Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable peverify-compat mode when SecurityTransparent or APTCA assembly attributes are present #22782

Closed
wants to merge 3 commits into from

Conversation

VSadov
Copy link
Member

@VSadov VSadov commented Oct 19, 2017

Same as #22772 + enabling compat mode when SecurityTransparent or APTCA assembly attributes are present

@jcouv jcouv added this to the 15.5 milestone Oct 19, 2017
@VSadov VSadov changed the title Enable peverify-compat mode when SecurityCritical or APTCA assembly attributes are present Enable peverify-compat mode when SecurityTransparent or APTCA assembly attributes are present Oct 20, 2017
@VSadov
Copy link
Member Author

VSadov commented Oct 23, 2017

Closing this.
Due to the interaction of various security related attributes, inferring the demands of a given assembly statically does not seem to be practical.

For example - meaning of of SecurityCritical or APTCA may be altered via

[assembly: SecurityPermission(SecurityAction.RequestMinimum, SkipVerification = true)]     and/or
[assembly: SecurityRules(SecurityRuleSet.Level2, SkipVerificationInFullTrust = true)]

And in a case of a .net module, we cannot even know all the attributes at compile time.

@VSadov VSadov closed this Oct 23, 2017
@svick
Copy link
Contributor

svick commented Oct 24, 2017

@VSadov In that case, would it make sense to be conservative, i.e. enable peverify-compat if one of the attributes is present, even if it might not be actually necessary (because of SkipVerification = true)? Unnecessarily disabling an optimization in fairly rare cases sounds better to me than throwing VerificationException in previously working code.

Or is "If you upgrade to C# 7.2/8.0, your code might start throwing VerificationException" acceptable?

@VSadov
Copy link
Member Author

VSadov commented Oct 24, 2017

@svick - there will be a flag to control the behavior (separate PR).

This one was just to explore if we can have heuristics that are triggered by the attributes. Turns out that is not very reliable. It has potential for both false positives and false negatives.

Also it is likely that the user who cares about verification would want errors/warnings when he uses features/patterns that are impossible to emit in verifiable way, but it would be bad to key breaking diagnostics on an unreliable heuristics.
Once we agree that the compiler switch is needed anyways - to be sure to have predictable behavior, it becomes questionable whether attribute based heuristics is useful.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants