Fix problem with Hive slave sandboxing

[ascheibe]

mkommend discovered that constant optimization + the sine symbol + the Hive slave sandboxing produces runs with wrong results. This should be investigated. Either

• fix the problem
• remove sandboxing functionality because
  • it is probably not secure anyway
  • the slave is run as network service which already has minimum rights (no admin rights)

[ascheibe]

Added files for testing the bug

[jkarder]

r12926:

• changed sandboxing to always use an unrestricted permission set
• removed IsAllowedPrivileged role and according IsPrivileged code

[gkronber]

Just a quick question: does this mean that "sandboxing" is effectively deactivated?

[ascheibe]

Yes we removed sandboxing. There are a few reasons for this:

• It never really was a sandbox because we had to activate certain permissions (like e.g. SecurityPermissionFlag.UnmanagedCode) so that HL could even run. E.g. you could write a native dll that formats the hard drive or similar stuff.
• It sometimes led to Hive slave crashes when people forgot to check the "IsPrivileged" checkbox in the job manager. You could essentially wipe out all the slaves with a single job which would then require me going in the labs and manually restart ~100 computers. That does not make me happy.
• Getting wrong results as described by mkommend which is probably even worse then dying slaves. jkarder tried to find out why this is happening but wasn't able to track this issue despite quite a bit of testing.
• The slave service is executed as user NetworkService. This user has just normal privileges as every normal Windows user would have. Therefore it is not possible to harm the computer.

Because of this we decided to remove this feature as it causes a lot of problems and does not in any way provide security.

[gkronber]

Thanks.

This was not meant as a critique, of course it is important that all of the research group members are happy! ;)

I'm only asking because I have the task to clean up the plugin infrastructure and if we don't need the separate AppDomain anymore then this can also be removed now. Is the separate AppDomain still necessary/useful in your point of view?

[ascheibe]

Thanks :) AppDomains are still necessary. Each task in Hive has its own set of assemblies that the slave needs to load before executing a task and unload when the task is finished. Because you cannot unload single assemblies but only AppDomains with all loaded assemblies we still need them.

[ascheibe]

r12927 fixed docu comment

[ascheibe]

r12930 adapted MetaOpt branch to changes from r12926

[ascheibe]

r12959 added backwards compatibility to task in the service

[ascheibe]

Reviewed and tested, looks good.

[ascheibe]

Merge after #2388

[ascheibe]

r12963 merged r12926, r12927 and r12959 into stable