Unable to make restrictions other than to the internet

[MPeti1]

I'm writing here because I'm not sure if this is a bug, maybe it's just me misunderstanding something.

I've just installed Sandboxie, and tried to start a few tools I know of to test if restrictions are applied correctly.
Right clicking on the defaultbox, run > run program, and tried process explorer from sysinternals, process hacker, and total commander. Both of the task managers were able to see processes running outside of the sandbox, and total commander was not just able to list directory contents outside of the sandbox, but it has loaded with the settings and opened tabs that I had outside the sandbox.

Then I've checked the sandbox settings with right clicking on the defaultbox, then sandbox options, and modified a few settings, among which were these:

• resouce access: File/Folder - All programs - Closed - *
• advanced options: hide processes: ticked the box for "don't allow sandboxed processes to see processes running in other boxes."

Of course, I clicked apply when done.

After that I've stopped all processes in the sandbox (with right clicking on defaultbox, then "terminate all programs"), and tried again all 3 of the tools I've tried before. It seems nothing has changed though, every one of them had access to information about world outside of the sandbox. They were running inside the sandbox for sure, though, because hovering over their window border made the yellow border visible.

What did I misunderstand or do wrong? I tried Sandboxie a few times already in the past few years, mostly before the open sourcing, and I've always ran into this issue.

[DavidXanatos]

The old Sandboxie does not protect your personal data, it only protects your system from being altered by the software run under its supervision.

That said with version 1.0.0 which is not very far away there will be a new Privacy Mode which blocks access to all user data and generally all locations except C:\Windows and C:\Program FIles

With regard to blocking process listing, "hide processes" hides only boxes from each otehr not host processes from a bix, for that there is a separate setting where you can specify host processes by name to be hidden, there is no option right now to hide all processes. Note however that this only allows listing, not accessing these processes or messing with them in any way.

[isaak654]

Sandboxie can block specific paths with a careful configuration of ClosedFilePath and ClosedKeyPath rules + a number of additional rules listed in CHANGELOG.md as the features to block printer spooler, clipboard and much more. All of these can be easily found on the Plus UI.

For more info, see #890, in particular:

Sandboxie as it is reliably prevents unwanted changes to the system, however what it does not prevent without advanced configuration is exfiltration of user data by processes running under its supervision, as the default file and registry access scheme is allow read to anything except when the user specified a particular path to be closed.
Hence I'm looking into reworking the access mechanism such that it by default only allows access to generic windows locations required for applications to run and not allow any access to the user profile, drives other than C and folders on C other than standard windows folders.
This way applications running under sandboxie's supervision will not be able to access private data unless specifically granted the access by the user.

[MPeti1]

Thank you, I'll check these.
Though what I still don't understand is, if I open the sandbox options for the defaultbox sandbox, go to the resource access menu, then what does the "close" access mean, and what is it's effect?

[isaak654]

Closed is the equivalent of ClosedFilePath if you have a rule with "File/Folder" as Type.
Closed is the equivalent of ClosedKeyPath if you have a rule with "Registry" as Type.
In the previous post I attached two links about them.

[MPeti1]

Oh, now I get it! Sandboxie's filesystem protection works as I expected, except that it (or internal Windows APIs) doesn't know what to do with only an asterisk as the path.
Now I blocked the path to my user directory (c:\Users[my username]), and a sandboxed total commander loaded with default settings, and on trying to open my user directory it showed an access denied error.

That said, I'm perfectly fine with needing to define what to allow and what to block.

@DavidXanatos with the upcoming Privacy Mode did you mean a preset of safe filesystem restriction options? (and under the hood changes that need to be done so it's possible)

[isaak654]

Oh, now I get it! Sandboxie's filesystem protection works as I expected, except that it (or internal Windows APIs) doesn't know what to do with only an asterisk as the path.

@DavidXanatos told me that this issue is about a change to the matching function that instead of yes/no it returned the count of characters explicitly matched, so in case of * the count was 0 hence the rest of the mechanism thought "no". A fix was included to v0.9.6 / 5.51.6.