I am trying to restrict an application I am writing to a single
directory (not known until run-time) to prevent any possible directory
traversal attacks (the application needs to deal with
untrusted-user-supplied paths).

What I have done is:

1. Asked CAS to give my application no permissions:

[assembly: PermissionSet(SecurityAction.RequestOptional,
Unrestricted=false)]

2. Request unrestricted FileIOPermission (is this avoidable?):

[assembly: FileIOPermission(SecurityAction.RequestMinimum,
Unrestricted=true)]

3. When performing any action involving a user-supplied path I use
PermitOnly to drop permission to other directories:

FileIOPermission p = new FileIOPermission(PermissionState.None);
p.AddPathList(FileIOPermissionAccess.AllAccess, workingDirectory);
p.PermitOnly();

//Perform action.

FileIOPermission.RevertPermitOnly();

I'm not happy with Step 2 and 3, I'd rather the assembly only get
granted permission to the working directory, but since it's not known
until run-time (it's read from a configuration file) this does not seem
possible. Is it possible to either:

1. Have the assembly only granted access to the working directory. Or,
2. Have the assembly granted no access and then I request it when I
need it, and drop it when I'm done.

Or, is what I've done the best/only way to do this?