What is Garbage Collection and Why We Need It?

Memory Facts

• Free (empty space)
• Reserved (already allocated)
• Committed (This block is give-out to physical memory and not available for space allocation)

How GC Works?

• 0 Generation (Zero): This generation holds short-lived objects, e.g., Temporary objects. GC initiates garbage collection process frequently in this generation.
• 1 Generation (One): This generation is the buffer between short-lived and long-lived objects.
• 2 Generation (Two): This generation holds long-lived objects like a static and global variable, that needs to be persisted for a certain amount of time. Objects which are not collected in generation Zero, are then moved to generation 1, such objects are known as survivors, similarly objects which are not collected in generation One, are then moved to generation 2 and from there onwards objects remain in the same generation.

How GC Decides If Objects Are Live?

• It collects all handles of an object that are allocated by user code or by CLR
• Keeps track of static objects, as they are referenced to some other objects
• Use stack provided by stack walker and JIT

When GC Gets Triggered?

1. When virtual memory is running out of space.
2. When allocated memory is suppressed acceptable threshold (when GC found if the survival rate (living objects) is high, then it increases the threshold allocation).
3. When we call GC.Collect() method explicitly, as GC runs continuously, we actually do not need to call this method.

What is Managed and Unmanaged Objects/Resources?

 VS 

Clean Up Unmanaged Resources

• Implement IDisposable interface and Dispose method
• 'using' block is also used to clean unmanaged resources

• Implement Dispose using 'SafeHandle' Class (It is inbuilt abstract class which has 'CriticalFinalizerObject' and 'IDisposable' interface has been implemented)
• Object.Finalize method to be override (This method is clean unmanaged resources used by particular object before it is destroyed)

• Implement Dispose using 'SafeHandle' Class:
  Hide   Shrink    Copy Code

  class clsDispose_safe
      {
          // Take a flag to check if object is already disposed
          bool bDisposed = false;
  
          // Create a object of SafeHandle class
          SafeHandle objSafeHandle = new SafeFileHandle(IntPtr.Zero, true);
  
          // Dispose method (public)
          public void Dispose1()
          {
              Dispose(true);
              GC.SuppressFinalize(this);
          }
  
          // Dispose method (protected)
          protected virtual void Dispose(bool bDispose)
          {
              if (bDisposed)
                  return;
  
              if (bDispose)
              {
                  objSafeHandle.Dispose();
                  // Free any other managed objects here.
              }
  
              // Free any unmanaged objects here.
              //
              bDisposed = true;
          }
      }

• Implement Dispose using overriding the 'Object.Finalize' method:
  Hide   Shrink    Copy Code

  class clsDispose_Fin
      {
          // Flag: Has Dispose already been called?
          bool disposed = false;
  
          // Public implementation of Dispose pattern callable by consumers.
          public void Dispose()
          {
              Dispose1(true);
              GC.SuppressFinalize(this);
          }
  
          // Protected implementation of Dispose pattern.
          protected virtual void Dispose1(bool disposing)
          {
              if (disposed)
                  return;
  
              if (disposing)
              {
                  // Free any other managed objects here.
                  //
              }
  
              // Free any unmanaged objects here.
              //
              disposed = true;
          }
  
          ~clsDispose_Fin()
          {
              Dispose1(false);
          }
      }

'using' Statement

Hide   Shrink    Copy Code

class testClass : IDisposable
{
    public void Dispose()
    {
        // Dispose objects here
  // clean resources
  Console.WriteLine(0);
    }
}

//call class
class Program
{
    static void Main()
    {
        // Use using statement with class that implements Dispose.
  using (testClass objClass = new testClass())
  {
       Console.WriteLine(1);
 }
  Console.WriteLine(2);
    }
}

//output
1
0
2

//it is same as below TRY...Finally code
{
    clsDispose_Fin objClass = new clsDispose_Fin();
    try
    {
        //code goes here 
    }
    finally
    {
        if (objClass != null)
        ((IDisposable)objClass).Dispose();
    }
}

Re-view

• Garbage collector manages allocation and reclaim of memory.
• GC works on managed heap, which is nothing but a block of memory to store objects.
• There is no specific timings for GC to get triggered, GC automatically start operation.
• Managed objects are created, managed and under scope of CLR.
• Unmanaged objects are wrapped around operating system resources like file streams, database connections, network related instances, handles to different classes, registries, pointers, etc.
• Unmanaged resources can be cleaned-up using 'Dispose' method and 'using' statement.

Introduction

1. Role Based Security (not being discussed in this article)
2. Code Access Security

• Restrict what your code can do
• Restrict which code can call your code
• Identify code

Jargon

• permissions
• permission sets
• code groups
• evidence
• policy

Permissions

Permission sets

Code groups

Policy

Quick Example

using System.IO;

private void btnWrite_click(object sender, System.EventArgs e)
{ 
    StreamWriter myFile = new StreamWriter("c:\\Security.txt");
    myFile.WriteLine("Trust No One");
    myFile.Close();
}

private void btnRead_click(object sender, System.EventArgs e)
{ 
    StreamReader myFile = new StreamReader("c:\\Security.txt");
    MessageBox.Show(myFile.ReadLine())
    myFile.Close()
}

[assembly: AssemblyVersion("1.0.0.0")]

.NET Configuration Tool

Creating a new permission set

Creating a new code group

Exclusive and LevelFinal

Functions of Code Access Security

• Defines permissions and permission sets that represent the right to access various system resources.
• Enables administrators to configure security policy by associating sets of permissions with groups of code (code groups).
• Enables code to request the permissions it requires in order to run, as well as the permissions that would be useful to have, and specifies which permissions the code must never have.
• Grants permissions to each assembly that is loaded, based on the permissions requested by the code and on the operations permitted by security policy.
• Enables code to demand that its callers have specific permissions. Enables code to demand that its callers possess a digital signature, thus allowing only callers from a particular organization or site to call the protected code.
• Enforces restrictions on code at run time by comparing the granted permissions of every caller on the call stack to the permissions that callers must have.

Security Namespace

Declarative vs. Imperative

Declarative syntax

[FileIOPermission(SecurityAction.Demand, Unrestricted=true)]
public calss MyClass 
{
    public MyClass() {...}   // all these methods
    public void MyMethod_A() {...} // demands unrestricted access to 
    public void MyMethod_B() {...} // the file system
}

Imperative syntax

public calss MyClass 
{
    public MyClass() { }

    public void Method_A() 
    {
        // Do Something

        FileIOPermission myPerm = 
          new FileIOPermission(PermissionState.Unrestricted);
        myPerm.Demand(); 
        // rest of the code won't get executed if this failed

        // Do Something
    }

    // No demands
    public void Method_B()
    {
        // Do Something
    }
}

• Action - one of the values in SecurityAction enum (common)
• Unrestricted - unrestricted access to the resource (common)
• Clipboard - type of access to the clipboard, one of the values in UIPermissionClipboard enum(UIPermission specific)
• Window - type of access to the window, one of the values in UIPermissionWindow enum (UIPermissionspecific).

[UIPermission(SecurityAction.Demand,
      Clipboard=UIPermissionClipboard.AllClipboard)]

[UIPermission(SecurityAction.Demand,
      Clipboard=UIPermissionClipboard.AllClipboard, 
      Window=UIPermissionWindow.AllWindows)]

[UIPermission(SecurityAction.Demand, Unrestricted=true)]

RegistryPermission myRegPerm = 
   new RegistryPermission(RegistryPermissionAccess.AllAccess,
   "HKEY_LOCAL_MACHINE\\Software");
myRegPerm.Demand();

RegistryPermission myRegPerm = new 
  RegistryPermission(PermissionState.Unrestricted);
myRegPerm.Demand();

Security Demands

• Demand
• Link Demand
• Inheritance Demand

Demand

using System.Security;
using System.Security.Permissions;

private void btnFileRead_Click(object sender, System.EventArgs e)
{
    try
    {
        InitUI(1); 
    }
    catch (SecurityException err)
    {
        MessageBox.Show(err.Message,"Security Error");
    }
    catch (Exception err)
    {
        MessageBox.Show(err.Message,"Error");
    } 
}

// Access is denied for this function to read from C: drive
// Note: Using declrative syntax
[FileIOPermission(SecurityAction.Deny,Read="C:\\")]
private void InitUI(int uino)
{
    // Do some initializations
    ShowUI(uino);    // call ShowUI
}

private void ShowUI(int uino)
{
    switch (uino)
    {
        case 1: // That's our FileRead UI
            ShowFileReadUI();
            break;
        case 2:
            // Show someother UI
            break;            
    }
}

private void ShowFileReadUI()
{
    MessageBox.Show("Before calling demand");
    FileIOPermission myPerm = new 
      FileIOPermission(FileIOPermissionAccess.Read, "C:\\");
    myPerm.Demand();
       // All callers must have read permission to C: drive
      // Note: Using imperative syntax
      
    // code to show UI
    MessageBox.Show("Showing FileRead UI");
    // This is excuted if only the Demand is successful.
}

Link Demand

[FileIOPermission(SecurityAction.LinkDemand,Read="C:\\")]
private void MyMethod()
{
    // Do Something 
}

Inheritance Demand

[SecurityPermission(SecurityAction.InheritanceDemand)]
private class MyClass()
{
    // what ever
}

private class MyClass()
{
    public class MyClass() {}
    
    [SecurityPermission(SecurityAction.InheritanceDemand)]
    public virtual void MyMethod()
    {
        // Do something
    }
}

Requesting Permissions

• RequestMinimum
• RequestOptional
• RequestRefuse

RequestMinimum

using System;
using System.Windows.Forms;
using System.IO;

using System.Security;
using System.Security.Permissions;

// placed in assembly level
// using declarative syntax
[assembly:RegistryPermission(SecurityAction.RequestMinimum, 
         Write="HKEY_LOCAL_MACHINE\\Software")]

namespace SecurityApp
{
    // Rest of the implementation
}

RequestOptional

[assembly:FileIOPermission(SecurityAction.RequestMinimum, Read="C:\\")]
[assembly:FileIOPermission(SecurityAction.RequestOptional, Write="C:\\")]

RequestRefuse

[assembly:FileIOPermission(SecurityAction.RequestRefuse, Write="C:\\")]

Overriding Security

• Assert
• Deny
• PermitOnly

Assert

private void ShowUI(int uino)
{
    // using imperative syntax to create a instance of FileIOPermission
    FileIOPermission myPerm = new 
      FileIOPermission(FileIOPermissionAccess.Read, "C:\\");
    myPerm.Assert();    // don't check above stack frames.

    switch (uino)
    {
        case 1: // That's our FileRead UI
            ShowFileReadUI();
            break;
        case 2:
            // Show someother UI
            break;            
    }

    CodeAccessPermission.RevertAssert();    // cancel assert
}

Deny

WebPermission myWebPermission = 
        new WebPermission(NetworkAccess.Connect, 
        "http://www.somewebsite.com");
myWebPermission.Deny();

// Do some work

CodeAccessPermission.RevertDeny(); // cancel Deny

PermitOnly

WebPermission myWebPermission = 
  new WebPermission(NetworkAccess.Connect, 
  "http://www.somewebsite.com");
myWebPermission.PermitOnly();

// Do some work

CodeAccessPermission.PermitOnly(); // cancel PermitOnly

Calculating Permissions

1. Starting from the All_Code code group, all the child groups are searched to determine which groups the code belongs to, using identity information provided by the evidence. (If the parent group doesn't match, then that group's child groups are not checked.)
2. When all matches are identified for a particular policy level, the permissions associated with those groups are combined in an additive manner (union).
3. This is repeated for each policy level and permissions associated with each policy level are intersectedwith each other.

• Exclusive - The permissions with the code group marked as Exclusive are taken as the only permissions for that policy level. So permissions associated with other code groups are not considered when computing permissions.
• LevelFinal - Policy levels (except the application domain level) below the one containing this code group are not considered when checking code group membership and granting permissions.

Nice Features in .NET Configuration Tool

• Evaluate Assembly - This can be used to find out which code group(s) a particular assembly belongs to, or which permissions it has.
• Create Deployment Package - This wizard will create a policy deployment package. Just choose the policy level and this wizard will wrap it into a Windows Installer Package (.msi file), so what ever the code groups and permissions in your development PC can be quickly transferred to any other machine without any headache.

Tools

Permissions View Tool - permview.exe

• permview SecurityApp.exe - Displays the permissions requested by the assembly SecurityApp.exe.

Code Access Security Policy Tool - caspol.exe

• caspol -listgroups - Displays the code groups
• caspol -machine -addgroup 1. -zone Internet Execution - Adds a child code group to the root of the machine policy code group hierarchy. The new code group is a member of the Internet zone and is associated with the Execution permission set.
• caspol -user -chggroup 1.2. Execution - Changes the permission set in the user policy of the code group labeled 1.2. to the Execution permission set.
• caspol -security on - Turns code access security on.
• caspol -security off - Turns code access security off.

Summary

• Using .NET Code Access Security, you can restrict what your code can do, restrict which code can call your code and identify code.
• There are four policy levels - Enterprise, Machine, User and Application Domain which contains code groups with associated permissions.
• Can use declarative syntax or imperative syntax.
• Demands can be used to ensure that every caller has the demanded permission.
• Requests can be used to request (or refuse) permissions in the grant time.
• Granted permissions can be overridden.

• MSDN Documentation
• Code Access Security in Practice (MSDN article)