Release v1.0.0 / 5.55.0 (pre-release) #1376
Replies: 8 comments 5 replies
-
|
I just did an update to this version of Sandboxie and as soon as I did when I load Google Chrome or Microsoft Chrome they load and the screen goes white and nothing displays, if I move the cursor around everything is there but I can't see if. |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
Sorry for the issue but it dawned on me just now Use hardware acceleration when available was enabled |
Beta Was this translation helpful? Give feedback.
-
|
Can someone point me in the direction of how to resolve printing from Classic Sandboxie Chrome[AOL] |
Beta Was this translation helpful? Give feedback.
-
|
It seems a known regression: #1397 |
Beta Was this translation helpful? Give feedback.
-
|
I am having my AOL clients call calling today that they cannot print |
Beta Was this translation helpful? Give feedback.
-
|
The issue has just been found, you need to wait the next version (1.0.2) or just downgrade to 0.9.8d in the meantime. |
Beta Was this translation helpful? Give feedback.
-
|
Ok thanks, how far out is that I have over 150 Sandboxie users call me daily
Remote Desktop Services
517 Miltwood Dr, Greensboro, NC 27455-2709
(336) 988-0891 ***@***.***
"Your operating system and Data are only as good as your last backup"
Life is not a journey to the grave with the intention of arriving safely in a pretty and well-preserved body, but rather to skid in broadside, thoroughly used up, totally worn out,
and loudly proclaiming...
'Wow! What a ride!’
From: isaak654 ***@***.***>
Sent: Tuesday, December 7, 2021 1:59 PM
To: sandboxie-plus/Sandboxie ***@***.***>
Cc: BilleBarrett ***@***.***>; Comment ***@***.***>
Subject: Re: [sandboxie-plus/Sandboxie] Release v1.0.0 / 5.55.0 (Discussion #1376)
The issue has just been found, you need to wait the next version (1.0.2).
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub <#1376 (reply in thread)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJ3MQJIJKLE2UZMDJYDR73DUPZKQ7ANCNFSM5IGSVUYA> .
Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> . <https://github.com/notifications/beacon/AJ3MQJNGZXQBXYHGHSUPSDTUPZKQ7A5CNFSM5IGSVUYKYY3PNVWWK3TUL52HS4DFWFCGS43DOVZXG2LPNZBW63LNMVXHJKTDN5WW2ZLOORPWSZGOAANPVYY.gif>
|
Beta Was this translation helpful? Give feedback.
-
I expect to release a new build tomorrow evening or such, may be, but being bug free will have to be proven by time and testers. Well if you are so relaying on reliability, I think I should set up a separate release channel with only the most stable of stablest versions ball it busyness channel and grant access to it only for a fee. I mean would it be to much to ask if one has clients to first test the new version with their use cases for function, especially with such a major release. |
Beta Was this translation helpful? Give feedback.
-
|
I try and not update until I see a major update with my clients, they are not the sharpest tools in the shed, then really depend of Sandboxie
In some cases Sandboxie has latterly save a few companies, they will wait and they will complain. 😊
Remote Desktop Services
517 Miltwood Dr, Greensboro, NC 27455-2709
(336) 988-0891 ***@***.***
"Your operating system and Data are only as good as your last backup"
Life is not a journey to the grave with the intention of arriving safely in a pretty and well-preserved body, but rather to skid in broadside, thoroughly used up, totally worn out,
and loudly proclaiming...
'Wow! What a ride!’
From: DavidXanatos ***@***.***>
Sent: Tuesday, December 7, 2021 3:36 PM
To: sandboxie-plus/Sandboxie ***@***.***>
Cc: BilleBarrett ***@***.***>; Comment ***@***.***>
Subject: Re: [sandboxie-plus/Sandboxie] Release v1.0.0 / 5.55.0 (pre-release) (Discussion #1376)
how far out is that
I expect to release a new build tomorrow evening or such, may be, but being bug free will have to be proven by time and testers.
Well if you are so relaying on reliability, I think I should set up a separate release channel with only the most stable of stablest versions ball it busyness channel and grant access to it only for a fee.
I mean would it be to much to ask if one has clients to first test the new version with their use cases for function, especially with such a major release.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub <#1376 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJ3MQJP5FNTH24RNPYAX5FTUPZV2RANCNFSM5IGSVUYA> .
Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> . <https://github.com/notifications/beacon/AJ3MQJLRBTEQB4DMGCT7IEDUPZV2RA5CNFSM5IGSVUYKYY3PNVWWK3TUL52HS4DFWFCGS43DOVZXG2LPNZBW63LNMVXHJKTDN5WW2ZLOORPWSZGOAANPZ2Y.gif>
|
Beta Was this translation helpful? Give feedback.
-
|
Can someone help me understand how app compartment works vs token based? |
Beta Was this translation helpful? Give feedback.
-
|
I also wanted to know which difference are between Application Compartment and normal sandbox. |
Beta Was this translation helpful? Give feedback.
-
|
Application Compartment means low isolation level (less restrictions) in favour of software compatibility, i.e. you could run more programs than standard sandbox. If something goes wrong there too, you can open a new issue.
I've just reposted your suggestion in the documentation issue that was opened here. |
Beta Was this translation helpful? Give feedback.
-
Version 1.0.0 is here and brings a lot of new major features, hence its a pre release, test it and expect new bugs as well, at least in the new features. I expect the final being 1.1.0 or so
The first major feature is Privacy Mode, here most of the PC is set to be treated like a Write[File/Key]Path meaning the sandbox locations are writable but the unsandboxed locations are not readable. The Hard disk appears empty except for C:\Windows and C:\Program Files and the registry only allows reading of the machine but not user root keys. This way sandboxed processes can work but can not access private user data.
To make this mode useful an other feature has been implemented called “Rule Specificity” it can be enabled independently but is always enabled in Privacy enhanced boxes. It allows to specify rules to override other rules, this is not based on specifying an order or priority, but instead by measuring how specific a rule is and always attributing the highest priority to the most specific rule.
Here the specificity is measures by the path length that matches the rule, except the last wildcard.
So for example the built in privacy rules plus a custom one
OpenFilePath=%AppData%\Mozilla\Firefox\Profiles*
NormalFilePath=C:\Program Files*
NormalFilePath=C:\Windows*
WriteFilePath=C:*
Here the rules are ordered by their specificity.
Also there is a new type Normal[File/Key/Ipc]Path which defines a default sandbox behavior for a path.
The next major feature is "App Compartment" mode "NoSecurityIsolation=y", this is a new mode of operation which disables the token based security isolation, which brings the security down to the level of other sand boxing solutions, but by doing so greatly improves compatibility. For all use cases where the goal is only compartmentalization, running multiple instances, etc, but not hard core security this mode is preferable as it should avoid many typical sandboxie issues caused by processes running with a heavily restricted token.
In this mode file system and registry accesses are still being filtered to enforce the access rules, this filtering can be disabled with "NoSecurityFiltering=y"
To ensure this “unsecure” mode is at least as secure as the sandboxing offered by other sandboxing products, a new object access filter was added that can be enabled with "EnableObjectFiltering=y" in the global settings.
If you have issues with an update installation, just uninstall the previous version keeping the sandboxie.ini and reinstall the new build.
You can support the project through donations, any help will be greatly appreciated.
Changelog
Added
added Privacy enhanced mode, sandboxes with "UsePrivacyMode=y" will not allow read access to locations containing user data
-- all locations except generic Windows system paths will need to be opened explicitly for read and/or write access
-- using "NormalFilePath=...", "NormalKeyPath=...", "NormalIpcPath=..." allows to open locations to be readable and sandboxed
added new "App Compartment" mode of operation, it's enabled by adding "NoSecurityIsolation=y" to the box configuration
-- in this mode, security is traded in for compatibility, it should not be used for untrusted applications
-- note: in this mode, file and registry filtering are still in place, hence processes run without administrative privileges
-- it is reasonably safe, all filtering can be disabled with "NoSecurityFiltering=y"
added experimental use of ObRegisterCallbacks to filter object creation and duplication
-- this filtering is independent from the regular SbieDrv's syscall-based filtering, hence it also applies to App Compartments
-- with it enabled, an application running in a compartment will not be able to manipulate processes running outside the sandbox
-- Note: this feature improves the security of unisolated App Compartment boxes
-- to enable this feature, set "EnableObjectFiltering=y" in the global section and reload the driver
-- when globally activated, the filtering can be disabled for individual boxes with "DisableObjectFilter=y"
added "DontOpenForBoxed=n", this option disables the discrimination of boxed processes for open file and open key directives
-- this behaviour does not really improve security anyways, but may be annoying, also app compartments always disable this
added setting to entirely open access to the COM infrastructure
Changed
-- for example "OpenFilePath=C:\User\Me\AppData\Firefox takes precedence over "WriteFilePath=C:\User\Me"
-- to enable this new behaviour, add "UseRuleSpecificity=y" to your Sandboxie.ini, this behaviour is always enabled in Privacy enhanced mode
-- added "NormalFilePath=..." to restore default Sandboxie behaviour on a given path
-- added "OpenConfPath=...", which similarly to "OpenPipePath=..." is a "OpenKeyPath=..." variant which applies to executables located in the sandbox
Fixed
This discussion was created from the release Release v1.0.0 / 5.55.0.
Beta Was this translation helpful? Give feedback.
All reactions