoft Windowsh#$ &.6)=z>z z)egUser-Based Securityh8X&*. '>.. )e';I7'>8)=.* .'28!&Ã((8=&.6IJ)=i) )e> Dw9<.I&.68.S4>=6.:6' .:6'.&*Si *'.S' " .NET FrameworkI$.4%&.6&s3g=> 9I&.6 )e.Sh\ • CAS gCode Access SecurityEL.6';.Sh • RBS gRole-Based SecurityEL.6)=z>zzkh CASRBS4'I'*M&.6)5.) PGMI68>.v&.6<2 &.6s$z9zB CASO)4tD.(.&'S$6G=E<' ::gevidencehE;i;(..SF'; '>E<'9'gpermissionhP2&.6.NET FrameworkE.6 $<9'/%EiqX;*K::9'7 .NET Framework O)'>N9'gpermissiondemand'permission requesth&:v90F4&i';X" '>N& &=&.5\I.D0.M:$z&z%.S F.9'FCAS&.5\v=.Se' .:6'&*D *.StDF8:4 .:6'D )e*'.SP.>9ICAS M'6\ P X .S Fzzz6'z.zN gpartially trusted codeh ' ; (.&'>.*&*g.Z^Zh u4CASg.Z^]h!J4.9'=g. Z^^h m>N9'';.S;i;(.&=S 9'.S&*g.Z^_8Z^`8Z^a8Z^[h w.=QIX1>&5CASg.Z^bh {(.;X;OB::(.&'g.Z^cZ^Zdh {OB&.6&= &5.:)g.Z^ZZZ^Z]h RBSX&*=9'IiG=gruntime decisionh)=>i) gidentityhkgroleh )e‘” ‘:)*'>)q )e'7>Windows8<'2=9'Ii)=>> )e WindowsF. Windows . )eF7'>8 RBS ` "&()(N..$'9.D.*F$=>D & 512 Chương 13: Bảo mật .MI&.645.)8X&* 2$&…D )eP.M'6 <'.NET RBS\ 72$RBS )eWindows ;i;(.. )e F>.F.Windows F'4g.Z^Z^h w.';I:v:))=> )e k. )e'.>g.Z^Z_h p6. )eWindows=>) q )eFg.Z^Z`h P.>9I RBS CAS M'%&'.D44 .&*@N=:)8GJ.4.NV v&.6.NET Frameworkl}M8&*S'.. 9''>&.6.NET Framework 1. 1. Cho phép mã l nh có-đ -tin-c y-m t-ph nệ ộ ậ ộ ầ Cho phép mã l nh có-đ -tin-c y-m t-ph nệ ộ ậ ộ ầ s d ng assembly tên m nh c a b nử ụ ạ ủ ạ s d ng assembly tên m nh c a b nử ụ ạ ủ ạ #eAJwAD@jQOIQcff†OFY]J>@cf’fcXJ>XA^Y\s>RQHZ]vZPQLK@DE@O}YqA> J^6LI6Q@A6JN]6OIQ6d>wAiQ>†XO_JLMA>FIQ>nJQ>@s>TABJ>Xd>•dO}YqA>J^6 LI6Q@A6JN]6OIQ6d>wA QHZ] vZPQ JSJ s@tZ D\ JSJ Q>\A> D@CA A`O QHXAB OIQ cff†OFY]QCAOeA>k( dhUABL_JQaA> System.Security.AllowPartiallyTrustedCallersAttribute J>X cff†OFY]J>@cf’JbcFeA( l.'M&.6).S'.&'8&=4X (.&'Fzzz6'z.zN';I(.&'>.*n*I'. .'M.S'.4D&*8D.I 6IINF 2 7(9'/8(.&'>.*$!Global Assembly CachegGACh ::v90$)eK:)l' G(.&'NET FrameworkP(.&'>.* Qx.$z<z&szzS?@5.GAC';D :)$z9zBwv)GAC 82';)r)8 N.90D:)I(.&'>.*. >FvD&:*.S'.$z 9zB 74 8.SFv'..S$*QM;EÃ((E CF&*F2g'4Fh=.u2&.6.!i8.S *'Q.'&F6'Ngfull trusth8.S$* QM;JF6'.Ngpartial trusthHv.SFzzz6'z.zN ';I(.&'>.*Tq.SFzzz6'z.zN4FM 513 Chương 13: Bảo mật O)2v(.&'.2'.84 (.&'%.#sF$Uq>8B'I'i5&* 9B2&.6.e$HI&*.SF6' N84J&…(.&'?F';(.&'>.*&*8. .S'kF';:vNETFrameworkl'@ .0&.6æ jZFeAQ>@jQsj>@qAQ>nJD\Q>gAB>@qOcff†OFY]J>@cf’JbcFeAOIQJSJ> d>r>WdF`AB CAS LtB@E@>eAD@qJQHZ]vZPQLjAJSJQ>\A>D@CA‚ZcAQH•ABFeA s>TABJwASdL_QOIQ>eAJ>jFcXQHrOLtAB‡AO}YqA>J^6LI6Q@A6JN]6OIQ6 d>wAfghUABcff†OFY]JbcFeA(Z]A>@CALK@DE@OIQcff†OFY]FPQs•s>TAB Q>tJ>~ABO@A>H`ABs>TABJ^Yx>‘ABFRXONQA\XLtO}ABZ]>@tOJ^Q>tYW@ hUAB(XL^FeAACAv†Ov•QJ«AQ>NAA>ZJwZJ>Xd>•dO}YqA>J^6LI6Q@A6JN]6 OIQ6d>wA QHZ] vZPQ cff†OFY] QCA OeA> QHVEJ s>@ Sd hUAB L_J QaA> AllowPartiallyTrustedCallersAttribute ( L=v.SFzzz6'z.zN';(.&'>.*&5 ! LinkDemand 69' FullTrust >.0>4zgpublich$z&z gprotectedh.#z'z;z4z$iq(.&'l ' F q J K (.&' $ 9' M M 6 9' FullTrust %.F';>(.&'>.*u ) AllowPartiallyTrustedCallersAttribute (.&'>.*&&= 4& LinkDemand F=>>&> #IQ>nJQ>@J>MZQHSJ>A>@qOFZIJJSJ>XeQLIABFRXONQABwO LinkDemand J^ >@qZYnJLtFRXDqJSJcff†OFY] QCAOeA>‹ C# assembler s>TABf@A>HcJSJYqA> s>c@FSX LinkDemand Y•JF@CAhMJ>( l* .S ) <' % &' . : ) F O ) ! 2 AllowPartiallyTrustedCallersAttribute PGB58&*O)D assembly: &%&>)i52!2'(.&'gk$0!2 Eglobal attributehH84N>.N Attribute >!2E.! )e&*F>.I.Du%&*/.I(.&'>!2'$! using .:>8&4> using System.Security; [assembly:AllowPartiallyTrustedCallers] public class AllowPartiallyTrustedCallersExample { § } >nJQjQPQJRJSJL_JQaA>QX\AJUJLGZA`OQHXABOIQ…@Y†LIJYNdDE@d>wAO} YqA>JyAYe@Jbc~ABhUAB( Microsoft Visual Studio .NET fghUABJSJ>Q@jdJNA A\]zQeXOIQ…@Y†J^QCAY\ AssemblyInfo.cs LtJ>~cQPQJRJSJL_JQaA>QX\AJUJ( 514 Chương 13: Bảo mật HI) AllowPartiallyTrustedCallersAttribute (.&'8&*.D.S Fzzz6'z.zN J0 $. D > F8 &* N&s LinkDemand 69' FullTrust >>NI8$%&' *.S)<'\ [System.Security.Permissions.PermissionSetAttribute (System.Security.Permissions.SecurityAction.LinkDemand, Name="FullTrust")] public void SomeMethod() { § } 2. 2. Vô hi u b o m t truy xu t mã l nhệ ả ậ ấ ệ Vô hi u b o m t truy xu t mã l nhệ ả ậ ấ ệ #eAJwADT>@qZ CAS ( >@jQYNdQ>ZIJQaA> SecurityEnabled JbcYEd System.Security.SecurityManager Y\ false D\YVZYe@F`ABd>V[ABQ>~J SecurityManager.SavePolicy (#eAJ“ABJ^Q>t fghUABJTABJU Code Access Security Policy i Caspol.exe kD\Q>nJQ>@YqA> caspol –s off ( CASN(D.4%&.6&= NET8?N! NET.4F"!)eCAS$;<')=>2 .&v=S$O).x0 NET83F.2.#'>N&.6gsecurity demandhŠ gI9h.&== l4G8&.6.:z.SzF4&*&6<.8!NvF $9NCAS7 $'8&*F4CAS *&V2.&.6.:z.Szu4CASF).S v=&….NET Framework#$gMM 69' FullTrust h8&t.v*.S80'>8 O)V=I';& #eAJ>ˆACADT>@qZ CAS DlJSJYŠhX>@qZA‡ABfcZs>@L}Q@CZ>jQQPQJRJSJ J>ƒABOnJJ^Q>ts>SJLtLeQLVWJJSJL_JL@tO>@qZA‡ABO\~ABhUABJbc FeALy@>Ž@(@qJYNddHX…@Y†J>XO}YqA>Q>VoABfmA>NAF@jQA>?ABDrABO\ FeAJ^Q>tJR@Q>@qALSABst>@qZA‡ABA>VABs>TABd>R@DT>@qZ CAS (BX\@Hc FeAJwAFRXLROJSJQ\@ABZ]CA>qQ>KABL}LVWJFRXDqF`ABJSJJ[J>jFRX ONQJbc>qL@GZ>\A>iA>V Windows ACLs kQHVEJs>@DT>@qZ CAS ( Caspol.exe.2$eNET Framework8X&*%2 &.6';.SQ)kw&*6 caspol –s off ! caspol –s on 82'@ ;6 2 SecurityEnabled SecurityManager y SecurityManager 6M:q';)K:v& 515 Chương 13: Bảo mật .690l*.S)<'%&'O)2 SecurityEnabled 4 2*CAS\ // Vô hiệu CAS. System.Security.SecurityManager.SecurityEnabled = false; // Lưu cấu hình. System.Security.SecurityManager.SavePolicy(); // Kích hoạt CAS. System.Security.SecurityManager.SecurityEnabled = true; // Lưu cấu hình. System.Security.SecurityManager.SavePolicy(); l 4 CAS8 .S &* F N O ControlPolicy System.Security.Permissions.SecurityPermission l2*CAS8&*4N F9' 7's SecurityEnabled @4CI*CASI% F8?4CII%.I&*0M: SavePolicy * SecurityEnabled WindowsRegistrylI8.NET Framework4&.K's SecurityEnabled @GI* CASI%UF8&*'s SecurityEnabled t.C .I%.F$*G..D Hình 13.1 Registry Editor (CAS đã bị vô hiệu) HeAB Q>S@ >@qA >\A> Jbc CAS i on - off k LVWJ YVZ QHXAB s>^c HKEY_ LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Security\Policy Jbc Windows Registry (jZs>^cA\]s>TABQ€AQe@O_JLMA> CAS Y\ on ( 516 Chương 13: Bảo mật 3. 3. Vô hi u vi c ki m tra quy n th c thiệ ệ ể ề ự Vô hi u vi c ki m tra quy n th c thiệ ệ ể ề ự #eAJwAAB‡AFIQ>nJQ>@s@tOQHcOx@cff†OFY]LVWJAedD\XJ^‚Z]GAQ>nJQ>@ i execution permission k>c]s>TAB( >@jQ YNd Q>ZIJ QaA> CheckExecutionRights Jbc YEd System.Security. SecurityManager Y\ false H€@ YVZ Ye@ F`AB d>V[AB Q>~J SecurityManager. SavePolicy ( #eA J“AB J^ Q>t fg hUAB JTAB JU Code Access Security Policy i Caspol.exe kD\Q>nJQ>@YqA> caspol –e off ( "#*(.&'8&= &.z((.&' ' F:NO Execution SecurityPermission L==.9%<2 + -glazy policy resolution processh8qz( .(.&' 4$2 IF.'>N&.6gsecurity demandh$=>(.&'' u.9'=4J&&=..#(.&'F9'= '48.kI*<2D.#(.&'$ *86$2<2+ -P'ID'F<'=% S(.&'$*8!&&=*(.&'e .G 7 $8X.S**'4.'M .r*'>90S$&&5CAS &5MI&.6L=.NETX&*4= .9'='&>.S8'&54Caspol.exe w&*6 caspol –e off ! caspol –e on 8 Caspol.exe @ ;6 2 CheckExecutionRights SecurityManager L*F=4'&> .S\ // Vô hiệu việc kiểm tra quyền thực thi. System.Security.SecurityManager.CheckExecutionRights = false; // Lưu cấu hình. System.Security.SecurityManager.SavePolicy(); // Kích hoạt việc kiểm tra quyền thực thi. System.Security.SecurityManager.CheckExecutionRights = true; // Lưu cấu hình. System.Security.SecurityManager.SavePolicy(); l ' s i CheckExecutionRights % .S &* F N O ControlPolicy SecurityPermission 7's'@F)I% ':%8X&**(.&'G=.&=4 517 Chương 13: Bảo mật .GF9'='47'>8's'@4CI I%FU6'8&*'sWindows Registryg&5M: SavePolicy hFF)I%. 4. 4. B o đ m b th c thi c p cho assembly m t s quy n nào đóả ả ộ ự ấ ộ ố ề B o đ m b th c thi c p cho assembly m t s quy n nào đóả ả ộ ự ấ ộ ố ề #eAJwAFRXLROFIQ>nJQ>@JPdJ>Xcff†OFY]JbcFeAJSJ‚Z]GAQHZ]vZPQO} YqA>i code access permission kO\JSJ‚Z]GAA\]‚Z]jQLMA>fnQ>\A>JTABQHXAB >XeQLIABJbc~ABhUAB( ghUABJSJ]CZJwZ‚Z]GAi permission request kLtJ>ˆLMA>JSJ‚Z]GAQHZ]vZPQ O}YqA>O\cff†OFY]JwAd>R@J^(#eAs>c@FSXJSJ]CZJwZ‚Z]GAF`ABJSJL_J QaA>‚Z]GAQHZ]vZPQO}YqA>‰O~Jcff†OFY]( P'>N9'&I9'..SF%.F*'$u2)8 I&*I.%;(.. )eFO)F;(..Q .((86*I2&.6 )e4XM% '.C.ID.*I((PM%&*@**'8 )e I D I (( ;(. .8 M % @ * System.Security.SecurityException p(.&''>N9'NI F .C . I D .* I (( g System.Net.WebPermission ' System.Net.SocketPermission 8e'ID&*N.Ch L=='>N9''>/\*.S8'DM *.S&*=..F4F9'u%6'8 I 9% <2&.68 &=;i$z( (.&'4:'>N9'(.&'8F@4*(.&' X.* System.Security.Policy.PolicyException l&.'>N9'8&*O)&!2gattribute counterparth 9'';.S&*N79'';.SF.&! 2 . &*F O )*&.6 & gdeclarative security statementhE&t.'>N9'u2)8&!2 SocketPermission SocketPermissionAttribute 8 & ! 2 WebPermission WebPermissionAttribute E79'&!2Ge(9' !>>e4> ‚ ) PermissionRequestExample ) <' F '> N 9'\ . SocketPermission . SecurityPermission L*N\ • L*&'>N9'&… using .:>& …&'4> • l!2/.I(.&'>&*>.D assembly: >!2 • w4N>.N Attribute >!2E.!)e&*F>.I .D • L*Ji SecurityAction.RequestMinimum DDN>!2E i'&I<'.'>N9' 518 Chương 13: Bảo mật • L*%!2.49'';.S.&*N&5 2!2L*S'.NET Framework SDK&I>. I2).#!2&.6';.S= • P'>N9'4$IG&5).x'gTh • l*'>N9'8JN>.'>N9'$%&' 2))<'\ using System.Net; using System.Security.Permissions; // Yêu cầu SocketPermission (cho phép mở một kết nối // TCP đến host và port được chỉ định). [assembly:SocketPermission(SecurityAction.RequestMinimum, Access = "Connect", Host = "www.fabrikam.com", Port = "3538", Transport = "Tcp")] // Yêu cầu phần tử UnmanagedCode của SecurityPermission, // (kiểm soát khả năng thực thi mã lệnh không-được-quản-lý). [assembly:SecurityPermission(SecurityAction.RequestMinimum, UnmanagedCode = true)] public class PermissionRequestExample { public static void Main() { // Làm gì đó } } HI&*=:) PermissionRequestExample 2&.64 (.&''9'$'>N8&*@6$* PolicyException ) <':)@4=wO)2&.6.!i8'@;' I&**'(.&'Q..* )e %(.&'$*QÃ( 4$ SocketPermission Unhandled Exception: System.Security.Policy.PolicyException: Required permission cannot be acquired. w&**.(.&'Q&>.Sg='&5'h8(.&''F :'>N9'.2&.64:%M:.&*O )*(.&'@X.* PolicyException 8)F&*Be $ 519 Chng 13: Bo mt 5. 5. Gi i h n cỏc quy n c c p cho assembly Gi i h n cỏc quy n c c p cho assembly #eAJwA>eAJ>jJSJZ]GAQHZ]vZPQO}YqA>LVWJJPdJ>XcffOFY] JbcFeA LROFRXABVo@s>SJD\d>wAOGOs>SJs>TABQ>tãáÂO}YqA>JbcFeAƯÔạÂÔ OIQJ[J>jO\Q>TABZcL^LtQ>nJ>@qAJSJ>\A>LIABABZ]>@tO>c]s>TAB OXABOZKA( ghUABJSJYqA>FRXONQs>c@FSXi declarative security statement kLtJ>LMA> JSJ]CZJwZZ]GAQr]J>Ai optional permission request kD\JSJ]CZJwZYXe@QH Z]GAi permission refusal request kQHXABcffOFY]JbcFeA(SJ]CZJwZZ]GA Qr]J>ALMA>AB>cQNdQK@LcJSJZ]GAO\FIQ>nJQ>@fmJPdJ>XcffOFY]( SJ]CZJwZYXe@QHZ]GAJ>LMA>JSJZ]GAJUQ>tO\FIQ>nJQ>@fms>TAB JPdJ>XcffOFY]( HI9<.I&.686BC.S&*JF9'';.S NƠĐ=:vFl'.'M .S O).S&*='.'4. .Du8&=<9'.(.&'&52&.6 g). )eF' 9i%hP2&.6F *.#M.:)*'8&*4.9'.2& .6i.S&* "!)e&*4.2&.6*M S*'8 .NET FrameworkMI.49F8&*F*&V9'$ (.&'&*\'>N*Qgrefuse requesth'>Ne'0goptional requesthm>N*QX&*J9'.&*4.D&= (.&'| 9%<28Iz(.(.&' :&9'S$Ji.'>N*Q8&=@*&V 9'Fm>Ne'0iq6D9'.&=F (.&'HIz(.(.&':&9'9'S$ Ji'>Ne'08&=@*&V9'Fw'>N9'D gS$6.Z^_h8&=@4QD*(.&'êă IF49'S$Ji'>Ne'0 L*F'>N*Q'>Ne'00=$eI 9T.&*O)e'D$9'&*.D*&VHI.D*&V ầ29'8&*S'0'>N*Q7'>8I.D*&V9'8&* S'0'>Ne'0ẵÔÊÊ Ôỗ.ầôÊÔăƯƠôÊÔố ăảãăắ L*>.'>Ne'0'>N*Q.S&5&.6 &GD'>N9'DS$6.Z^_ l.&)'i System.Security.Permissions.SecurityAction .&* ' M : C )= ! 2 9' |O ) SecurityAction.RequestOptional & . '> N e' 0 SecurityAction.RequestRefuse &.'>N*QP?D'> N9'D8&*&'>Ne'0'>N*Q!2 &5>.D assembly: >!2H8'>N 520 Chương 13: Bảo mật ;&… using .:>&…&'4 > u2))<'.0.'>N9'e'069' Internet l<'6 9' $ i q &C 2 & .6 .! i w & = * OptionalRequestExample 8F@4(.&''&:9'45. 69' Internet g.NET Framework SDK&I>.I 9'69' Internet h using System.Security.Permissions; [assembly:PermissionSet(SecurityAction.RequestOptional, Name = "Internet")] public class OptionalRequestExample { public static void Main() { // Làm gì đó } } 7 OptionalRequestExample 82))<'O).'>N*Q*&V 9' System.Security.Permissions.FileIOPermission g.49'';Ds qCh\ using System.Security.Permissions; [assembly:FileIOPermission(SecurityAction.RequestRefuse, Write = @"C:\")] public class RefuseRequestExample { public static void Main() { // Làm gì đó } } 6. 6. Xem các yêu c u quy n đ c t o b i m t assemblyầ ề ượ ạ ở ộ Xem các yêu c u quy n đ c t o b i m t assemblyầ ề ượ ạ ở ộ #eAJwAv†OJSJJSJYXe@QHƒD\JSJ]CZJwZ‚Z]GAs>c@FSXLVWJQeXFCAQHXAB OIQcff†OFY]LtJ^Q>tJPZ>lA>J>aA>fSJ>FRXONQOIQJSJ>d>r>Wd>X_J . RefuseRequestExample { public static void Main() { // Làm gì đó } } 6. 6. Xem các yêu c u quy n đ c t o b i m t assemblyầ ề ượ ạ ở ộ Xem các yêu c u quy n đ c t o b i m t assemblyầ ề ượ ạ ở ộ #eAJwAv†OJSJJSJYXe@QHƒDJSJ]CZJwZ‚Z]GAs>c@FSXLVWJQeXFCAQHXAB OIQcff†OFY]LtJ^Q>tJPZ>lA>J>aA>fSJ>FRXONQOIQJSJ>d>r>Wd>X_J