/*!*/
        private static PermissionSet CreatePermissionSet()
        {
            #if CLR2
            string name = "Internet";
            bool foundName = false;
            PermissionSet setIntersection = new PermissionSet(PermissionState.Unrestricted);

            // iterate over each policy level
            IEnumerator e = SecurityManager.PolicyHierarchy();
            while (e.MoveNext()) {
                PolicyLevel level = (PolicyLevel)e.Current;
                PermissionSet levelSet = level.GetNamedPermissionSet(name);
                if (levelSet != null) {
                    foundName = true;
                    setIntersection = setIntersection.Intersect(levelSet);
                }
            }

            if (setIntersection == null || !foundName) {
                setIntersection = new PermissionSet(PermissionState.None);
            } else {
                setIntersection = new NamedPermissionSet(name, setIntersection);
            }

            return setIntersection;
            #else
            // this functionality is not available on Mono (AddHostEvidence is undefined), use dynamic to resolve it at runtime
            dynamic e = new Evidence();
            e.AddHostEvidence(new Zone(SecurityZone.Internet));
            return SecurityManager.GetStandardSandbox((Evidence)e);
            #endif
        }

		static AppDomain NewDomain () {
			PolicyStatement statement = new PolicyStatement(new PermissionSet(PermissionState.None),PolicyStatementAttribute.Nothing);
			PermissionSet ps = new PermissionSet(PermissionState.None);
			ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.Execution));
			ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.Assertion));
			ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.ControlAppDomain));
			ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.ControlDomainPolicy));
			ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.ControlEvidence));
			ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.ControlPolicy));
			ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.ControlPrincipal));
			ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.ControlThread));
			ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.Infrastructure));
			ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.RemotingConfiguration));
			ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.SerializationFormatter));
			ps.AddPermission(new FileIOPermission(PermissionState.Unrestricted));
			ps.AddPermission(new EnvironmentPermission(PermissionState.Unrestricted));
			ps.AddPermission(new ReflectionPermission(PermissionState.Unrestricted));
			ps.AddPermission(new RegistryPermission(PermissionState.Unrestricted));
			ps.AddPermission(new IsolatedStorageFilePermission(PermissionState.Unrestricted));
			ps.AddPermission(new EventLogPermission(PermissionState.Unrestricted));
			ps.AddPermission(new PerformanceCounterPermission(PermissionState.Unrestricted));
			ps.AddPermission(new DnsPermission(PermissionState.Unrestricted));
			ps.AddPermission(new UIPermission(PermissionState.Unrestricted));
   			PolicyStatement statement1 = new PolicyStatement(ps,PolicyStatementAttribute.Exclusive);
			CodeGroup group;
			group = new UnionCodeGroup(new AllMembershipCondition(),statement);
			group.AddChild(new UnionCodeGroup(new ZoneMembershipCondition(SecurityZone.MyComputer),statement1));
			PolicyLevel level = PolicyLevel.CreateAppDomainLevel();
			level.RootCodeGroup = group;

			AppDomain domain = AppDomain.CreateDomain ("test");
			domain.SetAppDomainPolicy(level);
			return domain;
		}

        /// <summary>
        /// Creates an AppDomain.
        /// </summary>
        /// <param name="applicationName">The application name for the new AppDomain, or null if none.</param>
        /// <param name="applicationBaseDirectory">The application base directory for the new AppDomain, or null to use the current one.</param>
        /// <param name="configurationFile">The configuration file for the new AppDomain, or null to use the current one.</param>
        /// <param name="enableShadowCopy">If true, enables shadow copying within the AppDomain.</param>
        /// <returns>The new AppDomain.</returns>
        public static AppDomain CreateAppDomain(string applicationName, string applicationBaseDirectory, string configurationFile, bool enableShadowCopy)
        {
            AppDomainSetup appDomainSetup = new AppDomainSetup();

            appDomainSetup.ApplicationName = applicationName ?? string.Empty;
            appDomainSetup.ApplicationBase = applicationBaseDirectory ?? AppDomain.CurrentDomain.BaseDirectory;

            if (configurationFile != null)
            {
                // NOTE: We can also use AppDomainSetup.SetConfigurationBytes but it only applies to
                //       CLR-internal configuration settings such as the assembly binding policy.
                //       In order for other configuration mechanisms to operate correctly, we must
                //       use a real configuration file on disk instead.
                appDomainSetup.ConfigurationFile = configurationFile;
            }

            if (enableShadowCopy)
            {
                appDomainSetup.ShadowCopyFiles = @"true";
                appDomainSetup.ShadowCopyDirectories = null;
            }

            // TODO: Might need to be more careful about how the Evidence is derived.
            Evidence evidence = AppDomain.CurrentDomain.Evidence;
            if (DotNetRuntimeSupport.IsUsingMono)
            {
                return AppDomain.CreateDomain(appDomainSetup.ApplicationName, evidence, appDomainSetup);
            }
            else
            {
                PermissionSet defaultPermissionSet = new PermissionSet(PermissionState.Unrestricted);
                StrongName[] fullTrustAssemblies = new StrongName[0];
                return AppDomain.CreateDomain(appDomainSetup.ApplicationName, evidence, appDomainSetup, defaultPermissionSet, fullTrustAssemblies);
            }
        }

        public void GeneratedTypeForAdditionalInterfaceWithMethodsHavingSignaturesMatchingMethodsInTheBaseClassIsVerifiable()
        {
            PermissionSet grantSet = new PermissionSet(PermissionState.None);
            grantSet.AddPermission(
                new SecurityPermission(
                    SecurityPermissionFlag.Execution
                    | SecurityPermissionFlag.ControlEvidence
                    | SecurityPermissionFlag.ControlPolicy));
            grantSet.AddPermission(
                new ReflectionPermission(ReflectionPermissionFlag.RestrictedMemberAccess
                    | ReflectionPermissionFlag.MemberAccess));
            grantSet.AddPermission(new FileIOPermission(PermissionState.Unrestricted));

            AppDomain sandbox =
                AppDomain.CreateDomain(
                    "sandbox",
                    AppDomain.CurrentDomain.Evidence,
                    new AppDomainSetup { ApplicationBase = AppDomain.CurrentDomain.BaseDirectory },
                    grantSet);

            sandbox.DoCallBack(() =>
            {
                InterceptingClassGenerator generator =
                    new InterceptingClassGenerator(typeof(MainType), typeof(IDoSomething), typeof(IDoSomethingToo));
                Type generatedType = generator.GenerateType();
            });
        }

        static XmlILModule() {
            AssemblyName asmName;
            AssemblyBuilder asmBldr;

            CreateModulePermissionSet = new PermissionSet(PermissionState.None);
            // CreateDelegate demands MemberAccess permission
            CreateModulePermissionSet.AddPermission(new ReflectionPermission(ReflectionPermissionFlag.MemberAccess));
            // DynamicMethod constructor demands ControlEvidence permissions. 
            // Emitting symbols in DefineDynamicModule (to allow to debug the stylesheet) requires UnmanagedCode permission. 
            CreateModulePermissionSet.AddPermission(new SecurityPermission(SecurityPermissionFlag.ControlEvidence | SecurityPermissionFlag.UnmanagedCode));

            AssemblyId = 0;

            // 1. LRE assembly only needs to execute
            // 2. No temp files need be created
            // 3. Never allow assembly to Assert permissions
            asmName = CreateAssemblyName();
            asmBldr = AppDomain.CurrentDomain.DefineDynamicAssembly(asmName, AssemblyBuilderAccess.Run);

            try {
                CreateModulePermissionSet.Assert();

                // Add custom attribute to assembly marking it as security transparent so that Assert will not be allowed
                // and link demands will be converted to full demands.
                asmBldr.SetCustomAttribute(new CustomAttributeBuilder(XmlILConstructors.Transparent, new object[] {}));

                // Store LREModule once.  If multiple threads are doing this, then some threads might get different
                // modules.  This is OK, since it's not mandatory to share, just preferable.
                LREModule = asmBldr.DefineDynamicModule("System.Xml.Xsl.CompiledQuery", false);
            }
            finally {
                CodeAccessPermission.RevertAssert();
            }
        }

        public JintEngine(Options options) {
            Visitor = new ExecutionVisitor(options);
            permissionSet = new PermissionSet(PermissionState.None);
            Visitor.AllowClr = allowClr;
            MaxRecursions = 400;
	        MaxSteps = 100 * 1000;

            var global = Visitor.Global as JsObject;

            global["ToBoolean"] = Visitor.Global.FunctionClass.New(new Func<object, Boolean>(Convert.ToBoolean));
            global["ToByte"] = Visitor.Global.FunctionClass.New(new Func<object, Byte>(Convert.ToByte));
            global["ToChar"] = Visitor.Global.FunctionClass.New(new Func<object, Char>(Convert.ToChar));
            global["ToDateTime"] = Visitor.Global.FunctionClass.New(new Func<object, DateTime>(Convert.ToDateTime));
            global["ToDecimal"] = Visitor.Global.FunctionClass.New(new Func<object, Decimal>(Convert.ToDecimal));
            global["ToDouble"] = Visitor.Global.FunctionClass.New(new Func<object, Double>(Convert.ToDouble));
            global["ToInt16"] = Visitor.Global.FunctionClass.New(new Func<object, Int16>(Convert.ToInt16));
            global["ToInt32"] = Visitor.Global.FunctionClass.New(new Func<object, Int32>(Convert.ToInt32));
            global["ToInt64"] = Visitor.Global.FunctionClass.New(new Func<object, Int64>(Convert.ToInt64));
            global["ToSByte"] = Visitor.Global.FunctionClass.New(new Func<object, SByte>(Convert.ToSByte));
            global["ToSingle"] = Visitor.Global.FunctionClass.New(new Func<object, Single>(Convert.ToSingle));
            global["ToString"] = Visitor.Global.FunctionClass.New(new Func<object, String>(Convert.ToString));
            global["ToUInt16"] = Visitor.Global.FunctionClass.New(new Func<object, UInt16>(Convert.ToUInt16));
            global["ToUInt32"] = Visitor.Global.FunctionClass.New(new Func<object, UInt32>(Convert.ToUInt32));
            global["ToUInt64"] = Visitor.Global.FunctionClass.New(new Func<object, UInt64>(Convert.ToUInt64));

            BreakPoints = new List<BreakPoint>();
        }

        public JintEngine()
        {
            PermissionSet = new PermissionSet(PermissionState.None);
            TypeSystem = new TypeSystem();

            _runtime = new JintRuntime(this);
        }

      public void Open()
      {
         if(State != CommunicationState.Created)
         {
            return;
         }
         try
         {
            Opening(this,EventArgs.Empty);

            //Permission required to read the providers application name and access config
            PermissionSet permissions = new PermissionSet(PermissionState.None);
            permissions.AddPermission(new AspNetHostingPermission(AspNetHostingPermissionLevel.Minimal));
            permissions.AddPermission(new FileIOPermission(PermissionState.Unrestricted));

            permissions.Assert();

            m_ServiceHostActivator.MembershipApplicationName = Membership.ApplicationName;
            if(Roles.Enabled)
            {
               m_ServiceHostActivator.RolesApplicationName = Roles.ApplicationName;
            }
            PermissionSet.RevertAssert();

            m_ServiceHostActivator.Open();

            State = CommunicationState.Opened;

            Opened(this,EventArgs.Empty);
         }
         catch
         {
            State = CommunicationState.Faulted;
         }
      }

 private PermissionSet ParsePermissionSet(Parser parser)
 {
     SecurityElement topElement = parser.GetTopElement();
     PermissionSet set = new PermissionSet(PermissionState.None);
     set.FromXml(topElement);
     return set;
 }

        public static Task<GetManifestCompletedEventArgs> DownloadManifestAsync(this InPlaceHostingManager manager) {
            var tcs = new TaskCompletionSource<GetManifestCompletedEventArgs>();

            manager.GetManifestCompleted += (sender, e) => {
                if(e.Error != null) {
                    tcs.SetException(e.Error);
                    return;
                }

                var trust = new ApplicationTrust();
                var permissions = new PermissionSet(PermissionState.Unrestricted);
                var statement = new PolicyStatement(permissions);

                trust.DefaultGrantSet = statement;
                trust.ApplicationIdentity = e.ApplicationIdentity;
                trust.IsApplicationTrustedToRun = true;

                ApplicationSecurityManager.UserApplicationTrusts.Add(trust);

                tcs.SetResult(e);
            };

            manager.GetManifestAsync();

            return tcs.Task;
        }

        //Create a SandBox to load Assemblies with "Full Trust"
        public static ServiceBridge Sandbox(string assemblyFilename, string configPath, ResolveEventHandler handler)
        {
            var trustedLoadGrantSet = new PermissionSet(PermissionState.Unrestricted);
            var trustedLoadSetup = new AppDomainSetup();
            trustedLoadSetup.ApplicationBase = Path.GetDirectoryName(assemblyFilename);
            trustedLoadSetup.PrivateBinPath = Path.GetDirectoryName(assemblyFilename);
            //trustedLoadSetup.ConfigurationFile = AppDomain.CurrentDomain.SetupInformation.ConfigurationFile;
            trustedLoadSetup.ConfigurationFile = configPath;

            AppDomain.CurrentDomain.AssemblyResolve += handler;
            AppDomain appDomain = AppDomain.CreateDomain("ServiceBridge SandBox", null, trustedLoadSetup, trustedLoadGrantSet);
            appDomain.SetData("DataDirectory", configPath.Replace("Web.config", "App_Data"));

            ServiceBridge loader = appDomain.CreateInstanceAndUnwrap(
                typeof(ServiceBridge).Assembly.GetName().FullName,
                typeof(ServiceBridge).FullName,
                false,
                BindingFlags.Default,
                null,
                new object[] { assemblyFilename },
                CultureInfo.InvariantCulture,
                null) as ServiceBridge;

            return loader;
        }

        private static PermissionSet CreateSkipVerificationSet() {
            PermissionSet permSet = new PermissionSet(PermissionState.None);
#pragma warning disable 618
            permSet.AddPermission(new SecurityPermission(SecurityPermissionFlag.SkipVerification));
#pragma warning restore 618
            return permSet;
        }

 public PermissionRequestEvidence(PermissionSet request, PermissionSet optional, PermissionSet denied)
 {
     if (request == null)
     {
         this.m_request = null;
     }
     else
     {
         this.m_request = request.Copy();
     }
     if (optional == null)
     {
         this.m_optional = null;
     }
     else
     {
         this.m_optional = optional.Copy();
     }
     if (denied == null)
     {
         this.m_denied = null;
     }
     else
     {
         this.m_denied = denied.Copy();
     }
 }

 private static PermissionSet Create_permission_set_for_sandbox_AppDomain(string beitragspfad)
 {
     PermissionSet permissionSet = new PermissionSet(PermissionState.None);
     permissionSet.AddPermission(new SecurityPermission(SecurityPermissionFlag.Execution));
     permissionSet.AddPermission(new FileIOPermission(FileIOPermissionAccess.AllAccess, beitragspfad));
     return permissionSet;
 }

 public PermissionSet(PermissionSet permSet) : this()
 {
     if (permSet == null)
     {
         this.Reset();
     }
     else
     {
         this.m_Unrestricted = permSet.m_Unrestricted;
         this.m_CheckedForNonCas = permSet.m_CheckedForNonCas;
         this.m_ContainsCas = permSet.m_ContainsCas;
         this.m_ContainsNonCas = permSet.m_ContainsNonCas;
         this.m_ignoreTypeLoadFailures = permSet.m_ignoreTypeLoadFailures;
         if (permSet.m_permSet != null)
         {
             this.m_permSet = new TokenBasedSet(permSet.m_permSet);
             for (int i = this.m_permSet.GetStartingIndex(); i <= this.m_permSet.GetMaxUsedIndex(); i++)
             {
                 object item = this.m_permSet.GetItem(i);
                 IPermission permission = item as IPermission;
                 ISecurityElementFactory factory = item as ISecurityElementFactory;
                 if (permission != null)
                 {
                     this.m_permSet.SetItem(i, permission.Copy());
                 }
                 else if (factory != null)
                 {
                     this.m_permSet.SetItem(i, factory.Copy());
                 }
             }
         }
     }
 }

 public void Clear()
 {
     this._inputPermissionSet = null;
     this._inputTrustInfoDocument = null;
     this._isFullTrust = true;
     this._outputPermissionSet = null;
 }

		public void CanReflectOnSecurityExceptionWithoutPermission()
		{
			SecurityPermission denyPermission
				= new SecurityPermission(SecurityPermissionFlag.ControlPolicy | SecurityPermissionFlag.ControlEvidence);
			PermissionSet permissions = new PermissionSet(PermissionState.None);
			permissions.AddPermission(denyPermission);
			permissions.Deny();

			SecurityException exception = null;
			try
			{
				DemandException(denyPermission);
			}
			catch (SecurityException e)
			{
				exception = e;
			}
			
			ExceptionFormatter formatter = new ExceptionFormatter();

			String message = formatter.GetMessage(exception);
			Match demandedMatch = DemandedEntryRegex.Match(message);
			Assert.IsNotNull(demandedMatch);
			Assert.AreEqual(Resources.PropertyAccessFailed, demandedMatch.Groups[1].Value);

			CodeAccessPermission.RevertDeny();

			message = formatter.GetMessage(exception);
			demandedMatch = DemandedEntryRegex.Match(message);
			Assert.IsNotNull(demandedMatch);
			Assert.AreNotEqual(Resources.PropertyAccessFailed, demandedMatch.Groups[1].Value);
		}

 // Make an extremely restrictive permission set that allows only:
 // Execution Permission.
 private static PermissionSet MakeExecutionOnlyPermSet()
 {
     var pSet = new PermissionSet(PermissionState.None);
     var perm = new SecurityPermission(SecurityPermissionFlag.Execution);
     pSet.AddPermission(perm);
     return pSet;
 }

        public AppDomain createAppDomain(string appDomainName, AppDomainSetup appDomainSetup)
        {
            try
            {
                if (DI.appDomainsControledByO2Kernel.ContainsKey(appDomainName))
                    DI.log.error("in createAppDomain, appDomainName provided has already been used, appDomainNames must be unique: {0}", appDomainName);
                else
                {


                    DI.log.info("Creating AppDomain {0} with Base Directory {1}", appDomainName,
                                appDomainSetup.ApplicationBase);
                    // ensure target directory exits
                    O2Kernel_Files.checkIfDirectoryExistsAndCreateIfNot(appDomainSetup.ApplicationBase);

                    // give our appDomain full trust :)
                    var permissionSet = new PermissionSet(PermissionState.Unrestricted);

                    DI.appDomainsControledByO2Kernel.Add(appDomainName,this);
                    
                    //Create domain
                    appDomain = AppDomain.CreateDomain(appDomainName, null, appDomainSetup, permissionSet);
            //        appDomain.AssemblyResolve += new ResolveEventHandler(assemblyResolve);
                    BaseDirectory = appDomain.BaseDirectory;
                    return appDomain;
                }
            }
            catch (Exception ex)
            {
                DI.log.ex(ex, "could not load createAppDomain: " + appDomainName);
            }
            return null;
        }

        public static PluginHost CreateSandbox(string applicationBasePath)
        {
            var rand = Path.GetRandomFileName();

            var setup = new AppDomainSetup()
            {
                ApplicationBase = applicationBasePath,
                ApplicationName = rand,
                ConfigurationFile = "", // DO not set to empty string if we want to use the conf file from this domain
                DisallowBindingRedirects = true,
                DisallowCodeDownload = true,
                DisallowPublisherPolicy = true
            };

            var permissions = new PermissionSet(PermissionState.None);
            permissions.AddPermission(new SecurityPermission(SecurityPermissionFlag.Execution));
            permissions.AddPermission(
                new FileIOPermission(FileIOPermissionAccess.Read | FileIOPermissionAccess.PathDiscovery | FileIOPermissionAccess.AllAccess,
                    applicationBasePath));

            // If we want to enable NLog (for example) to read our configuration file
            permissions.AddPermission(new FileIOPermission(FileIOPermissionAccess.PathDiscovery,
                @"C:\Dev\POC\Krang\src\Krang.App\bin\Debug\Krang.App.vshost.exe.Config"));

            var domain = AppDomain.CreateDomain(rand, null, setup, permissions,
                typeof(PluginHost).Assembly.Evidence.GetHostEvidence<StrongName>(),
                typeof(Plugin).Assembly.Evidence.GetHostEvidence<StrongName>());

            return (PluginHost)Activator.CreateInstanceFrom(domain, typeof(PluginHost).Assembly.ManifestModule.FullyQualifiedName, typeof(PluginHost).FullName).Unwrap();
        }