Add host flag to disable transparency checks in CoreCLR

A lot of security transparency annotations in corefx is missing or inconsistent. People keep running into MethodAccessExceptions because of that. It is not easy (nor cheap) to fix the annotations to make them consistent, and they are not actually required for any of the .NET Core scenarios.

This change is introducing a hosting flag to disable security transparency checks on CoreCLR, and adds this flag to all .NET Core hosts. The .NET Core hosts outside of the CoreCLR tree (e.g. ASP.NET 5) will need this flag added as well.

[tfs-changeset: 1437325]

1 files changed, 20 insertions, 18 deletions

diff --git a/src/vm/invokeutil.cpp b/src/vm/invokeutil.cpp
index 4c623f6981..60ee90630f 100644
--- a/src/vm/invokeutil.cpp
+++ b/src/vm/invokeutil.cpp
@@ -1667,14 +1667,16 @@ void InvokeUtil::CanAccessMethod(MethodDesc*    pMeth,
         if (pMeth->IsNDirect() ||
             (pMeth->IsComPlusCall() && !pMeth->IsInterface()))
         {
-            MethodDesc* pmdCaller = pSCtx->GetCallerMethod();
-
-            if (pmdCaller != NULL &&
-                Security::IsMethodTransparent(pmdCaller))
+            if (Security::IsTransparencyEnforcementEnabled())
             {
-                ThrowMethodAccessException(pSCtx, pMeth, IDS_E_TRANSPARENT_CALL_NATIVE);
-            }
+                MethodDesc* pmdCaller = pSCtx->GetCallerMethod();
 
+                if (pmdCaller != NULL &&
+                    Security::IsMethodTransparent(pmdCaller))
+                {
+                    ThrowMethodAccessException(pSCtx, pMeth, IDS_E_TRANSPARENT_CALL_NATIVE);
+                }
+            }
         }
 
 #else  // FEATURE_CORECLR
@@ -1706,21 +1708,21 @@ void InvokeUtil::CanAccessMethod(MethodDesc*    pMeth,
     //checkSkipVer is set only when the user tries to invoke a constructor on a existing object.
     if (checkSkipVer)
     {
-        MethodDesc *pCallerMD = pSCtx->GetCallerMethod();
-
-        // Interop (NULL) caller should be able to skip verification
-        if (pCallerMD != NULL &&
-            Security::IsMethodTransparent(pCallerMD) &&
-            !pCallerMD->GetAssembly()->GetSecurityTransparencyBehavior()->CanTransparentCodeSkipVerification())
+        if (Security::IsTransparencyEnforcementEnabled())
         {
-#ifdef _DEBUG
-            if (g_pConfig->LogTransparencyErrors())
+            MethodDesc *pCallerMD = pSCtx->GetCallerMethod();
+
+            // Interop (NULL) caller should be able to skip verification
+            if (pCallerMD != NULL &&
+                Security::IsMethodTransparent(pCallerMD) &&
+                !pCallerMD->GetAssembly()->GetSecurityTransparencyBehavior()->CanTransparentCodeSkipVerification())
             {
-                SecurityTransparent::LogTransparencyError(pMeth, "Attempt by a transparent method to use unverifiable code");
-            }
-            if (!g_pConfig->DisableTransparencyEnforcement())
+#ifdef _DEBUG
+                if (g_pConfig->LogTransparencyErrors())
+                {
+                    SecurityTransparent::LogTransparencyError(pMeth, "Attempt by a transparent method to use unverifiable code");
+                }
 #endif // _DEBUG
-            {
                 ThrowMethodAccessException(pCallerMD, pMeth, FALSE, IDS_E_TRANSPARENT_REFLECTION);
             }
         }