Help with .ini: Can't update Firefox - SBIE2191/2912 errors

[e-t-l]

Every time I open Firefox in its sandbox, I get errors SBIE291: "firefox.exe should not be updated under Sandboxie." and SBIE292: "To update the program, run it outside of the supervision of Sandboxie." This didn't use to happen, and it doesn't happen with other browsers in similar sandboxes. I have the firefox template enabled, but I have a feeling that there is some line in the ini that is preventing the Firefox updater from running appropriately, so I don't want to open a whole bug report yet. Would anyone mind looking over my ini to see if there's any obvious problem lines? (Firefox is installed outside the sandbox, on Windows 11. Sandboxie-plus version 1.13.7)

Enabled=y
BorderColor=#02f6f6,off,3
Template=OpenBluetooth
Template=SkipHook
Template=FileCopy
Template=qWave
Template=BlockPorts
Template=LingerPrograms
Template=AutoRecoverIgnore
Template=AdobeAcrobatReader
Template=AdobeAcrobat
Template=AdobeDistiller
Template=HP_UniversalPrintDriver
Template=TaskbarJumpList
Template=WindowsDefender
Template=Microsoft_Security_Essentials
Template=Firefox_Force
Template=Firefox_Profile_DirectAccess
Template=Firefox_Phishing_DirectAccess
Template=Firefox_Session_DirectAccess
Template=Firefox_Passwords_DirectAccess
Template=Firefox_Cookies_DirectAccess
Template=Firefox_Bookmarks_DirectAccess
Template=Local_SysCallPresets
ConfigLevel=10
UseFileDeleteV2=y
UseRegDeleteV2=y
AutoRecover=y
NeverRemove=y
OpenSamEndpoint=y
OpenLsaEndpoint=y
; OpenPipePath=C:\Program Files\Mozilla Firefox\*
OpenFilePath=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\*
; OpenFilePath=C:\Windows\System32\Tasks\Mozilla\*
; OpenFilePath=C:\Windows\System32\Tasks_Migrated\Mozilla\*
OpenFilePath=firefox.exe,%ProgramData%\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\UpdateLock-*
OpenFilePath=firefox.exe,fluentstore://*
OpenFilePath=firefox.exe,ms-store://*
OpenFilePath=firefox.exe,ms-windows-store://*
ReadFilePath=firefox.exe,file:///*
; ReadFilePath=firefox.exe,*.xpi
OpenKeyPath=firefox.exe,Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox*
OpenKeyPath=firefox.exe,Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\
OpenKeyPath=firefox.exe,Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Betterbird*
OpenKeyPath=Computer\HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\*
ForceProcess=firefox.exe
OpenIpcPath=\RPC Control\AudioClientRpc
BreakoutFolder=C:\Program Files\WindowsApps
BreakoutFolder=C:\Users\USER\Downloads\Installers
NeverDelete=y
NotifyDirectDiskAccess=y
WriteFilePath=C:\Users\USER\AppData\Local\Temp
AutoRecoverIgnore=C:\Windows\System32
AutoRecoverIgnore=C:\Users\USER\AppData
OpenPipePath=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\*
SpecialImage=firefox,firefox.exe
NoRestartOnPCA=y
ExternalManifestHack=firefox.exe,y
; OpenPipePath=firefox.exe,C:\Program Files (x86)\Mozilla Maintenance Service
; OpenPipePath=firefox.exe,C:\Users\USER\AppData\Roaming\Mozilla*
; OpenPipePath=firefox.exe,C:\Users\USER\AppData\Local\Mozilla*
; OpenPipePath=firefox.exe,C:\ProgramData\Mozilla*

[offhub]

1. Update to version 1.14.4
2. Add the BlockSoftwareUpdaters=n setting to your configuration Update proc.c #4046

Warning

However, there is one major drawback. When you update in the sandbox, the executables are now treated as INSIDE programs because the updated files are stored in the sandbox. Therefore, the OpenFilePath/OpenKeyPath directives will lose their functionality for these programs. You will have to use OpenPipePath/OpenConfPath for them. Predefined templates will also not work.

[e-t-l]

Oof, just saw the edits to your comment, that's good to know!

the executables are now treated as INSIDE programs because the updated files are stored in the sandbox

Could this be avoided by using OpenPipePath/OpenConfPath on all the Firefox install paths before running the first in-sandbox update?

[e-t-l]

Add the BlockSoftwareUpdaters=n

This was causing other compatibility issues, so I actually ended up deleting my whole Firefox sandbox, doing a fresh install of Firefox on the host system, and creating a new sandbox for it with all the Firefox Templates applied.

And I'm still running into the SBIE2191/2912 update errors. When I explored the sandboxes contents, I see that my entire user profile appears to be copied at "C:\Sandbox\e_t_l\FireBox\user\current\AppData\Roaming\Mozilla\Firefox\Profiles". This doesn't make sense to me, because Template=Firefox_Profile_DirectAccess should be allowing Firefox to read and write directly to the real profile folder at "C:\Users\e_t_l\AppData\Roaming\Mozilla\Firefox\Profiles", shouldn't it?

I don't understand this, because Brave and Thunderbird are also forced in the same sandbox, but their updaters manage to run outside of it just fine..

[offhub]

See #3521

Host's FF updater does absolutely nothing. Why? The "Firefox Background Update" tasks in Windows wants to start "firefox.exe", which is a forced-program, so it will be routed into the sandbox thus preventing the update.

[e-t-l]

Ah ok, so it's a known issue. Ironically I already arrived at the workaround you suggested (modified the updater task to call unsandboxed ff). Thank you for explaining this!