Solution Deployment Security

There are two type of solution introduced in SharePoint 2010:


Farm Solution
In the manifest file, the solution must define that the assembly be deployed to GAC or Bin folder using DeploymentTarget attribute. Farm solution which is hosted in the IIS worker process (W3WP.exe) , run code that affect the whole farm. IIS application pool recycles before SharePoint retracts or deploys the feature.


1. Deployint Assembly to GAC (global assembly cache)
    Assemblies installed in the GAC run with Full trust and it is accessible to full set of object model. You must reset IIS every time you recompile assemblies.


2. Deploying Assembly to Bin folder using CAS
    Assemblies installed in the Bin folder of the application requires you to assign execution permissions. It is only accessible to subset of object model. You can create a custom policy file and SharePoint defines two trust levels : WSS_Minimal and WSS_Medium (local_drive:\Program Files\Common Files\Microsoft Shared\web server extensions\60\config). There are cases that deploying this solution is not suitable:
(1) Workflow
(2) Event receiver
(3) Timer job


Sandboxed Solution
    Sandboxed solution which is hosted in the SharePoint user code solution worker process (SPUCWorkerProcess.exe), run code that can only affect the site collection of the solution. It is not necessary for the SPUCWorkerProcess process to recycle to load the latest version of the solution. There are the most common things that sandboxed solution cannot  do:
(1) Connect to resources that are not located on the local farm
(2) Access a database
(3) Change the threading model
(4) Call unmanaged code
(5) Write to dick
(6) Access resources in a different site collection


References:
Moss 2007 and Code Access Security
Microsoft Windows SharePoint Services and Code Access Security
Differences Between Sandboxed and Farm Solutions
Sandboxed solutions overview (SharePoint Server 2010)
Chapter 4: Sandboxed Solutions
Farm Solutions