Sandboxie-Plus 1.12.4/1.12.5 failed to start start.exe in confidential box

[bastik-1001]

Describe what you noticed and did

1. Open Sandman
2. Right-click a confidential box
3. Select Run > Run Program
4. start.exe is going to be started but gets killed and the error is displayed

Please see this thread as, reference.

How often did you encounter it so far?

Try to start something in a confidential type box

Affected program

Sanboxie itself

Download link

this repo

Where is the program located?

The program is installed only outside the sandbox.

Expected behavior

Being able to use the confidential type box as before.

What is your Windows edition and version?

Windows 7 64bit

In which Windows account you have this problem?

A local account (Standard user).

Please mention any installed security software

MSE

What version of Sandboxie are you running?

Sandboxie Plus 1.12.4 or Sandboxie 1.12.5 64bit

Is it a new installation of Sandboxie?

I recently did a new clean installation.

Is it a regression?

Sandboxie 1.12.3 works fine

In which sandbox type you have this problem?

I could not select, any box with confidentiality set. I tried a standard sandbox and a hardened sandbox with ConfidentialBox=y. The "original" box is the config at the bottom.

Can you reproduce this problem on a new empty sandbox?

I can confirm it also on a new empty sandbox.

Did you previously enable some security policy settings outside Sandboxie?

No response

Crash dump

No response

Trace log

No response

Sandboxie.ini configuration

Enabled=y
BlockNetworkFiles=y
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
RecoverFolder=%Personal%
RecoverFolder=%Desktop%
BorderColor=#027df7,ttl,6
Template=OpenBluetooth
Template=SkipHook
Template=FileCopy
Template=qWave
Template=BlockPorts
Template=LingerPrograms
Template=AutoRecoverIgnore
ConfigLevel=10
UseFileDeleteV2=y
UseRegDeleteV2=y
ClosedFilePath=!<InternetAccess>,InternetAccessDevices
ProtectHostImages=y
ClosePrintSpooler=y
ClosedIpcPath=!<StartRunAccess>,*
ClosedFilePath=C:\Windows\SysWOW64
ForceProcess=KeePass.exe
ProcessGroup=<StartRunAccess>,KeePass.exe,dllhost.exe,cvtres.exe,csc.exe
ConfidentialBox=y
UseSecurityMode=y
DenyHostAccess=explorer.exe,n

[offhub]

DenyHostAccess=csrss.exe,n

[DavidXanatos]

hmm... please check with process hacker or task explorer if on your windows 7 system the csrss.exe is not running as a protected process
it should but the found workaround indicates that it does not.
also does the isue happen on windows 10? i cant reproduce it currently on ym 10 and 11 test vm's

[offhub]

Only the System process appears to be protected on Windows 7.

I have not experienced this problem on Windows 10/11.

[bastik-1001]

DenyHostAccess=csrss.exe,n

This resolves the issue.

[...] on your windows 7 system the csrss.exe is not running as a protected process [...]

It runs with the status "critical" and "system".

I am not aware that this can be reproduced on newer versions of Windows.

As there is a workaround, I am fine with closing this issue. Compatibility with older versions can be restored, but those won't be supported forever.