Can't run program or installers located inside sandbox root when "privacy mode" enabled.

[Arkadiumx]

I'm trying to install a browser inside the confidential box I've created. If I set the preset to "hardened with data protection" or enable "privacy mode" I can't run any installers to install the program and I can't run anything inside the sandbox, even if the things I'm trying to run are located inside the box root directory. Only way to allow it is to uncheck "protect box root from unsandboxed applications".

Maybe this is intended functionality, but I even tried putting the installer in the Program Files root of the box and it still won't allow anything to run. I can't even browse the box to select thing for the sandboxie start.exe prompt. Everything is blocked.

What do I need to set to be able to install a run a program in my confidential box, while still keeping the privacy mode and hardened data protection? I have to temporarily unprotect the box root to even put the installer in there. What am I doing wrong here?

[bastik-1001]

What version of Sandboxie are you using? (e.g. Sandboxie Plus 1,12,3) On which system are you? (E.g. Windows 10 64 bit 22h2).

Can someone else reproduce this? I am unable to reproduce this.

Edit: I copied files to the Sandbox root folder and ran them from there by double-clicking. For launching from within, I placed files at DRIVE:\Sandbox\%Username%\%sandboxname%\drive\C

[bastik-1001]

This appears to be a bug. I hope, David or someone else has more insight.

I only get that message if the file is not within the sandbox (or the outside location is not readable from within).

[Arkadiumx]

This seems to be directly related to the "privacy mode" feature for access policies, as unchecking that fixes this issue.

Do I need to make another post for this bug somewhere else to get it looked at?

Also, does privacy mode need to be on to prevent things running inside the sandbox from writing or viewing data from outside the box?

[bastik-1001]

This disscussion can be turned into an issue. On the right side, there is a link "Create issure from discussion".

[Arkadiumx]

Sandboxie and it's features don't use any of the windows services besides it own, correct? I have alot of services that are usually running disabled. Does sandboxie need any particular windows service to be running like App-V or something? Maybe that could be the issue? Unfortunately I don't have the time to go through all the services I've turned off and enable them to test one by one. A bunch of them would require restarts and registry work.

[bastik-1001]

There shouldn't be a reliance on other Windows services, as far as I know.

[DavidXanatos]

I think you are running into a combination of issues.

First:
A Security Hardened Box does not give admin permissions to boxed processes, hence installers don't run.
You can make programs think they have admin permissions using "FakeAdminRights=y" this often but not always works with installers.

Second:
The Box Root of an Encrypted Box can not be accessed by processes not running in the sandbox, only exceptions are some of sb+'s own processes, so to get a file into an Encrypted Box you need to eider copy/download it with a process running in that box or mount the container file without protection.

A Privacy Enhanced Box does not allow read access to most of your system so you can not copy files from your profile or wherever.

Having a Encrypted and Privacy Enhanced Box pretty much leaves you in a situation where the box cant read anything from the host and the host can not write anything into that box.

The proper way to resolve this is to set some path as Open or Normal then you can access it from within the sandbox and use this "shared" folder as a gateway between your host and your box.

[Arkadiumx]

Thanks for the reply, I think I understand how it works better now.

Having a Encrypted and Privacy Enhanced Box pretty much leaves you in a situation where the box cant read anything from the host and the host can not write anything into that box.

This is pretty much exactly what I'm trying to achive - Nothing goes in or out of the box, with the only way to get something in the box being to temporarily uncheck the root protection option. That way I can get my browser installer in, and from there, download the other program installers from within and right into the box filesystem.

But when the privacy mode is enabled, the box can't even access its own root directories. I think 8222b62 is related. Although if the fix is live, I cant see a download for 1.12.4 is it on a different branch?

##3472 (comment)

[isaak654]

Although if the fix is live, I cant see a download for 1.12.4 is it on a different branch?

#3472 (reply in thread)

[offhub]

According to my tests, programs located in the sandbox folder do not work when using an encrypted box.

create and mount encrypted box without root protection:

UsePrivacyMode=n
UseFileImage=y

from sandboxed cmd:

cd /d "C:\Program Files (x86)\Microsoft\Edge\Application"
copy msedge.exe msedge2.exe
msedge2.exe

Result:
The system cannot find the file c:\Program Files (x86)\Microsoft\Edge\Application\msedge2.exe.

[DavidXanatos]

hmm... seams that this fails even without root protection, also ram disk box is affected, yup that's a bug

[DavidXanatos]

bugfix: 8222b62

[Arkadiumx]

Is this fix live? The repo files still show 1.12.3 for me.

[isaak654]

Is this fix live? The repo files still show 1.12.3 for me.

Not as official build, just as a portable test build available in https://github.com/sandboxie-plus/Sandboxie/actions/runs/7077910366. Considering that you have opened a separate issue, you can continue there from now on.