Take the 2-minute tour ×

I have a situation in which my (C#) application can load external DLLs (not written by me) and execute code from those libraries. The libraries can be C# or CPP.

I need to make sure this external code won't access any files in my local file system (read and write) except from a specific folder.

How can i do that?

share|improve this question
You cannot otherwise sandbox native C++ code that uses the winapi directly, other than running the process with a user account that restricts file system access. –  Hans Passant Dec 21 '11 at 14:06
You say c# or CPP..are they always managed libs? –  Myles McDonnell Dec 21 '11 at 14:06
Isnt possible to do wrap the call to unmanaged code in an impersonated call (logon user APIs) with restricted access, so that doesnt have to run the whole application with restricted privs but just restrict the external calls? –  Paralife Dec 21 '11 at 14:14
@Hans this is not so. There are tools for sandboxing generic code. –  Eugene Mayevski 'EldoS Corp Dec 21 '11 at 16:10
add comment

6 Answers

If you allow user-supplied, unmanaged code to run, you have virtually zero chance of controlling what it does, unless you run it in a sandboxed/virtualized environment (which is non-trivial to a high degree). If you drop support for C++ libraries, you can use .NET techniques like this, as Hans Passant suggested.

What others say is correct, you can use OS facities to restrict filesystem access, but this would mean you have to set up a dedicated user account and create a new process to execute the code in the DLL, which might or might not be an option (and it is non-trivial as well). I am sure that you will face new problems with this approach, like how to create an EXE that executes the library code you are interacting with and how to implement inter-process communication with your original application. Plus, this would be very, very, very insecure, because the restricted code can still interact with other services running on your machine or on the local network!

share|improve this answer
Is creating a new process necessary? I dont know so well but I think you can use impersonation. –  Paralife Dec 21 '11 at 14:16
Paralife: Hm, I figured that if you impersonated a non-privileged user account before calling the library function, then you would need to return to your privileged security context afterwards. I imagine the called code (living in the same address space) could somehow get the handle to the original context and impersonate it, thus circumventing the restrictions. When creating a new process, this cannot possibly happen because of address space separation, so I suggested it. I might be wrong, though. –  Niklas B. Dec 21 '11 at 14:20
This is not exactly so. Intercepting / blocking all or major API bindings would isolate any application, and this is what different application firewalls and wrappers do, from Comodo Internet Security to Molebox. –  Eugene Mayevski 'EldoS Corp Dec 22 '11 at 5:59
That's what I meant by sandboxing. It's still not as secure as virtualization (can't possibly be). Plus, it's also not trivial to set up, especially because OP wants to call library code, so he still has to write some wrapper binary which at least needs access to IPC mechanisms, so it cannot be denied access to every API function/syscall. –  Niklas B. Dec 22 '11 at 8:49
@Niklas as the OP needs to block just file access (and that's a limited set of APIs), the task becomes easier. On a side note: when you answer the comment, add AT sign followed by the user name - this will notify the recipient about your response. Unfortunately SO strips this mark from comments being shown, so new posters don't know that this feature exists. –  Eugene Mayevski 'EldoS Corp Dec 23 '11 at 7:37
show 3 more comments

Run the application as a restricted user account and only grant the user access to that specific folder.

share|improve this answer
This is a good solution but now i have another problem - i must be able to connect to a pipe created by a java process from the Administrator user. I receive an access denied error. –  Erik Sapir Dec 22 '11 at 9:01
have the administrator user process create the pipe with priviledges that allow the restricted user to access it –  Paralife Dec 22 '11 at 9:49
add comment

Secure the files through the OS facilities (filesystem privs), create an account that can access only those files and use this account to run the application

share|improve this answer
add comment

It depends on your framework, but you can use Caspol (Code Access Security Policy) up to .Net 3.5 (and I think C++ DLLs also) to specify security privileges including IO access.

Hope that helps :)

share|improve this answer
add comment

I've seen third-party code that does this; for example, Jint lets you write JavaScript scripts that manipulate CLR objects, but it prevents any JavaScript-originated code paths from accessing the filesystem, Reflection, etc. by using permissions.

You can read Jint's documentation and poke through their source code for more details, but the essence of it seems to be this:

PermissionSet myPermissionSet = new PermissionSet(PermissionState.None);
// or some other permission set, depending on your requirements

try {
    // run untrusted code
} finally {

A lot of things I've read say you need to create a sandboxed Appdomain (something I've never had much success with), but Jint's approach seems to work pretty well. You might have to watch out for the third-party code hooking static events that would fire later, though -- then they could escape the PermitOnly scope.

share|improve this answer
add comment

Take a look at Molebox, maybe it will fit your needs. Molebox lets you wrap modules to sandbox them.

share|improve this answer
add comment

Your Answer


