Template BoxedCOM: Need Documentation or Explanation

[maykura]

When editing the ini file of a sandbox, I noticed a peculiar entry Template=BoxedCOM, and I don't exactly remember how that got there.
Upon checking Templates.ini, this is the definition of that template:

[Template_BoxedCOM]
NormalIpcPath=*BaseNamedObjects*\__ComCatalogCache__
NormalIpcPath=*BaseNamedObjects*\ComPlusCOMRegTable
NormalIpcPath=*BaseNamedObjects*\RotHintTable
NormalIpcPath=*BaseNamedObjects*\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
NormalIpcPath=*BaseNamedObjects*\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
NormalIpcPath=\RPC Control\actkernel
NormalIpcPath=\RPC Control\epmapper
NormalIpcPath=\RPC Control\OLE*
NormalIpcPath=\RPC Control\LRPC*

Searching through the internet, I couldn't find any documentation or discussions about this template.

Does anyone know what's the purpose and effects of this template, and why/when it should be enabled for a sandbox?

[bastik-1001]

I don't know why, but it got added around 4 years ago.

NormalIpcPath restores normal read access to an IPC path that is blocked in privacy type boxes (data protection boxes) (red and cyan). By default, a sandboxed program could read everything a user was able to read. The data protection boxes only allow read access to generic stuff, plus what's installed into the program folders, so users don't have to enable access for all the software.

It does not change something for the other box types.

In my red box, this template is not set and so far, this did not cause any issues.

Someone who is more technically involved in Sandboxie, will be able to tell you why it was added.

[offhub]

When you set OpenIpcPath=* in the UI, it prompts you to select whether to box the COM or not. If you select (Yes), the Template_BoxedCOM template is added to the config alongside the OpenIpcPath setting.

Sandboxie/SandboxiePlus/SandMan/Windows/OptionsAccess.cpp

Lines 568 to 581 in f2ef637

	if (pItem->data(0, Qt::UserRole).toInt() == eIPC && Mode == eOpen
	&& ((Path == "*" && pItem->data(3, Qt::UserRole).toString() != "*")
	|| (Path == "\\*" && pItem->data(3, Qt::UserRole).toString() != "\\*"))
	&& !m_BoxTemplates.contains("BoxedCOM"))
	{
	if (theConf->GetInt("Options/WarnOpenCOM", -1) == -1) {
	bool State = false;
	if (CCheckableMessageBox::question(this, "Sandboxie-Plus", tr("Opening all IPC access also opens COM access, do you still want to restrict COM to the sandbox?")
	, tr("Don't ask in future"), &State, QDialogButtonBox::Yes | QDialogButtonBox::No, QDialogButtonBox::Yes) == QDialogButtonBox::Yes)
	SetTemplate("BoxedCOM", true); // Normal overrides Open even without rule specificity :D
	if (State)
	theConf->SetValue("Options/WarnOpenCOM", 1);
	}
	}

[maykura]

I do remember testing OpenIpcPath=* a while ago and then later removing it.
So I suppose Template_BoxedCOM got added in the process but did not get automatically removed when I deleted OpenIpcPath=*.

Thanks for the explanation.