index > Visual Studio Tools for Office > How to add caspol security settings for referenced assemblies

How to add caspol security settings for referenced assemblies

I'm building an Outlook add-in using VSTO 2005 targeted at Outlook 2003.

I've successfully added the SetSecurity project (from the MSDN "Deploying VS2005 Tools for Office Solutions Using Windows Installer" 2 part series) to my solution, which appears to properly configure security for my primary dll when my add in is deployed to another machine using my setup project.

However, the SetSecurity project sample doesn't appear to set up permissions for the com objects referenced in my add-in and my add-in throws an error when I run it. Specifically, my add-in uses the CDO and web browser com objects, so I'm guessing I also need to add Caspol calls for the Interop.MAPI.dll and the Interop.SHDocVw.dll to my setup project?

What's the best way to do this? I've never used Caspol before, so its syntax is Greek to me (i.e. the specifiec syntax would be most helpful)!.

Thanks for any thelp!

David H.

David -

You have to add a security policy for each referenced assembly. The example provided in the MSDN only handles a single assembly. If you have more than a single assembly, you'll either need to modify the SetSecurity code provided by MS to handle that, or just make calls to the CasPol command-line utility from your installer.

-dhtroy

Douglas H. Troy

Also when using CasPol one can specify that a whole directory is trusted instead of individual Assemblies.¹ Such as:

caspol -u -ag All_Code -url "C:\TestVSTO\*

OmegaMan

You can do this, and I fully understand the desire a developer might have for wanting to make this choice, but one must realize this creates a security risk. Now any assembly dumped into that directory has execution permissions and this kind of thing should be taken into account, especially since we're dealing with customers systems, and not our own.

IMHO, it is far better to grant the necessary security to those assemblies that you will use, and digitally sign those that you have control over ...

Once you understand how Security Policies work, and how to create them, it's very easy add/remove assemblies from a security grouping, without the need to grant the entire directory full trust execution permissions.

My two cents.

-dhtroy

Douglas H. Troy

I actually agree with DHT in terms of security....once you have a handle on the situation, specify each one individually.

OmegaMan

reply 5