473,322 Members | 1,405 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,322 software developers and data experts.

Plug-ins and security?

Im creating a host application (a game) which allows for users to supply a
custom computer AI. This will be in the form of a plugin assembly which
supports a specified interface. So the host will call interface functions in
the plugins like PerformMove(GameState gs). The host application is a
trusted application that runs on a server, and users upload plugins to this
server, but I can't trust the plugins.

PlugIn:
- Must adhere to a specific public interface.
- Is allowed to create and maintain private state information, to be used
between calls.
- Is not allowed access to I/O, Networks, Other processes, etc.
- Will recieve some objects by reference form the host, but has only read
capabilities on these objects. If this is not possible, it will recieve
objects by value only.

Host:
- Can kill any plugin process/thread that takes too long time.
- Can kill any plugin process/thread that takes too much memory (or maybe
limit the allowed memory size at creation of the plugin process?)
- In order to allow the host enough control over the plugin to be able to
kill it, I expect to have to run the plugin functions in a different thread
or process.

I'm pretty new to security, so how would you set up these plugins,
securitywise?
Jul 21 '05 #1
2 1394
The Code Access Security model of the .NET Framework allows you to do
this pretty easily. You will want to create a separate AppDomain to
load your plugin assemblies. You can specify limited permissions for
all code executing in the AppDomain. You then communicate with your
plugin code using .NET Remoting.

See the documentation for AppDomain.SetAppDomainPolicy for a hint on how
to get started:

http://msdn.microsoft.com/library/de...olicytopic.asp

Joshua Flanagan
http://flimflan.com/blog
Jesper wrote:
Im creating a host application (a game) which allows for users to supply a
custom computer AI. This will be in the form of a plugin assembly which
supports a specified interface. So the host will call interface functions in
the plugins like PerformMove(GameState gs). The host application is a
trusted application that runs on a server, and users upload plugins to this
server, but I can't trust the plugins.

PlugIn:
- Must adhere to a specific public interface.
- Is allowed to create and maintain private state information, to be used
between calls.
- Is not allowed access to I/O, Networks, Other processes, etc.
- Will recieve some objects by reference form the host, but has only read
capabilities on these objects. If this is not possible, it will recieve
objects by value only.

Host:
- Can kill any plugin process/thread that takes too long time.
- Can kill any plugin process/thread that takes too much memory (or maybe
limit the allowed memory size at creation of the plugin process?)
- In order to allow the host enough control over the plugin to be able to
kill it, I expect to have to run the plugin functions in a different thread
or process.

I'm pretty new to security, so how would you set up these plugins,
securitywise?

Jul 21 '05 #2
Thanks. At first glance, it seems like just what I am looking for.
Jul 21 '05 #3

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

13
by: Mike | last post by:
Apparently there is now a way to hide html source code. How it done? For example see: See http://www.eteamz.com/banksblaze/
6
by: Graham Ashton | last post by:
Hi. I'm trying to edit C# code from within eclipse 2.1.1 but am getting nowhere. The Improve plug-in doesn't seem to install on such recent versions of eclipse; is there anything else out there...
3
by: Muhammad Aftab Alam | last post by:
Hello All is it possible to write plug-in for IIS with c#, if so what path should I follow to get to what I want. best regards Muhammad Aftab Alam
6
by: Gary James | last post by:
This may not be a direct C# question, but since I'll be using using C# for development, I thought I'd pose the question here. I'll soon be involved in the design of a new software product that...
1
by: TusharP | last post by:
Hi, Before asking my doubt, first I want to tell you about my application structure. I want to design a Client Desktop program, which has an MDI form. This MDi Form has one Horizontal Toolbar....
1
by: Koichi | last post by:
Hi, I'm now making a plug-in for a CG software. I embed Python in a plugin and it works. The problem is that it conflicts with other plugins that also embeds Python because it runs in the same...
1
by: DeveloperX | last post by:
I've knocked up a quick plug in project (actually it's 6 projects, but more on that in a moment). This project is referenced by a shared add in (used for Excel). The issue I have is that when...
1
by: JoderCoder | last post by:
I have an application (the code is C++, platform VS 2003) which has a plug in for outlook (i also have the msi installation file for the program). if i install the msi, outlook plug in will be...
4
by: -Lost | last post by:
How should one write a plug-in interface? I've tossed around several ideas but rudimentary ones at best. For example: Plug-In-A -Plug-In-Proxy -Application The plug-in simply hands off its...
0
by: ryjfgjl | last post by:
ExcelToDatabase: batch import excel into database automatically...
0
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...
0
by: Vimpel783 | last post by:
Hello! Guys, I found this code on the Internet, but I need to modify it a little. It works well, the problem is this: Data is sent from only one cell, in this case B5, but it is necessary that data...
0
by: jfyes | last post by:
As a hardware engineer, after seeing that CEIWEI recently released a new tool for Modbus RTU Over TCP/UDP filtering and monitoring, I actively went to its official website to take a look. It turned...
1
by: PapaRatzi | last post by:
Hello, I am teaching myself MS Access forms design and Visual Basic. I've created a table to capture a list of Top 30 singles and forms to capture new entries. The final step is a form (unbound)...
1
by: Defcon1945 | last post by:
I'm trying to learn Python using Pycharm but import shutil doesn't work
1
by: Shællîpôpï 09 | last post by:
If u are using a keypad phone, how do u turn on JavaScript, to access features like WhatsApp, Facebook, Instagram....
0
by: af34tf | last post by:
Hi Guys, I have a domain whose name is BytesLimited.com, and I want to sell it. Does anyone know about platforms that allow me to list my domain in auction for free. Thank you
0
by: Faith0G | last post by:
I am starting a new it consulting business and it's been a while since I setup a new website. Is wordpress still the best web based software for hosting a 5 page website? The webpages will be...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.