internal static void CheckAssembly(RuntimeAssembly asm, CodeAccessPermission demand)
 {
     PermissionSet set;
     PermissionSet set2;
     asm.GetGrantSet(out set, out set2);
     CheckHelper(set, set2, demand, PermissionToken.GetToken(demand), RuntimeMethodHandleInternal.EmptyHandle, asm, SecurityAction.Demand, true);
 }

		internal bool CheckDemand (CodeAccessPermission target)
		{
			if (target == null)
				return false;
			if (target.GetType () != this.GetType ())
				return false;
			return IsSubsetOf (target);
		}

		internal bool CheckAssert (CodeAccessPermission asserted)
		{
			if (asserted == null)
				return false;
			if (asserted.GetType () != this.GetType ())
				return false;
			return IsSubsetOf (asserted);
		}

 internal bool CheckDemand(CodeAccessPermission demand, PermissionToken permToken, RuntimeMethodHandleInternal rmh)
 {
     if (!CheckAssert(this.AssertSet, demand, permToken))
     {
         return false;
     }
     CodeAccessSecurityEngine.CheckHelper(this.GrantSet, this.RefusedSet, demand, permToken, rmh, null, SecurityAction.Demand, true);
     return true;
 }

 internal bool CheckDemand(CodeAccessPermission demand, PermissionToken permToken, RuntimeMethodHandle rmh)
 {
     this.CompleteConstruction(null);
     if (this.PLS != null)
     {
         this.PLS.CheckDemand(demand, permToken, rmh);
     }
     return false;
 }

 internal bool CheckDemandNoThrow(CodeAccessPermission demand)
 {
     PermissionToken permToken = null;
     if (demand != null)
     {
         permToken = PermissionToken.GetToken(demand);
     }
     return this.m_firstPermSetTriple.CheckDemandNoThrow(demand, permToken);
 }

 internal bool CheckDemand(CodeAccessPermission demand, PermissionToken permToken, RuntimeMethodHandleInternal rmh)
 {
     bool flag = this.CheckDemand2(demand, permToken, rmh, false);
     if (flag)
     {
         flag = this.CheckDemand2(demand, permToken, rmh, true);
     }
     return flag;
 }

 internal bool CheckDeny(CodeAccessPermission denied)
 {
     IPermission permission = this.Intersect(denied);
     if (permission != null)
     {
         return permission.IsSubsetOf(null);
     }
     return true;
 }

 internal static bool IsPermissionGranted(CodeAccessPermission requestedPermission)
 {
     try
     {
         // Try and get this permission
         requestedPermission.Demand();
         return true;
     }
     catch
     {
         return false;
     }
 }

     // Returns true if OK to return from check, or false if
     // permission-specific information must be checked.
     internal static bool CheckUnrestricted(IUnrestrictedPermission grant, CodeAccessPermission demand)
     {
         // We return true here because we're defining a demand of null to
         // automatically pass.
         if (demand == null)
             return true;
 
         if (demand.GetType() != grant.GetType())
             return false;
         if (grant.IsUnrestricted())
             return true;
         if (((IUnrestrictedPermission)demand).IsUnrestricted())
             throw new SecurityException(String.Format(Environment.GetResourceString("Security_Generic"), demand.GetType().FullName), demand.GetType(), demand.ToXml().ToString());
         return false;
     } 

		internal bool CheckDeny (CodeAccessPermission denied)
		{
			if (denied == null)
				return true;
			Type t = denied.GetType ();
			if (t != this.GetType ())
				return true;
			IPermission inter = Intersect (denied);
			if (inter == null)
				return true;
			// sadly that's not enough :( at this stage we must also check
			// if an empty (PermissionState.None) is a subset of the denied
			// (which is like a empty intersection looks like for flag based
			// permissions, e.g. AspNetHostingPermission).
			return denied.IsSubsetOf (PermissionBuilder.Create (t));
		}

 internal bool CheckDemand(CodeAccessPermission demand, PermissionToken permToken, RuntimeMethodHandleInternal rmh)
 {
     bool flag = true;
     if (this.m_permSetTriples != null)
     {
         for (int i = 0; (i < this.m_permSetTriples.Count) && flag; i++)
         {
             flag = ((PermissionSetTriple) this.m_permSetTriples[i]).CheckDemand(demand, permToken, rmh);
         }
     }
     else if (this.m_firstPermSetTriple != null)
     {
         flag = this.m_firstPermSetTriple.CheckDemand(demand, permToken, rmh);
     }
     return false;
 }

 internal static void Assert(CodeAccessPermission cap, ref StackCrawlMark stackMark)
 {
     FrameSecurityDescriptor descriptor = CheckNReturnSO(AssertPermissionToken, AssertPermission, ref stackMark, 1);
     if (descriptor == null)
     {
         Environment.FailFast(Environment.GetResourceString("ExecutionEngine_MissingSecurityDescriptor"));
     }
     else
     {
         if (descriptor.HasImperativeAsserts())
         {
             throw new SecurityException(Environment.GetResourceString("Security_MustRevertOverride"));
         }
         descriptor.SetAssert(cap);
     }
 }

 private static bool CheckAssert(PermissionSet pSet, CodeAccessPermission demand, PermissionToken permToken)
 {
     if (pSet != null)
     {
         pSet.CheckDecoded(demand, permToken);
         CodeAccessPermission asserted = (CodeAccessPermission) pSet.GetPermission(demand);
         try
         {
             if (pSet.IsUnrestricted() || demand.CheckAssert(asserted))
             {
                 return false;
             }
         }
         catch (ArgumentException)
         {
         }
     }
     return true;
 }

        [System.Security.SecurityCritical]  // auto-generated
        internal bool CheckDemandNoThrow(CodeAccessPermission demand) 
        {
            // AppDomain permissions - no asserts. So there should only be one triple to work with 
            Contract.Assert(m_permSetTriples == null && m_firstPermSetTriple != null, "More than one PermissionSetTriple encountered in AD PermissionListSet"); 

 

            PermissionToken permToken = null;
            if (demand != null)
                permToken = PermissionToken.GetToken(demand); 

            return m_firstPermSetTriple.CheckDemandNoThrow(demand, permToken); 
 

        } 

 public void AddPermission(CodeAccessPermission perm, int type)
 {
     //BCLDebug.Assert(type == MatchAssert || type == MatchDeny, "type == MatchAssert || type == MatchDeny");
     
     // can't get token if perm is null
     if (perm == null)
         return;
     
     PermissionToken permToken = PermissionToken.GetToken(perm);
     PermissionList plist = GetListForToken(permToken, true);
     plist.AppendPermission(perm, type);
 }

        internal bool CheckDemandNoThrow(CodeAccessPermission demand, PermissionToken permToken)
        {
            Exception exception;

            CheckDemandInternal( demand, permToken, out exception );

            return (exception == null);
        }

        internal bool CheckDemand(CodeAccessPermission demand, PermissionToken permToken)
        {
            Exception exception;

            bool cont = CheckDemandInternal( demand, permToken, out exception );

            if (exception != null)
            {
                throw exception;
            }

            return cont;
        }

        [System.Security.SecurityCritical]  // auto-generated
#pragma warning disable 618
        internal static bool CheckHelper(PermissionSet grantedSet,
#pragma warning restore 618
                                        PermissionSet refusedSet,
                                        CodeAccessPermission demand, 
                                        PermissionToken permToken,
                                        RuntimeMethodHandleInternal rmh,
                                        Object assemblyOrString,
                                        SecurityAction action,
                                        bool throwException)
        {
            // We should never get here with a null demand
            Contract.Assert(demand != null, "Should not reach here with a null demand");
            
#if _DEBUG && FEATURE_CAS_POLICY
            if (debug)
            {
                DEBUG_OUT("Granted: ");
                DEBUG_OUT(grantedSet.ToXml().ToString());
                DEBUG_OUT("Refused: ");
                DEBUG_OUT(refusedSet != null ? refusedSet.ToXml().ToString() : "<null>");
                DEBUG_OUT("Demanded: ");
                DEBUG_OUT(demand.ToString());
            }
#endif // _DEBUG && FEATURE_CAS_POLICY

            if (permToken == null)
                permToken = PermissionToken.GetToken(demand);

            if (grantedSet != null)
                grantedSet.CheckDecoded(permToken.m_index);
            if (refusedSet != null)
                refusedSet.CheckDecoded(permToken.m_index);

            // If PermissionSet is null, then module does not have Permissions... Fail check.

            bool bThreadSecurity = SecurityManager._SetThreadSecurity(false);

            try
            {
                if (grantedSet == null)
                {
                    if (throwException)
                        ThrowSecurityException(assemblyOrString, grantedSet, refusedSet, rmh, action, demand, demand);
                    else
                        return false;
                }
                
                else if (!grantedSet.IsUnrestricted())
                {
                    // If we aren't unrestricted, there is a refused set, or our permission is not of the unrestricted
                    // variety, we need to do the proper callback.

                    Contract.Assert(demand != null,"demand != null");

                    // Find the permission of matching type in the permission set.

                    CodeAccessPermission grantedPerm = 
                                (CodeAccessPermission)grantedSet.GetPermission(permToken);

                    // Make sure the demand has been granted
                    if (!demand.CheckDemand( grantedPerm ))
                    {
                        if (throwException)
                            ThrowSecurityException(assemblyOrString, grantedSet, refusedSet, rmh, action, demand, demand);
                        else
                            return false;
                    }
                }

                // Make the sure the permission is not refused.

                if (refusedSet != null)
                {
                    CodeAccessPermission refusedPerm = 
                        (CodeAccessPermission)refusedSet.GetPermission(permToken);
                    if (refusedPerm != null)
                    {
                        if (!refusedPerm.CheckDeny(demand))
                        {
        #if _DEBUG
                            if (debug)
                                DEBUG_OUT( "Permission found in refused set" );
        #endif
                                if (throwException)
                                    ThrowSecurityException(assemblyOrString, grantedSet, refusedSet, rmh, action, demand, demand);
                                else
                                    return false;

                        }
                    }

                    if (refusedSet.IsUnrestricted())
                    {
                        if (throwException)
                            ThrowSecurityException(assemblyOrString, grantedSet, refusedSet, rmh, action, demand, demand);
                        else
                            return false;
                    }
//.........这里部分代码省略.........

        [System.Security.SecurityCritical]  // auto-generated
        internal static void PermitOnly(CodeAccessPermission cap, ref StackCrawlMark stackMark)
        {
            FrameSecurityDescriptor secObj =
                SecurityRuntime.GetSecurityObjectForFrame(ref stackMark, true);
            if (secObj == null)
            {
                // Security: REQ_SQ flag is missing. Bad compiler ?
                // This can happen when you create delegates over functions that need the REQ_SQ 
                System.Environment.FailFast(Environment.GetResourceString("ExecutionEngine_MissingSecurityDescriptor"));
            }
            else
            {
                if (secObj.HasImperativeRestrictions())
                    throw new SecurityException( Environment.GetResourceString( "Security_MustRevertOverride" ) );

                secObj.SetPermitOnly(cap);
            }
        }