Question

Is it possible to load multiple assemblies into a new AppDomain and apply different PermissionSet to each?

Say, allow one of the assemblies to write to disk by granting it an unrestricted FileIOPermission and denying such permission to the other(s).

If it’s possible. How?

Update

P.S. I’m creating instances of types out of DLL’s not executing exes, so I’m using Load and CreateInstanceAndUnwrap instead of ExecuteAssembly.

Update

I tried (and failed) providing evidence with the load method with the following code:

Dim domain As AppDomain = AppDomain.CreateDomain("AssembliesDomain")
Dim protectedSet As New PermissionSet(PermissionState.None)

protectedSet.AddPermission(New SecurityPermission(SecurityPermissionFlag.Execution))
protectedSet.AddPermission(New IsolatedStorageFilePermission(PermissionState.Unrestricted))
protectedSet.PermitOnly()

domain.Load(protectedAssembly, New Evidence(Nothing, {protectedSet}))
domain.Load(unprotectedAssembly, New Evidence(Nothing, {protectedSet}))

Console.WriteLine(domain.CreateInstanceAndUnwrap(protectedAssembly, protectedAssembly & ".Actions").Sum(1, 2))
Console.WriteLine(domain.CreateInstanceAndUnwrap(unprotectedAssembly, unprotectedAssembly & ".Actions").Sum(1, 2))
Console.ReadLine()

Answer 1

Add this line (to get around the exception you’re getting):

protectedSet.AddPermission(new UIPermission(PermissionState.Unrestricted)); 

Helpful article: http://www.reliablesoftware.com/articles/UnderstandingSecurityActions.html