Sandboxie Plus 1.0.0

Discussion in 'Sandboxie (SBIE Open Source) Plus & Classic' started by DavidXanatos, Nov 17, 2021.

  1. DavidXanatos

    DavidXanatos Developer

    Joined:
    Sep 6, 2006
    Posts:
    1,386
    Location:
    Viena
    Version 1.0.0 is here and brings a lot of new major features, hence its a pre release, test it and expect new bugs as well, at least in the new features. I expect the final being 1.1.0 or so

    The first major feature is Privacy Mode, here most of the PC is set to be treated like a Write[File/Key]Path meaning the sandbox locations are writable but the unsandboxed locations are not readable. The Hard disk appears empty except for C:\Windows and C:\Program Files and the registry only allows reading of the machine but not user root keys. This way sandboxed processes can work but can not access private user data.

    To make this mode useful an other feature has been implemented called “Rule Specificity” it can be enabled independently but is always enabled in Privacy enhanced boxes. It allows to specify rules to override other rules, this is not based on specifying an order or priority, but instead by measuring how specific a rule is and always attributing the highest priority to the most specific rule.
    Here the specificity is measures by the path length that matches the rule, except the last wildcard.

    So for example the built in privacy rules plus a custom one
    OpenFilePath=%AppData%\Mozilla\Firefox\Profiles*
    NormalFilePath=C:\Program Files*
    NormalFilePath=C:\Windows*
    WriteFilePath=C:*
    Here the rules are ordered by their specificity.
    Also there is a new type Normal[File/Key/Ipc]Path which defines a default sandbox behavior for a path.

    The next major feature is "App Compartment" mode "NoSecurityIsolation=y", this is a new mode of operation which disables the token based security isolation, which brings the security down to the level of other sand boxing solutions, but by doing so greatly improves compatibility. For all use cases where the goal is only compartmentalization, running multiple instances, etc, but not hard core security this mode is preferable as it should avoid many typical sandboxie issues caused by processes running with a heavily restricted token.
    In this mode file system and registry accesses are still being filtered to enforce the access rules, this filtering can be disabled with "NoSecurityFiltering=y"

    To ensure this “unsecure” mode is at least as secure as the sandboxing offered by other sandboxing products, a new object access filter was added that can be enabled with "EnableObjectFiltering=y" in the global settings.
    If you have issues with an update installation, just uninstall the previous version keeping the sandboxie.ini and reinstall the new build.
    You can support the project through donations, any help will be greatly appreciated.

    Download: https://github.com/sandboxie-plus/Sandboxie/releases/tag/1.0.0

    Changelog
    Added

    added Privacy enhanced mode, sandboxes with "UsePrivacyMode=y" will not allow read access to locations containing user data
    -- all locations except generic Windows system paths will need to be opened explicitly for read and/or write access
    -- using "NormalFilePath=...", "NormalKeyPath=...", "NormalIpcPath=..." allows to open locations to be readable and sandboxed

    added new "App Compartment" mode of operation, it's enabled by adding "NoSecurityIsolation=y" to the box configuration
    -- in this mode, security is traded in for compatibility, it should not be used for untrusted applications
    -- note: in this mode, file and registry filtering are still in place, hence processes run without administrative privileges
    -- it is reasonably safe, all filtering can be disabled with "NoSecurityFiltering=y"

    added experimental use of ObRegisterCallbacks to filter object creation and duplication
    -- this filtering is independent from the regular SbieDrv's syscall-based filtering, hence it also applies to App Compartments
    -- with it enabled, an application running in a compartment will not be able to manipulate processes running outside the sandbox
    -- Note: this feature improves the security of unisolated App Compartment boxes
    -- to enable this feature, set "EnableObjectFiltering=y" in the global section and reload the driver
    -- when globally activated, the filtering can be disabled for individual boxes with "DisableObjectFilter=y"

    added "DontOpenForBoxed=n", this option disables the discrimination of boxed processes for open file and open key directives
    -- this behaviour does not really improve security anyways, but may be annoying, also app compartments always disable this

    added setting to entirely open access to the COM infrastructure

    Changed

    reworked the resource access path matching mechanism to optionally apply more specific rules over less specific ones
    -- for example "OpenFilePath=C:\User\Me\AppData\Firefox takes precedence over "WriteFilePath=C:\User\Me"
    -- to enable this new behaviour, add "UseRuleSpecificity=y" to your Sandboxie.ini, this behaviour is always enabled in Privacy enhanced mode
    -- added "NormalFilePath=..." to restore default Sandboxie behaviour on a given path
    -- added "OpenConfPath=...", which similarly to "OpenPipePath=..." is a "OpenKeyPath=..." variant which applies to executables located in the sandbox
    removed option to copy a box during creation, instead the box context menu offers a duplication option
    reworked the box creation dialog to offer new box types

    Fixed

    fixed SBIE1401 notification during Sandboxie Plus uninstall (by mpheath) 68fa37d
    fixed memory leak in driver handling FLT_FILE_NAME_INFORMATION (by Therzok) #1371
     
  2. deugniet

    deugniet Registered Member

    Joined:
    Nov 25, 2013
    Posts:
    1,071
    Nice! Congrats with Sandboxie Plus 1.0.0 :)
     
  3. plat1098

    plat1098 Registered Member

    Joined:
    Dec 19, 2018
    Posts:
    1,467
    Location:
    Brooklyn, NY
    Exited UI and installed Classic 5.55.0. Is it true Classic version is going to be discontinued as per here? :(
     
  4. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    18,787
    Location:
    UK
    Installed 5.55.0 over the top of previous build.
    No issues with downloads, no issues with Edge or Vivaldi.
     
  5. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    18,787
    Location:
    UK
    Installed Plus 1.0.0 over the top of previous plus build.
    No issues with downloads, no issues with Edge or Vivaldi.
    File recovery (quick recovery) seems very quick compared with previous plus builds.
     
  6. Stelica

    Stelica Registered Member

    Joined:
    Nov 10, 2014
    Posts:
    63
    Location:
    Romania
    Same error in event viewer due to virtual desktop manager template when I open edge pdf documents. Sandboxie Classic 5.55.0. (Event log - Name of the module with defects: msvcrt.dll)
     
    Last edited: Nov 17, 2021
  7. zmechys

    zmechys Registered Member

    Joined:
    Dec 29, 2012
    Posts:
    1,017
    Location:
    usa

    Lucky you.
    I've updated Sandboxie to 5.55.0, but that error message still there.

    Here is a snapshot of that error while using Google Chrome.

    SBIE2211[saoidfgj.png

    In addition, I've updated Brave but still don't have my spellcheck while using new Sandboxie.
    Brave has a fully functioning spellcheck without Sandboxie.
     
  8. deugniet

    deugniet Registered Member

    Joined:
    Nov 25, 2013
    Posts:
    1,071
    A request David. Could you make the pizza-icons (a little bit) larger? And possibly some more space between the pizza-icons?

    1.JPG
     
  9. Stelica

    Stelica Registered Member

    Joined:
    Nov 10, 2014
    Posts:
    63
    Location:
    Romania
    I removed virtual desktop manager template from the ini file and the error no longer appears in the event viewer. I don't know with what this template helps. In my case only with errors.
     
  10. Stelica

    Stelica Registered Member

    Joined:
    Nov 10, 2014
    Posts:
    63
    Location:
    Romania
    Unfortunately, after a while the error reappeared. I'm back to Sandoxie 5.53.2.
     
  11. DavidXanatos

    DavidXanatos Developer

    Joined:
    Sep 6, 2006
    Posts:
    1,386
    Location:
    Viena
    This change will be rolled back in the next build
     
  12. Stelica

    Stelica Registered Member

    Joined:
    Nov 10, 2014
    Posts:
    63
    Location:
    Romania
    Thank you!
     
  13. henryg1

    henryg1 Registered Member

    Joined:
    Jun 14, 2020
    Posts:
    240
    Location:
    uk
    Congratulations - a milestone!

    Am I correct that to use Privacy Mode every program that is to run in a sandbox must be specified unless installed in it?

    Even though I've used SB for many years, I suspect that its current complexity/versatility may be leaving me behind.
     
  14. zmechys

    zmechys Registered Member

    Joined:
    Dec 29, 2012
    Posts:
    1,017
    Location:
    usa
    P.S. Where could I get some kind of tutorial on Sandboxie Plus.
    I've just downloaded and installed it, along with my Classic Sandboxie.
    Another question.
    Is it "secure" that Sandboxie Plus "Cleanup?"

    Thank you.
     
  15. DavidXanatos

    DavidXanatos Developer

    Joined:
    Sep 6, 2006
    Posts:
    1,386
    Location:
    Viena
    yea you must eider set a program as forced process, or start it through the context menu option.



    There is no tutorial yet, but it should be intuitive enough to classic users the UI's have a lot of similarities
    the an otehr question has som gramatical issue i dont uderstand what you are asking
     
  16. zmechys

    zmechys Registered Member

    Joined:
    Dec 29, 2012
    Posts:
    1,017
    Location:
    usa

    Thank you, David.

    My question was about that button, "Cleanup".

    I always delete all the contents of Sandboxie by shredding it - securely.
    When I closed my browser and pushed that button, my Sandboxie folder was deleted.
    Was it a NORMAL folder deletion or a secure one?

    Cleanup.JPG
     
  17. DavidXanatos

    DavidXanatos Developer

    Joined:
    Sep 6, 2006
    Posts:
    1,386
    Location:
    Viena
    This button does not delete anything, it just cleans up the UI, like kept processes, log entries, trace log

    Sandboxie always use normal deletion as on SSD's there is no such thing liek secure erase.
     
  18. zmechys

    zmechys Registered Member

    Joined:
    Dec 29, 2012
    Posts:
    1,017
    Location:
    usa
    Thank you.

    LOL. I'm still using the old-fashioned HDD drive.

    P.S. I know you are busy, but could you just think about that strange issue with Brave - only with Brave that loses a spellcheck with Sandboxie.

    Thank you.
     
  19. henryg1

    henryg1 Registered Member

    Joined:
    Jun 14, 2020
    Posts:
    240
    Location:
    uk
    upload_2021-11-18_9-31-2.png

    Are any of these Privacy mode?

    Is there anywhere I can look up the differences between the options? I have used the same 2 sandboxes for years now, have never seen this dialogue, and I think it's about time I got to grips with the options.

    Great job, David.
     
  20. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    15,193
    Location:
    The Netherlands
    I don't see why Sandboxie Classic should be discontinued, they both share the same sandboxing engine, and Sandboxie Classic doesn't need any GUI changes if I'm correct.
     
  21. Melionix

    Melionix Registered Member

    Joined:
    Jun 22, 2020
    Posts:
    81
    Location:
    Earth
    It's the same reason 32-bit Windows 11 isn't a reality. Two code bases take more time than one to maintain.
     
  22. DavidXanatos

    DavidXanatos Developer

    Joined:
    Sep 6, 2006
    Posts:
    1,386
    Location:
    Viena
    "with Data Protection" are the variants with privacy mode

    "Application Compartment" are the variants without token based isolation, ie. reduced security for better compatibility.
     
  23. DavidXanatos

    DavidXanatos Developer

    Joined:
    Sep 6, 2006
    Posts:
    1,386
    Location:
    Viena
    That is not quite the same as we need SbieDll.dll and SbieSvc.exe on a 32 bit version even on a 64 bit windows, for the wow64 support i.e. runnign 32 bit apps on 64 bit windows.
    So in the end providing a 32 bit version breaks down mostly to providing a 32 bit SbieCtrl.exe and a few very minor additional components.

    Anyhow most of the new features can't be conveniently used with SbieCtrl.exe so it really is time to update to the plus ui.
    What reasons could someone have to stick to the old UI? In the last months I added mostly all functionality (even that one I consider pointless) from the classic UI. If there is still something mussing, let me know. About the Qt visuals, lets be honest the classic UI looks so ugly that Qt's shortcomings cant be worse.
     
  24. zmechys

    zmechys Registered Member

    Joined:
    Dec 29, 2012
    Posts:
    1,017
    Location:
    usa
    I wonder if there is ANY possibility to get that Sandboxie Plus Cleanup SECURE?
    (Just for me.)
    I don't want to engage in any discussions on, "Why do you need that SECURE deletion of Sandboxie contents?"
    If it's not possible, I'll switch back to Classic Sandboxie.

    Any ideas?
     
  25. henryg1

    henryg1 Registered Member

    Joined:
    Jun 14, 2020
    Posts:
    240
    Location:
    uk
    Have Sbie sandboxes in a ramdisk? I do.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.