service access denied to DLLs

[Shailesh Humbad]

I figured out what was causing the "Access is Denied" error when
calling functions from referenced DLLs in my service. I've tried to
be very detailed, so bear with me.

It turns out that libraries I made myself were not having this
problem, but it only happened with a zip library I downloaded and
copied into my program's directory. When using classes from this
library, my service threw an "Access Is Denied" FileLoadExcepti on,
which I've quoted below.

(Note that I was only able to trap the exception to a log file because
the zip library is accessed from one of my own libraries, otherwise,
the service would fail on startup with an SCM error dialog saying "the
service did not return any error code".)

The access is denied error occurred when I set up the service to run
as the Local System account, even though this account had full NT
permissions to the DLL. When I ran the service as Administrator, the
problem went away. But running the service as Administrator is not a
feasible option for deployment.

I then ran the Assembly Binding Log Viewer (fuslogvw.exe) and turned
on logging. After running the service, the load failure was logged as
an ASP.Net exception with the result of "Access is Denied". The log
messages said "Unable to extract last modified time from
c:\inetpub\wwwr oot\jobs\ICShar pCode.SharpZipL ib.DLL." (See the second
message below.) So I opened the DLL in Textpad as UTF-8, changed a
byte, changed it back, and then saved the file. After this, the
service could access the DLL without any problems running as Local System.

I can understand why .Net would want to check the last modified time,
but why did it fail to extract it? Before I modified it, the DLL did
have a valid last modified time stamp (as verified by checking the
file properties). Why did .Net fail to extract the time stamp when
running as LocalSystem, but not when running as Administrator?
Finally, why is the load failure categorized as an "ASP.Net" failure
in the Assembly Binding Log and not a "Default" failure? My immediate
issue is solved, but this behaviour may suggest a problem in the way
..Net assembly binder reads the last modified time stamp in Windows 2000.

Regards,
Shailesh

------------------------------------------FROM SERVICE LOG FILE:

Starting My Maintenance Service at 11/6/2003 5:02:52 PM with private
key file ''.
Error unzipping.
System.IO.FileL oadException: Access is denied: 'ICSharpCode.Sh arpZipLib'.
File name: "ICSharpCode.Sh arpZipLib"
at MyNamespace.Zip Helper.UnzipSin gleFile(String strInputFile,
String strOutputFile)
at MyMaintenanceSe rvice.OnStart(S tring[] args)

=== Pre-bind state information ===
LOG: DisplayName = ICSharpCode.Sha rpZipLib, Version=0.5.0.0 ,
Culture=neutral , PublicKeyToken= 1b03e6acf1164f7 3
(Fully-specified)
LOG: Appbase = c:\inetpub\wwwr oot\jobs\
LOG: Initial PrivatePath = NULL
Calling assembly : ziphelper, Version=0.0.0.0 , Culture=neutral ,
PublicKeyToken= null.
===

LOG: Publisher policy file is not found.
LOG: Host configuration file not found.
LOG: Using machine configuration file from
C:\WINNT\Micros oft.NET\Framewo rk\v1.1.4322\co nfig\machine.co nfig.
LOG: Post-policy reference: ICSharpCode.Sha rpZipLib, Version=0.5.0.0 ,
Culture=neutral , PublicKeyToken= 1b03e6acf1164f7 3
LOG: Attempting download of new URL
file:///c:/inetpub/wwwroot/jobs/ICSharpCode.Sha rpZipLib.DLL.
------------------------------------------FROM FUSLOGVW.EXE:

*** Assembly Binder Log Entry (11/6/2003 @ 5:02:52 PM) ***

The operation failed.
Bind result: hr = 0x80070005. Access is denied.

Assembly manager loaded from:
C:\WINNT\Micros oft.NET\Framewo rk\v1.1.4322\fu sion.dll
Running under executable c:\inetpub\wwwr oot\jobs\myjob. exe
--- A detailed error log follows.

=== Pre-bind state information ===
LOG: DisplayName = ICSharpCode.Sha rpZipLib, Version=0.5.0.0 ,
Culture=neutral , PublicKeyToken= 1b03e6acf1164f7 3
(Fully-specified)
LOG: Appbase = c:\inetpub\wwwr oot\jobs\
LOG: Initial PrivatePath = NULL
LOG: Dynamic Base = NULL
LOG: Cache Base = NULL
LOG: AppName = NULL
Calling assembly : ziphelper, Version=0.0.0.0 , Culture=neutral ,
PublicKeyToken= null.
===

LOG: Processing DEVPATH.
LOG: DEVPATH is not set. Falling through to regular bind.
LOG: Publisher policy file is not found.
LOG: Host configuration file not found.
LOG: Using machine configuration file from
C:\WINNT\Micros oft.NET\Framewo rk\v1.1.4322\co nfig\machine.co nfig.
LOG: Post-policy reference: ICSharpCode.Sha rpZipLib, Version=0.5.0.0 ,
Culture=neutral , PublicKeyToken= 1b03e6acf1164f7 3
LOG: Cache Lookup was unsuccessful.
LOG: Attempting download of new URL
file:///c:/inetpub/wwwroot/jobs/ICSharpCode.Sha rpZipLib.DLL.
LOG: Assembly download was successful. Attempting setup of file:
c:\inetpub\wwwr oot\jobs\ICShar pCode.SharpZipL ib.DLL
ERR: Unable to extract last modified time from
c:\inetpub\wwwr oot\jobs\ICShar pCode.SharpZipL ib.DLL.
ERR: Failed to complete setup of assembly (hr = 0x80070005). Probing
terminated.

[Peter Huang]

Hi Shailesh,

Did you use the Ngen tool with ICSharpCode.Sha rpZipLib.DLL to create a
native image?
Native Image Generator (Ngen.exe)
http://msdn.microsoft.com/library/de...us/cptools/htm
l/cpgrfnativeimag egeneratorngene xe.asp

If so I think you may use the assembly name as the argument of Ngen.
I think you may try to workaround the problem by using any of the three
workaround.
1. You could use the full assembly name.
2. You could change into the directory where the assembly lives and then
pass in the partial assembly name.
3. You could just use filenames instead of assembly names. For instance,
you could provide the full or partial path to ngen, or just change to the
directory where ICSharpCode.Sha rpZipLib.DLL lives before you compile it.

For detailed information you may try to refer the link above.
Did I misunderstand you meaning?
If you have any concern on this issue,please post here.
Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
--------------------

Date: Fri, 07 Nov 2003 02:50:05 -0500
From: Shailesh Humbad <hu******@hotma il.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031007X-Accept-Language: en-us, en
MIME-Version: 1.0
Subject: service access denied to DLLs
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Message-ID: <er************ **@TK2MSFTNGP10 .phx.gbl>
Newsgroups: microsoft.publi c.dotnet.langua ges.vb
NNTP-Posting-Host: cpe-024-210-100-160.twmi.rr.com 24.210.100.160
Lines: 1
Path: cpmsftngxa06.ph x.gbl!TK2MSFTNG P08.phx.gbl!TK2 MSFTNGP10.phx.g bl
Xref: cpmsftngxa06.ph x.gbl microsoft.publi c.dotnet.langua ges.vb:154563
X-Tomcat-NG: microsoft.publi c.dotnet.langua ges.vb

I figured out what was causing the "Access is Denied" error when
calling functions from referenced DLLs in my service. I've tried to
be very detailed, so bear with me.

It turns out that libraries I made myself were not having this
problem, but it only happened with a zip library I downloaded and
copied into my program's directory. When using classes from this
library, my service threw an "Access Is Denied" FileLoadExcepti on,
which I've quoted below.

(Note that I was only able to trap the exception to a log file because
the zip library is accessed from one of my own libraries, otherwise,
the service would fail on startup with an SCM error dialog saying "the
service did not return any error code".)

The access is denied error occurred when I set up the service to run
as the Local System account, even though this account had full NT
permissions to the DLL. When I ran the service as Administrator, the
problem went away. But running the service as Administrator is not a
feasible option for deployment.

I then ran the Assembly Binding Log Viewer (fuslogvw.exe) and turned
on logging. After running the service, the load failure was logged as
an ASP.Net exception with the result of "Access is Denied". The log
messages said "Unable to extract last modified time from
c:\inetpub\www root\jobs\ICSha rpCode.SharpZip Lib.DLL." (See the second
message below.) So I opened the DLL in Textpad as UTF-8, changed a
byte, changed it back, and then saved the file. After this, the
service could access the DLL without any problems running as Local System.

I can understand why .Net would want to check the last modified time,
but why did it fail to extract it? Before I modified it, the DLL did
have a valid last modified time stamp (as verified by checking the
file properties). Why did .Net fail to extract the time stamp when
running as LocalSystem, but not when running as Administrator?
Finally, why is the load failure categorized as an "ASP.Net" failure
in the Assembly Binding Log and not a "Default" failure? My immediate
issue is solved, but this behaviour may suggest a problem in the way
.Net assembly binder reads the last modified time stamp in Windows 2000.

Regards,
Shailesh

------------------------------------------FROM SERVICE LOG FILE:

Starting My Maintenance Service at 11/6/2003 5:02:52 PM with private
key file ''.
Error unzipping.
System.IO.File LoadException: Access is denied: 'ICSharpCode.Sh arpZipLib'.
File name: "ICSharpCode.Sh arpZipLib"
at MyNamespace.Zip Helper.UnzipSin gleFile(String strInputFile,
String strOutputFile)
at MyMaintenanceSe rvice.OnStart(S tring[] args)

=== Pre-bind state information ===
LOG: DisplayName = ICSharpCode.Sha rpZipLib, Version=0.5.0.0 ,
Culture=neutra l, PublicKeyToken= 1b03e6acf1164f7 3
(Fully-specified)
LOG: Appbase = c:\inetpub\wwwr oot\jobs\
LOG: Initial PrivatePath = NULL
Calling assembly : ziphelper, Version=0.0.0.0 , Culture=neutral ,
PublicKeyToken =null.
===

LOG: Publisher policy file is not found.
LOG: Host configuration file not found.
LOG: Using machine configuration file from
C:\WINNT\Micro soft.NET\Framew ork\v1.1.4322\c onfig\machine.c onfig.
LOG: Post-policy reference: ICSharpCode.Sha rpZipLib, Version=0.5.0.0 ,
Culture=neutra l, PublicKeyToken= 1b03e6acf1164f7 3
LOG: Attempting download of new URL
file:///c:/inetpub/wwwroot/jobs/ICSharpCode.Sha rpZipLib.DLL.
------------------------------------------FROM FUSLOGVW.EXE:

*** Assembly Binder Log Entry (11/6/2003 @ 5:02:52 PM) ***

The operation failed.
Bind result: hr = 0x80070005. Access is denied.

Assembly manager loaded from:
C:\WINNT\Micro soft.NET\Framew ork\v1.1.4322\f usion.dll
Running under executable c:\inetpub\wwwr oot\jobs\myjob. exe
--- A detailed error log follows.

=== Pre-bind state information ===
LOG: DisplayName = ICSharpCode.Sha rpZipLib, Version=0.5.0.0 ,
Culture=neutra l, PublicKeyToken= 1b03e6acf1164f7 3
(Fully-specified)
LOG: Appbase = c:\inetpub\wwwr oot\jobs\
LOG: Initial PrivatePath = NULL
LOG: Dynamic Base = NULL
LOG: Cache Base = NULL
LOG: AppName = NULL
Calling assembly : ziphelper, Version=0.0.0.0 , Culture=neutral ,
PublicKeyToken =null.
===

LOG: Processing DEVPATH.
LOG: DEVPATH is not set. Falling through to regular bind.
LOG: Publisher policy file is not found.
LOG: Host configuration file not found.
LOG: Using machine configuration file from
C:\WINNT\Micro soft.NET\Framew ork\v1.1.4322\c onfig\machine.c onfig.
LOG: Post-policy reference: ICSharpCode.Sha rpZipLib, Version=0.5.0.0 ,
Culture=neutra l, PublicKeyToken= 1b03e6acf1164f7 3
LOG: Cache Lookup was unsuccessful.
LOG: Attempting download of new URL
file:///c:/inetpub/wwwroot/jobs/ICSharpCode.Sha rpZipLib.DLL.
LOG: Assembly download was successful. Attempting setup of file:
c:\inetpub\www root\jobs\ICSha rpCode.SharpZip Lib.DLL
ERR: Unable to extract last modified time from
c:\inetpub\www root\jobs\ICSha rpCode.SharpZip Lib.DLL.
ERR: Failed to complete setup of assembly (hr = 0x80070005). Probing
terminated.

[Hans]

Shailesh Humbad <hu******@hotma il.com> wrote in message news:<er******* *******@TK2MSFT NGP10.phx.gbl>. ..

I figured out what was causing the "Access is Denied" error when ...

Hello Shailesh,

we're experiencing the same issue with some of our ASP.NET
applications as well as with a remoting app : the ACLs are ok, yet
access is denied. Modifying a byte in the dll solves the issue
temporarily. BTW, the problem occurs on our own DLLs.
We suspect our McAfee NetShield to cause the problem since everything
had been running fine for over a year until the last update to
NetShield last Friday. We've also had similar issues before where
outbound files were scanned. Disabling outbound scans solved that
problem.

Do you have antivirus on your server too? I'll see whether our
SysAdmin agrees in running a FileMon trace on one app, maybe I'll know
more then.
Do you still experience the problem?

Best Regards

Hans

[HVE]

On 28 Nov 2003 03:46:23 -0800, Hans wrote:

Shailesh Humbad <hu******@hotma il.com> wrote in message news:<er******* *******@TK2MSFT NGP10.phx.gbl>. ..

I figured out what was causing the "Access is Denied" error when ...

Hello Shailesh,

we're experiencing the same issue with some of our ASP.NET
applications as well as with a remoting app : the ACLs are ok, yet
access is denied. Modifying a byte in the dll solves the issue
temporarily. BTW, the problem occurs on our own DLLs.
We suspect our McAfee NetShield to cause the problem since everything
had been running fine for over a year until the last update to
NetShield last Friday. We've also had similar issues before where
outbound files were scanned. Disabling outbound scans solved that
problem.

Do you have antivirus on your server too? I'll see whether our
SysAdmin agrees in running a FileMon trace on one app, maybe I'll know
more then.
Do you still experience the problem?

Best Regards

Hans

Hi Shailesh,

I've found a way to reproduce the problem :

Starting from a working system, I set the Archive flag off for the DLL for
which access was denied before.
I try to re-run the application : Access Denied.
I reset the Archive flag and re-run the application : Access Denied
I modify the dll phyiscally and re-run the application : working again.

This might indicate that either the antivirus or the backup program (which
resets the Archive flag after a backup) cause the problem.

Best Regards

Hans