Activate restricted permission set for sandboxed AppDomains

[gkronber]

Currently the permission policy for 'sandboxed' AppDomains is unrestricted.

This is relevant for plugins HeuristicLab.Hive.Client and HeuristicLab.Grid which create a new appdomain for each job. Additionally HeuristicLab.Hive.Client loads plugins dynamically which causes additional troubles in combination with the security policy.

Probably the sandboxing mechanism has to be changed completely. Ideally we create a temporary directory for each job where we can store the files (assemblies) that are necessary for that job and use this directory as base-path (or private bin path) for the job-specific sandbox.

[ascheibe]

In a sandboxed AppDomain only partially-trusted code can be executed. Therefore all code that requires full trust has to be avoided:

• Ticket #1486 fixes a problem where gui dependencies which need full trust are pulled in.
• Ticket #1517 switches HeuristicLab.Tracing to Diagnostics.Trace to allow tracing in a sandbox.

For this ticket, a new ApplicationManager will be implemented which runs in a sandbox. Also, SandboxManager will be completed.

[ascheibe]

r6174

• completed SandboxManager
• added SandboxApplicationManager for Hive
• DefaultApplicationManager is now a subclass of the SandboxApplicationManager
• ApplicationManager now instantiates the LightweightApplicationManager only if it is accessed to avoid calling InitializeLifetimeService(..) in a sandbox

[ascheibe]

r6487 removed unnecessary permission

[gkronber]

Reviewed r6174 and r6487.

r6538:

• removed unnecessary method to load assemblies from byte arrays from SandboxApplicationManager.
• Minor changes in SandboxManager.

[gkronber]

Review comments:

The SandboxManager creates an application domain with a restricted permission set. However, the permissions granted in the sandbox are too powerful and it would actually be possible to compromise and gather sensitive information from the executing machine. To make the sandbox more secure the following permissions should be removed in future versions (see ticket #1580):

• SecurityPermissionFlag.Infrastructure
• SecurityPermissionFlag.UnmanagedCode
• SecurityPermissionFlag.ControlEvidence
• ReflectionPermission(PermissionState.Unrestricted)
• FileIOPermissionAccess.PathDiscovery, Path.GetPathRoot(Path.GetFullPath(Environment.SystemDirectory))

also see: ​http://msdn.microsoft.com/en-us/library/system.security.permissions.securitypermissionflag.aspx