I am attempting to run my ASP.Net application with Medium Trust as my hosting provider has set their web environment to medium trust.

I have read all the past threads on this issue and none have helped me fix this problem.

After extensive research, I believe this has something to do with LLBLGenDatasource.

I am attaching a complete demo solution containing an asp.net website, llblgen project, a .sql file to install the database (sql2k5), and the llblgen generated code.

From the attached test solution, it is easy to reproduce the issue. If you change the trust to "Full", the application works, but when changed to "Medium", it throws the exception below.

<trust level="Medium"/>

The exception I am getting is:

Security Exception 
Description: The application attempted to perform an operation not allowed by the security policy.  To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file. 

Exception Details: System.Security.SecurityException: Request for the permission of type 'System.Security.Permissions.SecurityPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

Source Error: 

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.  

Stack Trace: 


[SecurityException: Request for the permission of type 'System.Security.Permissions.SecurityPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.]
   SD.LLBLGen.Pro.ORMSupportClasses.EntityCollectionBase`1.GetObjectData(SerializationInfo info, StreamingContext context) +0
   System.Runtime.Serialization.Formatters.Binary.WriteObjectInfo.InitSerialize(Object obj, ISurrogateSelector surrogateSelector, StreamingContext context, SerObjectInfoInit serObjectInfoInit, IFormatterConverter converter, ObjectWriter objectWriter) +7629722
   System.Runtime.Serialization.Formatters.Binary.WriteObjectInfo.Serialize(Object obj, ISurrogateSelector surrogateSelector, StreamingContext context, SerObjectInfoInit serObjectInfoInit, IFormatterConverter converter, ObjectWriter objectWriter) +51
   System.Runtime.Serialization.Formatters.Binary.ObjectWriter.Serialize(Object graph, Header[] inHeaders, __BinaryWriter serWriter, Boolean fCheck) +410
   System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Serialize(Stream serializationStream, Object graph, Header[] headers, Boolean fCheck) +134
   System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Serialize(Stream serializationStream, Object graph) +13
   System.Web.UI.ObjectStateFormatter.SerializeValue(SerializerBinaryWriter writer, Object value) +842

LLBLGen version 2.6 Final SD.LLBLGen.Pro.ORMSupportClasses.NET20.dll version=2.6.0.0; File version: 2.6.09.0313 SD.LLBLGen.Pro.DQE.SqlServer.NET20.dll version=2.6.0.0; File version: 2.6.08.1114 Database used: SQL Server 2005 Template: SelfServicing

PS: On an unrelated topic, I had great difficulty in zipping this solution and to get it under the upload size limit that you guys have set. Considering that the code generated by LLBLGen for a handful of tables in my case is about 4 MB, I am not sure how to get the the zip file to be under 500k. I request you to raise this limit as this will help users send you viable test cases.

I had to use a program called 7-zip to zip the file as normal zip would have created a file bigger than the limit. Also, I had to remove the LLBLGen runtime dlls to reduce the size of the zip file.

Hi Bliss -

I have not used the LLBLGenDataSource. Best of luck with Frans & getting a fix.

I will, however, say that I am successfully using LLBLGen Pro on CrystalTech's Hosting in Medium Trust.

Just letting you know Medium Trust is possible. ; )

Ryan

PS. We are using Visual WebGui here, which is a WinForms API for the web. They have a BindingSource control that works identically to WinForms and everything works great.

What LLBLGen version and runtime library version are you using BTW? (http://llblgen.com/tinyforum/Messages.aspx?ThreadID=7725)

I have edited my original message to include version details.

I am really hoping this gets solved as I already paid a bunch of money to godaddy

Please check this thread: http://www.llblgen.com/TinyForum/Messages.aspx?ThreadID=13134

The exception is caused by the reflection done by the binary serializer which serializes data to the viewstate. Some information is stored in the viewstate and apparently this is causing the problem.

One way to solve this is to store the data not in the viewstate but in the session. Could you try that please? As you're using selfservicing, you can't switch on fastserialization which also solves this. We only have reports about godaddy.com which causes this problem, other hosters have not caused this problem.

1. I got past the problem with LLBLGenDatasource with using Session.
2. I ran into a new issue with running a LINQ query with medium trust. The offending line is:

int? size = (from s in metaData.Snapshot
                             where s.WebSite == this
                             select s.SizeMb).Sum();

The exception is:

Security Exception 
Description: The application attempted to perform an operation not allowed by the security policy.  To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file. 

Exception Details: System.Security.SecurityException: Request failed.

Source Error: 

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.  

Stack Trace: 


[SecurityException: Request failed.]
   System.Security.CodeAccessSecurityEngine.ThrowSecurityException(Assembly asm, PermissionSet granted, PermissionSet refused, RuntimeMethodHandle rmh, SecurityAction action, Object demand, IPermission permThatFailed) +150
   System.Security.CodeAccessSecurityEngine.ThrowSecurityException(Object assemblyOrString, PermissionSet granted, PermissionSet refused, RuntimeMethodHandle rmh, SecurityAction action, Object demand, IPermission permThatFailed) +100
   System.Security.CodeAccessSecurityEngine.CheckSetHelper(PermissionSet grants, PermissionSet refused, PermissionSet demands, RuntimeMethodHandle rmh, Object assemblyOrString, SecurityAction action, Boolean throwException) +284
   System.Security.PermissionSetTriple.CheckSetDemand(PermissionSet demandSet, PermissionSet& alteredDemandset, RuntimeMethodHandle rmh) +69
   System.Security.PermissionListSet.CheckSetDemand(PermissionSet pset, RuntimeMethodHandle rmh) +150
   System.Security.PermissionListSet.DemandFlagsOrGrantSet(Int32 flags, PermissionSet grantSet) +30
   System.Threading.CompressedStack.DemandFlagsOrGrantSet(Int32 flags, PermissionSet grantSet) +40
   System.Security.CodeAccessSecurityEngine.ReflectionTargetDemandHelper(Int32 permission, PermissionSet targetGrant, CompressedStack securityContext) +123
   System.Security.CodeAccessSecurityEngine.ReflectionTargetDemandHelper(Int32 permission, PermissionSet targetGrant) +54

1. The code is running locally on my machine, so it has nothing to do with Godaddy yet. I am attaching a test project to reproduce the issue. Just build the project and run default.aspx.

That stacktrace doesn't show the origin of the problem. Linq queries sometimes require the usage of reflection, however this should be possible without problems. I dont know if passing 'this' is really helpful in the query, as the object containing the query is then supposed to pass to the database to be used as a parameter. Didn't you mean this.SomeVariable ?

1. I guess I could have written the same code as :

int? size = (from s in metaData.Snapshot
                             where s.WebSite.WebsiteId == this.WebsiteId
                             select s.SizeMb).Sum();

although this code

int? size = (from s in metaData.Snapshot
                             where s.WebSite == this
                             select s.SizeMb).Sum();

has a more "object" feel to it and does work correctly in full trust.

1. I can confirm that even changing the code to

int? size = (from s in metaData.Snapshot
                             where s.WebSite.WebsiteId == this.WebsiteId
                             select s.SizeMb).Sum();

does not fix the issue. I still get a SecurityException under Medium Trust

1. BTW, if you were to run the attached test project in debug mode, you will see a very detailed exception.

Please post the complete stacktrace. With the stacktrace I can go into the code and look, otherwise I've to setup the database, data, your repro case, compile it (hopefully we've all the components you used), run it, hopefully follow the same path as you did and come to the same location in the code with a complete stacktrace. I fail to see why you didn't post the complete stacktrace in the first place, we need complete stacktraces, then we can easily identify code paths etc.

The stacktrace is:

at System.Reflection.MethodBase.PerformSecurityCheck(Object obj, RuntimeMethodHandle method, IntPtr parent, UInt32 invocationFlags) at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) at System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes) at System.Activator.CreateInstance(Type type, BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes) at System.Linq.Expressions.ExpressionCompiler.AddGlobal(Type type, Object value) at System.Linq.Expressions.ExpressionCompiler.GenerateConstant(ILGenerator gen, Type type, Object value, StackType ask) at System.Linq.Expressions.ExpressionCompiler.GenerateConstant(ILGenerator gen, ConstantExpression c, StackType ask) at System.Linq.Expressions.ExpressionCompiler.Generate(ILGenerator gen, Expression node, Stac kType ask) at System.Linq.Expressions.ExpressionCompiler.GenerateArgs(ILGenerator gen, ParameterInfo[] pis, ReadOnlyCollection1 args) at System.Linq.Expressions.ExpressionCompiler.GenerateMethodCall(ILGenerator gen, MethodInfo mi, ReadOnlyCollection1 args, Type objectType) at System.Linq.Expressions.ExpressionCompiler.GenerateMethodCall(ILGenerator gen, MethodCallExpression mc, StackType ask) at System.Linq.Expressions.ExpressionCompiler.Generate(ILGenerator gen, Expression node, StackType ask) at System.Linq.Expressions.ExpressionCompiler.GenerateConditional(ILGenerator gen, ConditionalExpression b) at System.Linq.Expressions.ExpressionCompiler.Generate(ILGenerator gen, Expression node, StackType ask) at System.Linq.Expressions.ExpressionCompiler.GenerateConvert(ILGenerator gen, UnaryExpression u) at System.Linq.Expressions.ExpressionCompiler.Generate(ILGenerator gen, Expression node, StackType ask) at System.Linq.Expressions.ExpressionCompiler.GenerateC onvert(ILGenerator gen, UnaryExpression u) at System.Linq.Expressions.ExpressionCompiler.Generate(ILGenerator gen, Expression node, StackType ask) at System.Linq.Expressions.ExpressionCompiler.GenerateLambda(LambdaExpression lambda) at System.Linq.Expressions.ExpressionCompiler.CompileDynamicLambda(LambdaExpression lambda) at System.Linq.Expressions.LambdaExpression.Compile() at SD.LLBLGen.Pro.LinqSupportClasses.LLBLGenProProvider.SetupProjectionElementsForExecution(QueryExpression toExecute) at SD.LLBLGen.Pro.LinqSupportClasses.LLBLGenProProvider.ExecuteValueListProjection(QueryExpression toExecute) at SD.LLBLGen.Pro.LinqSupportClasses.LLBLGenProProviderBase.ExecuteExpression(Expression handledExpression) at SD.LLBLGen.Pro.LinqSupportClasses.LLBLGenProProviderBase.Execute(Expression expression) at SD.LLBLGen.Pro.LinqSupportClasses.LLBLGenProProviderBase.System.Linq.IQueryProvider.Execute[TResult](Expression expression) at System.Linq.Queryable.Sum(IQ ueryable`1 source) at WebIntel.BusinessLayer.EntityClasses.WebSiteEntity.get_SizeMB()

AH, now we're getting somewhere.

The linq provider compiles some Expression elements to a delegate (using its Compile() method). This is for example done with a projection expression as it can contain whatever in-memory code.

THis compilation step (thus the call to Compile()) causes the .NET runtime apparently to do reflection on inner elements of the expression. I've to investigate how or IF this is avoidable. I'll get back to you on this.

(edit) here's your answer: http://msdn.microsoft.com/en-us/library/bb907622.aspx

It appears to be possible, but I don't know if you're allowed to overrule godaddy's security settings with own config files in the website's folder.

My modified security includes:

<IPermission class="ReflectionPermission" version="1" Flags="RestrictedMemberAccess"/>

..yet I get the following exception with .Count()

return (from x in metaData.XChatTickets where x.Interacted && x.RoomId == Roomid select x.RoomId).Count();

• SD.LLBLGen.Pro.ORMSupportClasses.NET20.dll 2.6.8.804
• SD.LLBLGen.Pro.LinqSupportClasses.NET35.dll 2.6.9.331
• SD.LLBLGen.Pro.DQE.SqlServer.NET20.dll 2.6.8.1114

** System.MethodAccessException**

{"System.Runtime.CompilerServices.StrongBox`1..ctor(System.__Canon)"}

at System.Reflection.MethodBase.PerformSecurityCheck(Object obj, RuntimeMethodHandle method, IntPtr parent, UInt32 invocationFlags) at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) at System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes) at System.Linq.Expressions.ExpressionCompiler.AddGlobal(Type type, Object value) at System.Linq.Expressions.ExpressionCompiler.GenerateConstant(ILGenerator gen, Type type, Object value, StackType ask) at System.Linq.Expressions.ExpressionCompiler.Generate(ILGenerator gen, Expression node, StackType ask) at System.Linq.Expressions.ExpressionCompiler.GenerateArgs(ILGenerator gen, ParameterInfo[] pis, ReadOnlyCollection1 args) at System.Linq.Expressions.ExpressionCompiler.GenerateMethodCall(ILGenerator gen, MethodInfo mi, ReadOnlyCollection1 args, Type objectType) at System.Linq.Expressions.ExpressionCompiler.GenerateMethodCall(ILGenerator gen, MethodCallExpression mc, StackType ask) at System.Linq.Expressions.ExpressionCompiler.Generate(ILGenerator gen, Expression node, StackType ask) at System.Linq.Expressions.ExpressionCompiler.GenerateConvert(ILGenerator gen, UnaryExpression u) at System.Linq.Expressions.ExpressionCompiler.Generate(ILGenerator gen, Expression node, StackType ask) at System.Linq.Expressions.ExpressionCompiler.GenerateConvert(ILGenerator gen, UnaryExpression u) at System.Linq.Expressions.ExpressionCompiler.Generate(ILGenerator gen, Expression node, StackType ask) at System.Linq.Expressions.ExpressionCompiler.GenerateLambda(LambdaExpression lambda) at System.Linq.Expressions.ExpressionCompiler.CompileDynamicLambda(LambdaExpression lambda) at System.Linq.Expressions.LambdaExpression.Compile() at SD.LLBLGen.Pro.LinqSupportClasses.LLBLGenProProvider.SetupProjectionElementsForExecution(QueryExpression toExecute) at SD.LLBLGen.Pro.LinqSupportClasses.LLBLGenProProvider.ExecuteValueListProjection(QueryExpression toExecute) at SD.LLBLGen.Pro.LinqSupportClasses.LLBLGenProProviderBase.ExecuteExpression(Expression handledExpression) at SD.LLBLGen.Pro.LinqSupportClasses.LLBLGenProProviderBase.System.Linq.IQueryProvider.Execute[TResult](Expression expression) at System.Linq.Queryable.Count[TSource](IQueryable`1 source)

Are you hosting at Godaddy too?

The following should be added to the C:\WINDOWS\Microsoft.NET\Framework\v2.0.50215\CONFIG\web_mediumtrust.config file

<SecurityClass 
  Name="ReflectionPermission" 
  Description="System.Security.Permissions.ReflectionPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>

Thanks for the reply, I'm a big fan of LLBLGen!

I'm using Mosso, recently i discovered a security flaw and shot myself in the foot (a bit) by reporting it. They've been good about it, and given me access to the new config settings but i'm not allowed to share them unfortunately.

I should also point out I'm using .NET 35 x64

I have the following implemented: custom trust file: web_mossotrust.config

<SecurityClass Name="ReflectionPermission" Description="System.Security.Permissions.ReflectionPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>

<IPermission class="ReflectionPermission" version="1" Flags="RestrictedMemberAccess"/>

(everything works when set to Unrestricted="true")

application's web.config

<securityPolicy>
   <trustLevel name="Mosso" policyFile="web_mossotrust.config" />
</securityPolicy>
<trust level="Mosso" originUrl=""/>

Thanks, Frank.

The PublicKeyToken might be different for x64. But it didn't solve the problem..

PublicKeyToken=b03f5f7f11d50a3a

Thanks, Frank.

As it's unclear what's the real problem as you seem to have added the proper permissions as far as I can tell, I found an article which discusses the exact same thing, and which has more in-depth info about what to do.

http://blogs.rev-net.com/ddewinter/2009/04/22/using-linq-to-sql-and-ef-in-sharepoint-under-medium-trust/

Could you please verify that you have implemented the solution discussed in this article?

Yep, that's been done (although I don't have sharepoint, or the config files). The relevant part of my external trust config is:

<SecurityClasses>

           ---other classes here removed, as Mosso doesn't want me sharing them---

            <SecurityClass Name="ReflectionPermission" Description="System.Security.Permissions.ReflectionPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>

</SecurityClasses>

<NamedPermissionSets>

            <PermissionSet class="NamedPermissionSet" version="1" Unrestricted="true" Name="FullTrust" Description="Allows full access to all resources"/>
            <PermissionSet class="NamedPermissionSet" version="1" Name="Nothing" Description="Denies all resources, including the right to execute"/>
            <PermissionSet class="NamedPermissionSet" version="1" Name="ASP.Net">

             ---other permissions here removed, as Mosso doesn't want me sharing them---        

              <IPermission class="ReflectionPermission" version="1"Flags="RestrictedMemberAccess"/>
            </PermissionSet>

             ---I Just added this below (SPRestricted from the url you specified) which made no difference---

            <PermissionSet class="NamedPermissionSet" version="1" Name="SPRestricted">
              <IPermission class="ReflectionPermission" version="1" Flags="RestrictedMemberAccess"/>
            </PermissionSet>

</NamedPermissionSets>

Thanks, Frank.

Could you please paste the complete message you get? As the exception isn't a security exception, but a method access exception it seems. (which I have no idea why it occurs). It happens inside a linq query it seems, can you track down which linq query that is, and more importantly, if you run that query in a console app for example, does it work then or does it give the same error? (with the same generated code/runtime lib)

Hi, It works fine as a console app, and it works when I set the reflectionpermission to Unrestricted="true"

There is no more detail (unless I'm missing something) - it simply says 'Method access exception'

Do you want to see it via teamviewer? Would that help?

It happens with Count(), but even with this!

            var metaData = new LinqMetaData();
            var q = (from x in metaData.XChatTickets where x.Interacted && x.RoomId == Roomid select x.RoomId);
            //trust issue, cant use Count();
            var c = 0;
            foreach (var i in q) <- fails here
            {
                c++;
            }
            return c;

Thanks, Frank.

Does the assembly that contains your entities have more permissions than your web site? (The most common cause of this would be if your entity assembly is installed in the GAC.) If that's the case, then RestrictedMemberAccess permissions will not be enough for LINQ to work. You will need MemberAccess.

Yes, "MemberAccess" as you mentioned, does work!

My entity assembly (the project generated by LLBLGen) is in my /bin directory, and is not in the GAC..

Where should I look, is there any way I determine which assembly has the elevated privileges?

If you can run CasPol.exe on the target machine (located in the Framework directory - %windir%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe), you should be able to see the permissions granted to an assembly by using the -rsp switch.

CasPol.exe -rsp <assembly>

That should give us a good hint on what permissions your entity assembly is running with. It's not a definitive answer but it should help.

Everything involved in my /bin directory reports this (my assemblies and the llblgen ones):

Resolving permissions for level = Enterprise Resolving permissions for level = Machine Resolving permissions for level = User

Grant = <PermissionSet class="System.Security.PermissionSet" version="1" Unrestricted="true"/>

Success

Thanks, Frank.

Btw: I tested this on the Mosso hosting system, the error is the same.. It seems it's not limited to my environment, just the config I'm using.

Thanks, Frank.

Assuming your entity assembly is not in the GAC and the output that you have shown, both your entity assembly and your web site should be running in the same trust level. Are you sure it's not in the GAC? (gacutil /l <assemblyname>)

Is it possible that you have security attributes on either your web site or your entity assembly that request optional permissions or refuse permissions?

http://msdn.microsoft.com/en-us/library/4b7hy971.aspx http://msdn.microsoft.com/en-us/library/ea5yat38.aspx