service access denied to DLLs

[Shailesh Humbad]

I figured out what was causing the "Access is Denied" error when
calling functions from referenced DLLs in my service. I've tried to
be very detailed, so bear with me.

It turns out that libraries I made myself were not having this
problem, but it only happened with a zip library I downloaded and
copied into my program's directory. When using classes from this
library, my service threw an "Access Is Denied" FileLoadException,
which I've quoted below.

(Note that I was only able to trap the exception to a log file because
the zip library is accessed from one of my own libraries, otherwise,
the service would fail on startup with an SCM error dialog saying "the
service did not return any error code".)

The access is denied error occurred when I set up the service to run
as the Local System account, even though this account had full NT
permissions to the DLL. When I ran the service as Administrator, the
problem went away. But running the service as Administrator is not a
feasible option for deployment.

I then ran the Assembly Binding Log Viewer (fuslogvw.exe) and turned
on logging. After running the service, the load failure was logged as
an ASP.Net exception with the result of "Access is Denied". The log
messages said "Unable to extract last modified time from
c:\inetpub\wwwroot\jobs\ICSharpCode.SharpZipLib.DL L." (See the second
message below.) So I opened the DLL in Textpad as UTF-8, changed a
byte, changed it back, and then saved the file. After this, the
service could access the DLL without any problems running as Local System.

I can understand why .Net would want to check the last modified time,
but why did it fail to extract it? Before I modified it, the DLL did
have a valid last modified time stamp (as verified by checking the
file properties). Why did .Net fail to extract the time stamp when
running as LocalSystem, but not when running as Administrator?
Finally, why is the load failure categorized as an "ASP.Net" failure
in the Assembly Binding Log and not a "Default" failure? My immediate
issue is solved, but this behaviour may suggest a problem in the way
..Net assembly binder reads the last modified time stamp in Windows 2000.

Regards,
Shailesh

------------------------------------------FROM SERVICE LOG FILE:

Starting My Maintenance Service at 11/6/2003 5:02:52 PM with private
key file ''.
Error unzipping.
System.IO.FileLoadException: Access is denied: 'ICSharpCode.SharpZipLib'.
File name: "ICSharpCode.SharpZipLib"
at MyNamespace.ZipHelper.UnzipSingleFile(String strInputFile,
String strOutputFile)
at MyMaintenanceService.OnStart(String[] args)

=== Pre-bind state information ===
LOG: DisplayName = ICSharpCode.SharpZipLib, Version=0.5.0.0,
Culture=neutral, PublicKeyToken=1b03e6acf1164f73
(Fully-specified)
LOG: Appbase = c:\inetpub\wwwroot\jobs\
LOG: Initial PrivatePath = NULL
Calling assembly : ziphelper, Version=0.0.0.0, Culture=neutral,
PublicKeyToken=null.
===

LOG: Publisher policy file is not found.
LOG: Host configuration file not found.
LOG: Using machine configuration file from
C:\WINNT\Microsoft.NET\Framework\v1.1.4322\config\ machine.config.
LOG: Post-policy reference: ICSharpCode.SharpZipLib, Version=0.5.0.0,
Culture=neutral, PublicKeyToken=1b03e6acf1164f73
LOG: Attempting download of new URL
file:///c:/inetpub/wwwroot/jobs/ICSharpCode.SharpZipLib.DLL.
------------------------------------------FROM FUSLOGVW.EXE:

*** Assembly Binder Log Entry (11/6/2003 @ 5:02:52 PM) ***

The operation failed.
Bind result: hr = 0x80070005. Access is denied.

Assembly manager loaded from:
C:\WINNT\Microsoft.NET\Framework\v1.1.4322\fusion. dll
Running under executable c:\inetpub\wwwroot\jobs\myjob.exe
--- A detailed error log follows.

=== Pre-bind state information ===
LOG: DisplayName = ICSharpCode.SharpZipLib, Version=0.5.0.0,
Culture=neutral, PublicKeyToken=1b03e6acf1164f73
(Fully-specified)
LOG: Appbase = c:\inetpub\wwwroot\jobs\
LOG: Initial PrivatePath = NULL
LOG: Dynamic Base = NULL
LOG: Cache Base = NULL
LOG: AppName = NULL
Calling assembly : ziphelper, Version=0.0.0.0, Culture=neutral,
PublicKeyToken=null.
===

LOG: Processing DEVPATH.
LOG: DEVPATH is not set. Falling through to regular bind.
LOG: Publisher policy file is not found.
LOG: Host configuration file not found.
LOG: Using machine configuration file from
C:\WINNT\Microsoft.NET\Framework\v1.1.4322\config\ machine.config.
LOG: Post-policy reference: ICSharpCode.SharpZipLib, Version=0.5.0.0,
Culture=neutral, PublicKeyToken=1b03e6acf1164f73
LOG: Cache Lookup was unsuccessful.
LOG: Attempting download of new URL
file:///c:/inetpub/wwwroot/jobs/ICSharpCode.SharpZipLib.DLL.
LOG: Assembly download was successful. Attempting setup of file:
c:\inetpub\wwwroot\jobs\ICSharpCode.SharpZipLib.DL L
ERR: Unable to extract last modified time from
c:\inetpub\wwwroot\jobs\ICSharpCode.SharpZipLib.DL L.
ERR: Failed to complete setup of assembly (hr = 0x80070005). Probing
terminated.

[Peter Huang]

Hi Shailesh,

Did you use the Ngen tool with ICSharpCode.SharpZipLib.DLL to create a
native image?
Native Image Generator (Ngen.exe)
http://msdn.microsoft.com/library/de...us/cptools/htm
l/cpgrfnativeimagegeneratorngenexe.asp

If so I think you may use the assembly name as the argument of Ngen.
I think you may try to workaround the problem by using any of the three
workaround.
1. You could use the full assembly name.
2. You could change into the directory where the assembly lives and then
pass in the partial assembly name.
3. You could just use filenames instead of assembly names. For instance,
you could provide the full or partial path to ngen, or just change to the
directory where ICSharpCode.SharpZipLib.DLL lives before you compile it.

For detailed information you may try to refer the link above.
Did I misunderstand you meaning?
If you have any concern on this issue,please post here.
Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
--------------------

Date: Fri, 07 Nov 2003 02:50:05 -0500
From: Shailesh Humbad <hu******@hotmail.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031007X-Accept-Language: en-us, en
MIME-Version: 1.0
Subject: service access denied to DLLs
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Message-ID: <er**************@TK2MSFTNGP10.phx.gbl>
Newsgroups: microsoft.public.dotnet.languages.vb
NNTP-Posting-Host: cpe-024-210-100-160.twmi.rr.com 24.210.100.160
Lines: 1
Path: cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTN GP10.phx.gbl
Xref: cpmsftngxa06.phx.gbl microsoft.public.dotnet.languages.vb:154563
X-Tomcat-NG: microsoft.public.dotnet.languages.vb

I figured out what was causing the "Access is Denied" error when
calling functions from referenced DLLs in my service. I've tried to
be very detailed, so bear with me.

It turns out that libraries I made myself were not having this
problem, but it only happened with a zip library I downloaded and
copied into my program's directory. When using classes from this
library, my service threw an "Access Is Denied" FileLoadException,
which I've quoted below.

(Note that I was only able to trap the exception to a log file because
the zip library is accessed from one of my own libraries, otherwise,
the service would fail on startup with an SCM error dialog saying "the
service did not return any error code".)

The access is denied error occurred when I set up the service to run
as the Local System account, even though this account had full NT
permissions to the DLL. When I ran the service as Administrator, the
problem went away. But running the service as Administrator is not a
feasible option for deployment.

I then ran the Assembly Binding Log Viewer (fuslogvw.exe) and turned
on logging. After running the service, the load failure was logged as
an ASP.Net exception with the result of "Access is Denied". The log
messages said "Unable to extract last modified time from
c:\inetpub\wwwroot\jobs\ICSharpCode.SharpZipLib.D LL." (See the second
message below.) So I opened the DLL in Textpad as UTF-8, changed a
byte, changed it back, and then saved the file. After this, the
service could access the DLL without any problems running as Local System.

I can understand why .Net would want to check the last modified time,
but why did it fail to extract it? Before I modified it, the DLL did
have a valid last modified time stamp (as verified by checking the
file properties). Why did .Net fail to extract the time stamp when
running as LocalSystem, but not when running as Administrator?
Finally, why is the load failure categorized as an "ASP.Net" failure
in the Assembly Binding Log and not a "Default" failure? My immediate
issue is solved, but this behaviour may suggest a problem in the way
.Net assembly binder reads the last modified time stamp in Windows 2000.

Regards,
Shailesh

------------------------------------------FROM SERVICE LOG FILE:

Starting My Maintenance Service at 11/6/2003 5:02:52 PM with private
key file ''.
Error unzipping.
System.IO.FileLoadException: Access is denied: 'ICSharpCode.SharpZipLib'.
File name: "ICSharpCode.SharpZipLib"
at MyNamespace.ZipHelper.UnzipSingleFile(String strInputFile,
String strOutputFile)
at MyMaintenanceService.OnStart(String[] args)

=== Pre-bind state information ===
LOG: DisplayName = ICSharpCode.SharpZipLib, Version=0.5.0.0,
Culture=neutral, PublicKeyToken=1b03e6acf1164f73
(Fully-specified)
LOG: Appbase = c:\inetpub\wwwroot\jobs\
LOG: Initial PrivatePath = NULL
Calling assembly : ziphelper, Version=0.0.0.0, Culture=neutral,
PublicKeyToken=null.
===

LOG: Publisher policy file is not found.
LOG: Host configuration file not found.
LOG: Using machine configuration file from
C:\WINNT\Microsoft.NET\Framework\v1.1.4322\config \machine.config.
LOG: Post-policy reference: ICSharpCode.SharpZipLib, Version=0.5.0.0,
Culture=neutral, PublicKeyToken=1b03e6acf1164f73
LOG: Attempting download of new URL
file:///c:/inetpub/wwwroot/jobs/ICSharpCode.SharpZipLib.DLL.
------------------------------------------FROM FUSLOGVW.EXE:

*** Assembly Binder Log Entry (11/6/2003 @ 5:02:52 PM) ***

The operation failed.
Bind result: hr = 0x80070005. Access is denied.

Assembly manager loaded from:
C:\WINNT\Microsoft.NET\Framework\v1.1.4322\fusion .dll
Running under executable c:\inetpub\wwwroot\jobs\myjob.exe
--- A detailed error log follows.

=== Pre-bind state information ===
LOG: DisplayName = ICSharpCode.SharpZipLib, Version=0.5.0.0,
Culture=neutral, PublicKeyToken=1b03e6acf1164f73
(Fully-specified)
LOG: Appbase = c:\inetpub\wwwroot\jobs\
LOG: Initial PrivatePath = NULL
LOG: Dynamic Base = NULL
LOG: Cache Base = NULL
LOG: AppName = NULL
Calling assembly : ziphelper, Version=0.0.0.0, Culture=neutral,
PublicKeyToken=null.
===

LOG: Processing DEVPATH.
LOG: DEVPATH is not set. Falling through to regular bind.
LOG: Publisher policy file is not found.
LOG: Host configuration file not found.
LOG: Using machine configuration file from
C:\WINNT\Microsoft.NET\Framework\v1.1.4322\config \machine.config.
LOG: Post-policy reference: ICSharpCode.SharpZipLib, Version=0.5.0.0,
Culture=neutral, PublicKeyToken=1b03e6acf1164f73
LOG: Cache Lookup was unsuccessful.
LOG: Attempting download of new URL
file:///c:/inetpub/wwwroot/jobs/ICSharpCode.SharpZipLib.DLL.
LOG: Assembly download was successful. Attempting setup of file:
c:\inetpub\wwwroot\jobs\ICSharpCode.SharpZipLib.D LL
ERR: Unable to extract last modified time from
c:\inetpub\wwwroot\jobs\ICSharpCode.SharpZipLib.D LL.
ERR: Failed to complete setup of assembly (hr = 0x80070005). Probing
terminated.

[Hans]

Shailesh Humbad <hu******@hotmail.com> wrote in message news:<er**************@TK2MSFTNGP10.phx.gbl>...

I figured out what was causing the "Access is Denied" error when ...

Hello Shailesh,

we're experiencing the same issue with some of our ASP.NET
applications as well as with a remoting app : the ACLs are ok, yet
access is denied. Modifying a byte in the dll solves the issue
temporarily. BTW, the problem occurs on our own DLLs.
We suspect our McAfee NetShield to cause the problem since everything
had been running fine for over a year until the last update to
NetShield last Friday. We've also had similar issues before where
outbound files were scanned. Disabling outbound scans solved that
problem.

Do you have antivirus on your server too? I'll see whether our
SysAdmin agrees in running a FileMon trace on one app, maybe I'll know
more then.
Do you still experience the problem?

Best Regards

Hans

[HVE]

On 28 Nov 2003 03:46:23 -0800, Hans wrote:

Shailesh Humbad <hu******@hotmail.com> wrote in message news:<er**************@TK2MSFTNGP10.phx.gbl>...

I figured out what was causing the "Access is Denied" error when ...

Hello Shailesh,

we're experiencing the same issue with some of our ASP.NET
applications as well as with a remoting app : the ACLs are ok, yet
access is denied. Modifying a byte in the dll solves the issue
temporarily. BTW, the problem occurs on our own DLLs.
We suspect our McAfee NetShield to cause the problem since everything
had been running fine for over a year until the last update to
NetShield last Friday. We've also had similar issues before where
outbound files were scanned. Disabling outbound scans solved that
problem.

Do you have antivirus on your server too? I'll see whether our
SysAdmin agrees in running a FileMon trace on one app, maybe I'll know
more then.
Do you still experience the problem?

Best Regards

Hans

Hi Shailesh,

I've found a way to reproduce the problem :

Starting from a working system, I set the Archive flag off for the DLL for
which access was denied before.
I try to re-run the application : Access Denied.
I reset the Archive flag and re-run the application : Access Denied
I modify the dll phyiscally and re-run the application : working again.

This might indicate that either the antivirus or the backup program (which
resets the Archive flag after a backup) cause the problem.

Best Regards

Hans