The Trace log entries confuse me for these types of situations. Is there a technical nuance I'm not seeing?

[TFWol]

If I put NormalIpcPath=$:HandBrake.exe, I still see the following in the trace log and the file doesn't reach HandBrake. I thought what I added was straight-forward.

I don't understand what else the log wants from me.

Time	Process	Status	Value
19:31:25.441	Ipc (K)	Closed	$:HandBrake.exe
19:31:25.441	Ipc (K)		$:HandBrake.exe

[TFWol]

anyone?

[offhub]

The reason your NormalIpcPath=$:HandBrake.exe setting is not working is that it is the wrong rule type for cross-process access control. According to the trace log, the access was logged as Closed because the driver’s process-access decision logic only evaluates the ClosedIpcPath, OpenIpcPath, and ReadIpcPath lists when handling the special $:ProcessName.exe syntax.

NormalIpcPath entries are not consulted during this decision.

To allow a sandboxed program to interact with HandBrake.exe, you must explicitly add one of the following rules:

• OpenIpcPath=$:HandBrake.exe — allows full access
• ReadIpcPath=$:HandBrake.exe — allows read-only access

When you add NormalIpcPath=$:HandBrake.exe, the following occurs:

• Process-access evaluation phase

  • The driver checks only ClosedIpcPath, OpenIpcPath, and ReadIpcPath for a matching $:ProcessName rule.
  • Because your rule is in NormalIpcPath, it is ignored at this stage.
  • If a ClosedIpcPath rule (or the default deny policy) applies, the access is blocked and a Closed entry is logged.

• Path-matching / logging phase

  • Independently, the generic path-matching engine may still evaluate NormalIpcPath for logging purposes.
  • This can produce a trace entry referencing your NormalIpcPath rule, even though it had no effect on the access decision.

Because these two mechanisms are separate, you can see log entries for NormalIpcPath while the actual access decision is still determined solely by the IPC allow/deny lists.

[TFWol]

Thanks for taking the time to explain it. I sort of understand although it's very confusing at the same time since I was thinking Normal was similar to the Normal for file/directory access.

I really wish the Trace log had a "plain speak" "mode" where it abstracted away the symbols. Like, a mouse hover that says "Process blocked from accessing <item> due to <reason>. You might want to check <related settings>."

I'm guessing Drag and Drop to handbrake isn't going to happen (what I'm actually trying to do) since I don't see a "block", "denied", or "closed" anywhere else in the log, even with these set.