Class ProcessIsolationPlatformSecurity

Namespace

Utils.Reflection.ProcessIsolation

Assembly

Utils.Reflection.dll

Exposes standardized security helpers used by process-container consumers.

public static class ProcessIsolationPlatformSecurity

Inheritance

object

ProcessIsolationPlatformSecurity

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

HasValidAuthenticodeSignature(string)

Returns whether a file carries a valid Authenticode signature.

public static bool HasValidAuthenticodeSignature(string filePath)

Parameters

filePath string

Path to the file to verify.

Returns

bool

true when valid and trusted; otherwise false.

Remarks

This method performs a live online revocation check (equivalent to Online). Use VerifyAuthenticodeSignature(string, AuthenticodeRevocationPolicy) when you need to distinguish between signature validity, chain trust, and revocation status.

Authenticode is a Windows-specific signing scheme with no equivalent on other platforms. Unlike IsExpectedNamedPipeClient(NamedPipeServerStream, int), this method does not silently report success on non-Windows platforms — a caller using this as a trust gate ("should I run this binary?") must not receive a false sense of having verified anything. Callers that need a cross-platform trust decision should branch on IsWindows() themselves and decide what "trusted" means for other platforms.

Exceptions

PlatformNotSupportedException

Thrown when called on a non-Windows platform.

IsExpectedNamedPipeClient(NamedPipeServerStream, int)

Verifies that the process connected to a named pipe is the expected process.

public static bool IsExpectedNamedPipeClient(NamedPipeServerStream pipe, int expectedProcessId)

Parameters

pipe NamedPipeServerStream

Server-side named pipe stream.

expectedProcessId int

Expected client process identifier.

Returns

bool

true when the connected process matches (Windows), or unconditionally on other platforms; otherwise false.

Remarks

Windows-only verification. There is no built-in .NET API to resolve the peer process of a Unix domain socket (the underlying transport for NamedPipeServerStream on Linux/macOS) — doing so would require P/Invoking getsockopt(SO_PEERCRED) (Linux) or getpeereid (macOS/BSD), which this library does not currently implement. On non-Windows platforms this method therefore always returns true without checking anything: callers on those platforms get no IPC identity hardening from this method and must not treat a true result there as a verified identity.

VerifyAuthenticodeSignature(string, AuthenticodeRevocationPolicy)

Verifies an Authenticode signature and returns a structured result separating signature presence, chain trust, and revocation status.

public static AuthenticodeVerificationResult VerifyAuthenticodeSignature(string filePath, AuthenticodeRevocationPolicy revocationPolicy = AuthenticodeRevocationPolicy.Online)

Parameters

filePath string

Path to the file to verify.

revocationPolicy AuthenticodeRevocationPolicy

How to check certificate revocation. Defaults to Online (live CRL/OCSP query); use CacheOnly when network access is undesirable and None only when speed is critical and revocation is acceptable to skip.

Returns

AuthenticodeVerificationResult

A structured result describing signature, chain, and revocation status.

Remarks

Authenticode is a Windows-specific signing scheme with no equivalent on other platforms. Callers that need a cross-platform trust decision should branch on IsWindows() themselves and decide what "trusted" means on other platforms — this method never silently reports success on non-Windows, unlike APIs that return true unconditionally when the platform cannot perform the check.

Exceptions

PlatformNotSupportedException

Thrown when called on a non-Windows platform.