There are several problems with the attribute-based approach to partially trusted services. First, every time there is a change in what the service does—or, for that matter, in any of the downstream classes it uses—you will need to modify the stack of attributes or the permission set file. The service is therefore coupled to those downstream classes, and the maintenance cost is increased.

Second, because the permissions are part of the service definition, there is no way to use the service with different permissions as a product of the hosting environment. That is, you cannot dynamically give it more or fewer permissions.

Third, and most important, it is unlikely that most services will actually go to the trouble of analyzing the security permissions required for them to operate and meticulously reducing their granted permissions in order to run with the least possible privileges and permissions. If anything, it is the host that should be concerned about what exactly the service it loads is up to, and yet the host by default has no ability to affect the service's permissions. WCF's ServiceHost hosts all services in full trust. It would be better for the host, as well as for the service's own protection, to allow the host to grant the service whichever permissions it deems appropriate.

To that end, I wrote the class AppDomainHost, defined in Example D-9.

public class AppDomainHost : IDisposable
{
   //Create new app domain in full trust
   public AppDomainHost(Type serviceType,params Uri[] baseAddresses);
   public AppDomainHost(Type serviceType,string appDomainName,
                        params Uri[] baseAddresses);

   //Create new app domain with specified permission set
   public AppDomainHost(Type serviceType,PermissionSet permissions,
                        params Uri[] baseAddresses);
   public AppDomainHost(Type serviceType,PermissionSet permissions,
                        string appDomainName,params Uri[] baseAddresses);
   public AppDomainHost(Type serviceType,StandardPermissionSet standardSet,
                        string appDomainName,params Uri[] baseAddresses);

   //Additional constructors that take standard permission set,
   //permission set filename, and an existing app domain

   public void Open(  );
   public void Close(  );
   public void Abort(  );

   //More members
}

AppDomainHost can be used just like the WCF-provided ServiceHost:

AppDomainHost host = new AppDomainHost(typeof(MyService));
host.Open(  );

The difference is that AppDomainHost will host the provided service type in a new app domain, not in the app domain of its caller. The new app domain name will default to "AppDomain Host for", suffixed with the service type and a new GUID. You can also specify a name for the new app domain:

AppDomainHost host = new AppDomainHost(typeof(MyService),"MyService App Domain");
host.Open(  );

The new app domain is created with full trust by default. However, placing the service in a separate app domain is the key to managing partially trusted services. AppDomainHost allows you to provide the permissions for the new app domain. For example, to host this service:

class MyService : IMyContract
{
   public void MyMethod(  )
   {
      Form form = new TestForm(  );
      form.ShowDialog(  );
   }
}

with the same permissions as in Example D-7, you would write:

PermissionSet permissions = new PermissionSet(PermissionState.None);
permissions.AddPermission(new SecurityPermission(
                                                SecurityPermissionFlag.Execution));
permissions.AddPermission(new UIPermission(
                                          UIPermissionWindow.SafeTopLevelWindows));
AppDomainHost host = new AppDomainHost(typeof(MyService),permissions);
host.Open(  );

You can also use a permission set file, but unlike with Example D-8, the file is needed only at runtime and can be modified post-deployment. You can also specify one of the standard named permission sets.

A single host process can have as many instances of AppDomainHost as required, each hosting the same or a different service type and each with any arbitrary set of permissions, as shown in Example D-10.

//Default is service with full trust
AppDomainHost host0 = new AppDomainHost(typeof(MyService),
                      "Full Trust App Domain",new Uri("net.tcp://localhost:6000"));
host0.Open(  );

//With just enough permissions to do work
PermissionSet permissions1 = new PermissionSet(PermissionState.None);
permissions1.AddPermission(new SecurityPermission(
                           SecurityPermissionFlag.Execution));
permissions1.AddPermission(new UIPermission(
                           UIPermissionWindow.SafeTopLevelWindows));

AppDomainHost host1 = new AppDomainHost(typeof(MyService),permissions1,
                "My Partial Trust App Domain",new Uri("net.tcp://localhost:6001"));
host1.Open(  );


//With not enough permissions to do work
PermissionSet permissions2 = new PermissionSet(PermissionState.None);
permissions2.AddPermission(new SecurityPermission(
                           SecurityPermissionFlag.Execution));

AppDomainHost host2 = new AppDomainHost(typeof(MyService),permissions2,
                     "Not enough permissions",new Uri("net.tcp://localhost:6002"));
host2.Open(  );


//Using one of the named permission sets
AppDomainHost host3 = new AppDomainHost(typeof(MyService),StandardPermissionSet.
Internet,
                      "Named permission set",new Uri("net.tcp://localhost:6003"));
host3.Open(  );

class ServiceHostActivator : MarshalByRefObject
{
   ServiceHost m_Host;

   public void CreateHost(Type serviceType,Uri[] baseAddresses)
   {
      m_Host = new ServiceHost(serviceType,baseAddresses);
   }
   public void Open(  )
   {
      m_Host.Open(  );
   }
   public void Close(  )
   {
      m_Host.Close(  );
   }
   public void Abort(  )
   {
      m_Host.Abort(  );
   }
   //Rest of the implementation
}

public class AppDomainHost : IDisposable
{
   ServiceHostActivator m_ServiceHostActivator;

   public AppDomainHost(Type serviceType,params Uri[] baseAddresses) :
                        this(serviceType,"AppDomain Host for "+serviceType+"
                        "+Guid.NewGuid(  ),baseAddresses)
   {}

   public AppDomainHost(Type serviceType,string appDomainName,
                        params Uri[] baseAddresses) : this(serviceType,
                        new PermissionSet(PermissionState.Unrestricted),
                        appDomainName,baseAddresses)
   {}

   public AppDomainHost(Type serviceType,PermissionSet permissions,
                        string appDomainName,params Uri[] baseAddresses) :
                        this(serviceType,AppDomain.CreateDomain(appDomainName),
                        permissions,baseAddresses)
   {}

   //More constructors

protected AppDomainHost(Type serviceType,AppDomain appDomain,
                           PermissionSet permissions,Uri[] baseAddresses)
   {
      string assemblyName = Assembly.GetAssembly(
                                            typeof(ServiceHostActivator)).FullName;
      m_ServiceHostActivator = appDomain.CreateInstanceAndUnwrap(
                              assemblyName,typeof(ServiceHostActivator).ToString(  ))
                                                           as ServiceHostActivator;

      appDomain.SetPermissionsSet(permissions);

      m_ServiceHostActivator.CreateHost(serviceType,baseAddresses);
   }
   public void Open(  )
   {
      m_ServiceHostActivator.Open(  );
   }
   public void Close(  )
   {
      m_ServiceHostActivator.Close(  );
   }
   public void Abort(  )
   {
      m_ServiceHostActivator.Abort(  );
   }
   void IDisposable.Dispose(  )
   {
      Close(  );
   }
}

public static class CodeAccessSecurityHelper
{
   public static void SetPermissionsSet(this AppDomain appDomain,
                                        PermissionSet permissions)
   {
      PolicyLevel policy = PolicyLevel.CreateAppDomainLevel(  );
      policy.RootCodeGroup.PolicyStatement = new PolicyStatement(permissions);
      appDomain.SetAppDomainPolicy(policy);
   }
   //More members
}

public sealed class AppDomain : MarshalByRefObject,...
{
   public void SetAppDomainPolicy(PolicyLevel domainPolicy);
   //More members
}