虚拟主机上asp.net运行权限不足问题及解决

   有些时候我们写的asp.net应用程序是运行在虚拟主机上。有一些虚拟主机可能是由于安全的考虑，对asp.net做了权限设置，会导致我们的应用程序无法正常运行。

问题现象：
     由于某种原因，asp.net不能加载某些dll文件，出现如下错误提示： server error in '/' application.
---------------------------------------------

required permissions cannot be acquired.
description: an unhandled exception occurred during the execution of the current web request. please review the stack trace for more information about the error and where it originated in the code.

exception details: system.security.policy.policyexception: required permissions cannot be acquired.

source error:

an unhandled exception was generated during the execution of the current web request. information regarding the origin and location of the exception can be identified using the exception stack trace below. 

stack trace:

[policyexception: required permissions cannot be acquired.]
   system.security.securitymanager.resolvepolicy(evidence evidence, permissionset reqdpset, permissionset optpset, permissionset denypset, permissionset& denied, boolean checkexecutionpermission) +2738293
   system.security.securitymanager.resolvepolicy(evidence evidence, permissionset reqdpset, permissionset optpset, permissionset denypset, permissionset& denied, int32& securityspecialflags, boolean checkexecutionpermission) +57

[fileloadexception: could not load file or assembly 'microsoft.practices.objectbuilder, version=1.0.51205.0, culture=neutral, publickeytoken=null' or one of its dependencies. failed to grant minimum permission requests. (exception from hresult: 0x80131417)]
   system.reflection.assembly.nload(assemblyname filename, string codebase, evidence assemblysecurity, assembly locationhint, stackcrawlmark& stackmark, boolean throwonfilenotfound, boolean forintrospection) +0
   system.reflection.assembly.internalload(assemblyname assemblyref, evidence assemblysecurity, stackcrawlmark& stackmark, boolean forintrospection) +211
   system.reflection.assembly.internalload(string assemblystring, evidence assemblysecurity, stackcrawlmark& stackmark, boolean forintrospection) +141
   system.reflection.assembly.load(string assemblystring) +25
   system.web.configuration.compilationsection.loadassemblyhelper(string assemblyname, boolean stardirective) +32

　　问题分析：

    根据我的观察，asp.net应用程序直接生成的dll可以正常加载，由asp.net直接调用的外部dll也可以正常加载，但是仅被外部dll引用的其他外部dll不能加载。我的猜想是：由于权限是不完全的，asp.net应用本身生成的dll和直接引用的dll可以通过权限的继承获得权限，而仅被外部dll引用的其他外部dll因为权限的限制不能继承权限，因此出现了权限不足的问题。

　　问题解决：

    通过在我电脑的试验，推测虚拟主机上修改了根web.config（在我电脑上其位置为c:/windows/microsoft.net/framework/v2.0.50727/config）的设置.
    默认web.config的权限设置节如下：

<location allowoverride="true">
        <system.web>
            <securitypolicy>
                <trustlevel name="full" policyfile="internal" />
                <trustlevel name="high" policyfile="web_hightrust.config" />
                <trustlevel name="medium" policyfile="web_mediumtrust.config" />
                <trustlevel name="low"  policyfile="web_lowtrust.config" />
                <trustlevel name="minimal" policyfile="web_minimaltrust.config" />
            </securitypolicy>
            <trust level="full" originurl="" />
        </system.web>
</location>

    推测虚拟主机上修改之后的设置：

 <location allowoverride="false">
        <system.web>
            <securitypolicy>
                <trustlevel name="full" policyfile="internal" />
                <trustlevel name="high" policyfile="web_hightrust.config" />
                <trustlevel name="medium" policyfile="web_mediumtrust.config" />
                <trustlevel name="low"  policyfile="web_lowtrust.config" />
                <trustlevel name="minimal" policyfile="web_minimaltrust.config" />
            </securitypolicy>
            <trust level="high" originurl="" />
        </system.web>
</location> 

   他首先设置了allowoverride为false，这就阻止了在用户web.config中重新定义权限的能力。然后，他定义trust level为high，而不是默认的full。经我测试，只要trust level不为full，仅被外部dll引用的其他外部dll就不能被加载。 因此，我建议技术支持将allowoverride节设置为true。这样我就可以在web.config中重新指定权限了。

例：<trust level="full" originurl="" />

    最近已经不研究aps.net了，因此也没有认真去查找深层的原因，或许我的认识还有误。希望那位高手可以道出深层的原因，或指正我的错误。