Sandboxie Forum - Google Chrome (3912)

ZomgLoL:

Wed Nov 26, 2008 1:40 pm

Can't believe the hype surrounding google chrome. Think I'll stick to Opera... On another note, The German guys did forge Iron from Chrome.

Jason: Re: Download issue

Tue Nov 18, 2008 2:52 am

]]>Quoting Damjan: ]]>I am experiencing this on three PCs I use. If I initiate download of anything from a sandboxed Crome, the download remains stuck at "starting" status. This behaviour didn't change since 3.30.16 and is still an issue with 3.32. Anyone else had this problem? Sandboxed IE and FF download just fine. Unsandboxed Chrome downloads without problem. Damjan ]]> I have a separate sandbox for SRWare Iron, the downloading will work with the following settings: Settings -> Resource Access -> File Access -> Full Access -> %Personal%\Downloads\ [/img]

:

Tue Nov 18, 2008 1:58 am

Sometimes when I go to recover the download it says 'file in use by another application' then I'll try again and it recovers. That has never happened with FF or Opera.

tzuk:

Mon Nov 17, 2008 12:31 pm

I'm not using Chrome regularly so I did not notice this earlier, but I tried now and I can confirm the problem. I'll look into it later on.

Damjan: Download issue

Mon Nov 17, 2008 11:21 am

I am experiencing this on three PCs I use. If I initiate download of anything from a sandboxed Crome, the download remains stuck at "starting" status. This behaviour didn't change since 3.30.16 and is still an issue with 3.32. Anyone else had this problem? Sandboxed IE and FF download just fine. Unsandboxed Chrome downloads without problem. Damjan

offthegrid:

Thu Nov 13, 2008 10:20 pm

Works great with the beta. I just need to figure out a way to keep the bookmarks and cookies updated when I delete the sandbox.

tzuk:

Tue Nov 04, 2008 3:46 pm

I added this to my to-do list, but I don't expect that I will be addressing this soon.

: not so fast

Mon Nov 03, 2008 3:42 pm

Immediate Recovery is still not working as it should. It is triggered at the START of the download and not at the END as in IE7. Meaning you have the Immediate Recovery window sitting in front of you as long as the the download is in progress (eventually allow minimize for the window). If you try to download an .exe things get even stranger. Chrome creates a spaceholder file like "unconfirmed 123456.exe" and of course sbie offers Immediate Recovery for this file too.

tzuk:

Sun Nov 02, 2008 12:40 pm

And with these last two comments said, this issue is now resolved.

SnDPhoenix:

Fri Oct 31, 2008 3:23 pm

Yep, I tried installing/running SRware Iron and Iron Portable sandboxed with the latest beta and it went through fine, didn't need to change any settings in Sandboxie (such as to allow drivers) or use any command line switches. Oh btw, I recommend Iron ove Chrome, Chrome "owns everything you do", creates a unique ID and logs everything you do and associates it with that unique ID which is tied to your IP. Oh and also it loads up that stupid Google Updater in the background without your permission, sure you could easily terminate that and delete the file as well as using the "UnChrome" program to help anonymize you some, but why bother? If you want chrome, without all the spying, then use Iron. Plus Iron is actually up-to-date unlike Chrome... :wink:

soccerfan:

Fri Oct 31, 2008 2:23 pm

]]>Quoting Anonymous: ]]>I am using SRWare Iron which is based on Chromium (Google Chrome) source code, and it crashes immediately after I start it in sandbox. :( http://www.srware.net/en/software_srware_iron_chrome_vs_iron.php ]]> I just tried chrome and iron (with and without the "-no-sandbox" flag) with the newest sandboxie beta v3.31.16 and both run fine for me (on XP). Try it with this beta.

tzuk:

Fri Oct 31, 2008 11:14 am

Are you trying with the latest beta version 3.31.16 ?

:

Thu Oct 30, 2008 8:52 pm

I am using SRWare Iron which is based on Chromium (Google Chrome) source code, and it crashes immediately after I start it in sandbox. :( http://www.srware.net/en/software_srware_iron_chrome_vs_iron.php

Bob Smith: Further Oddities

Thu Sep 25, 2008 2:56 pm

Original poster here, I just bumped into this again, and found a nice work-around. I have the low-level kernel driver thing previously mentioned turned off, and have chrome forced to run in it's sandbox. If I run chrome in the sandbox using "Run Sandboxed -> Run from Start Menu," I always get a broken chrome instance. However, running from the windows start menu and letting sandboxie force it into the sandbox always results in a working instance (yes; I'm sure it's in the sandbox.). I don't have any special settings in the sandbox asides from immediate deletion. chrome 0.2.149.30 sandboxie 3.30 Also running firefox and msn in other sandboxes. Run as UAC is off.

: Import bookmarks & settings

Thu Sep 18, 2008 7:24 am

Here is another one that needs investigating. Importing (bookmarks, History whatever) does not work under SBIE's control. Mean - one can use the function but there are no entries in chrome shown or saved (Chrome without SBIE = no problem). Sorry can't help. I like this little browzr and SBIE too.

Lupatrian: Re: 9/14 Guest post

Mon Sep 15, 2008 9:08 pm

I'm running Chrome un-Sandboxied for now. I upped my Migration to a million KB just to get Chrome to open in S-Boxie, but that slowed Chrome down quite a bit. I still have to mess around and try the suggestions listed here. Good luck. ~:)

tzuk:

Sun Sep 14, 2008 8:30 pm

Yes, soon. :) Unfortunately Chrome was released just as I finalized version 3.30 and had to focus my attention away from development for a short while. Soon I will be able to get back on track.

: got it to work - don't know why

Sun Sep 14, 2008 6:29 pm

SOCCERFAN, thanks for this. Resource Access Monitor did not help here. It did not show any different resources used before and after I got it working. After fiddling around I've put my Chrome download Directory into File Access / Full Access. Bingo this worked. Looks like Chrome saves the downloads in an very strange way. Of course this kills the Quick Recovery feature but at least it's a workaround. Hope we get some "official" support for Chrome soon...

soccerfan: Re: No downloads with Chrome

Sun Sep 14, 2008 4:10 pm

]]>Quoting Anonymous: ]]>LUPATRIAN, did you got downloads working in Chrome? Mine are stuck with message "starting..." and hanging forever. Does anybody have a solution to get downloads working? Tried with chrome.exe build 2190 and --no-sandbox (and --single-process). I did also opened up IPC and all Low-Level Access for testing - but did not help. XP/SP3 and sbie 3.3 ]]> You may want to try resource access monitor to see what resources are being blocked. Look here: [url]http://www.sandboxie.com/index.php?ResourceAccessMonitor[/url]

: No downloads with Chrome

Sun Sep 14, 2008 2:52 pm

LUPATRIAN, did you got downloads working in Chrome? Mine are stuck with message "starting..." and hanging forever. Does anybody have a solution to get downloads working? Tried with chrome.exe build 2190 and --no-sandbox (and --single-process). I did also opened up IPC and all Low-Level Access for testing - but did not help. XP/SP3 and sbie 3.3

SnDPhoenix:

Sun Sep 14, 2008 2:02 pm

]]>Quoting infoqseesq: ]]>Google Chrome has the best malware protection of all the web browsers and as much faster than IE 7 and 8 and slightly faster than Firefox. ]]> Yep Chrome does have the best malware protection of any browser and is definetley faster, in program speed and browsing speed.... ...But, chromes malware protection is not SO good it doesnt need Sandboxie... Chromes sandboxing is a bare bones attempt at sandboxing and only covers cookies and history...

infoqseesq:

Sun Sep 14, 2008 1:56 pm

]]>Quoting SnDPhoenix: ]]> ]]>Quoting xellos: ]]>chrome is very secure as it is, so far the only known exploit is the download one (http://www.palluxo.com/2008/09/03/apple-safari-carpet-bomb-flaw-hits-google-chrome-browser/) so maybe set it to prompt for downloads. im sure its safe to run untill tzuk can fix it with sb :) ]]> Actually, there is more then just that one exploit now [URL=http://www.picoodle.com/view.php?img=/3/9/5/f_Screenshotm_aaa3c63.png&srv=img28][img:81da0f944d]http://img28.picoodle.com/data/img28/3/9/5/t_Screenshotm_aaa3c63.png[/img:81da0f944d][/URL] However I guess that isn't too bad for now... Anyways, Chrome is probably pretty secure, I only wish I knew why Chrome needed drivers allowed in Sandboxie just to connect to the net. :( ]]> In the latest beta build of Google Chrome, most of the exploits were fixed..there is only one left which will be fixed in the build which will be released soon. Google Chrome has the best malware protection of all the web browsers and as much faster than IE 7 and 8 and slightly faster than Firefox.

infoqseesq: Re: Google Chrome

Sun Sep 14, 2008 1:51 pm

]]>Quoting Bob Smith: ]]>I just installed Google's new web browser, Google Chrome (http://www.google.com/chrome/). Running chrome outside of sandboxie, everything works fine. Inside sandboxie, I cannot navigate to any web page. Sometimes the tab stays blank, sometimes I get a generic error message, and sometimes I get a message telling me that the tab is not responding. This happens both if 'This program is the only program that can access the internet' is on or off. I'm running Sandboxie version 3.24. ]]> Google Chrome already has it's own sandbox so you do not need sandboxie. It also has the best malware protection in any browser and is much faster than IE 7 and 8 and slightly or equally as fast as firefox.

prescott:

Sat Sep 13, 2008 3:06 pm

]]>Quoting SnDPhoenix: ]]>Anyone been able to find out what driver chrome is loading/installing? I haven't gotten the chance to look cause I've had a lot of things to do today and traveling alot plus meeting up with some people, etc.. ]]> Looking at the threads in Process Explorer In Sandboxie with kernel mode driver access enabled [img:223d51e6fc]http://i34.tinypic.com/29wwk04.png[/img:223d51e6fc] In Sandboxie running Chrome with '-no-sandbox' and kernel mode driver access disabled [img:223d51e6fc]http://i38.tinypic.com/2vla4c8.jpg[/img:223d51e6fc]

:

Tue Sep 09, 2008 11:21 pm

]]>Quoting Guest105: ]]>Chrome works well with Sandboxie, you don't have to let programs load kernel drivers and impair security. Just run chrome.exe with -no-sandbox switch. Sandboxie\start.exe X:\chrome.exe -no-sandbox (X=path to chrome.exe executable) ]]> Thanks for the tip... it seems to be working fine with this shortcut!

Guest105:

Mon Sep 08, 2008 5:21 pm

Chrome works well with Sandboxie, you don't have to let programs load kernel drivers and impair security. Just run chrome.exe with -no-sandbox switch. Sandboxie\start.exe X:\chrome.exe -no-sandbox (X=path to chrome.exe executable)

MitchE323:

Sun Sep 07, 2008 7:04 am

On XP, after installing Chrome normally (Unsandboxed), there are only two additions to Windows and below. One is an msi placed in Installer for Google Gears. The other is a task placed in Tasks for Google Updater. Since Scheduled Tasks is a service, could that be what is preventing a sandboxed installation?

LM7:

Sun Sep 07, 2008 5:22 am

An idea for those who want to avoid the potential problems inherent in letting SBIE install drivers: make a separate Sandbox just for Chrome, and set it so that it can install drivers, while leaving the Default Box settings unchanged. To quickly access Chrome, in its own sandbox, make a shortcut like: "C:\Program Files\Sandboxie\Start.exe" /box:Chrome c:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\Chrome.exe.

xellos:

Sun Sep 07, 2008 2:56 am

Lupatrian, sounds like you've been using chrome oustside of sandbox so its trying to load some big cache files maybe so when sandboxie sees these files already created it trys to copy them over, you should clear all browser histrory outside sandboxie first then that message should go away. as for running chrome sandboxed if youve read through this thread you should know it doesnt work perfect with sandboxie yet, you also need to check the box to allow sandboxie to load kernel mode drivers (as i said in the begining of this thread).

Lupatrian: Good God, it's me again!

Sat Sep 06, 2008 9:27 pm

Okay, I THOUGHT I was running Chrome via Sandboxie (until I saved a file without sandboxing). I had the Sandbox DefaultBox, BUT, it's all yellow - no red spots. So I'm still getting the same Migration-size error. The messages seem to differ based on whether I open Chrome via the Sandboxed Web Browser icon, or the Chrome (default) icon > Run Sandboxed; sometimes, I don't get the Migrate message at all. ?? I'll stop posting now and just check back for answers!

Lupatrian: Update

Sat Sep 06, 2008 9:02 pm

This is weird: I went in to adjust some other things in Sandboxie Settings - including knocking my migrate file size back down to 49K (because I couldn't remember the original size!), and now G-Chrome loads just fine - and I confirmed that it is running in sandbox. ??

Lupatrian: Chrome won't open in Sandboxie

Sat Sep 06, 2008 8:50 pm

Chrome won't load in Sandbox for me, either - but I get the "File too large to migrate" message (do you others have it checked-to-suppress-message?). I tried upping the migrating file size; chrome will then open to a blank page (as I have it set up to do), but will not proceed to other pages; I get a "The following pages have become unresponsive. Kill/Wait?" message. Hope this helps find the cause. V3.30, downloaded today. In Google Chrome > Settings, make sure you have "Ask me where to save every file" checked off. The issue was the way auto-downloads kinda sneak by; changing this setting will alert you to any downloads. I am (was??) a Firefox devotee, but I sure do love Chrome. It's QUICK. And if you use many of the Google products, it's sooo smooth. :oops:

SnDPhoenix:

Sat Sep 06, 2008 3:29 am

]]>Quoting xellos: ]]>chrome is very secure as it is, so far the only known exploit is the download one (http://www.palluxo.com/2008/09/03/apple-safari-carpet-bomb-flaw-hits-google-chrome-browser/) so maybe set it to prompt for downloads. im sure its safe to run untill tzuk can fix it with sb :) ]]> Actually, there is more then just that one exploit now [URL=http://www.picoodle.com/view.php?img=/3/9/5/f_Screenshotm_aaa3c63.png&srv=img28][img:67f058fd7b]http://img28.picoodle.com/data/img28/3/9/5/t_Screenshotm_aaa3c63.png[/img:67f058fd7b][/URL] However I guess that isn't too bad for now... Anyways, Chrome is probably pretty secure, I only wish I knew why Chrome needed drivers allowed in Sandboxie just to connect to the net. :(

soccerfan:

Fri Sep 05, 2008 8:30 pm

A portable version has appeared on portableapps.com: [url]http://portableapps.com/node/15456[/url] It can be run sandboxed provided driver loading is allowed (blockdrivers=n). I'll wait for tzuk's verdict/advice and also wait for this browser to mature before I try it again.

:

Fri Sep 05, 2008 7:28 pm

Hey tzuk, you may want to check Chromes sandbox source code directly: http://src.chromium.org/viewvc/chrome/branches/official/build_151.1/src/sandbox/ Another thing.... Chromium an alternative(???) version of Chrome which is also open source, does not start at all when run in sandboxie, it crashes immediately.

xellos:

Fri Sep 05, 2008 11:05 am

chrome is very secure as it is, so far the only known exploit is the download one (http://www.palluxo.com/2008/09/03/apple-safari-carpet-bomb-flaw-hits-google-chrome-browser/) so maybe set it to prompt for downloads. im sure its safe to run untill tzuk can fix it with sb :)

soccerfan:

Fri Sep 05, 2008 11:03 am

]]>Quoting tzuk: ]]>Before discussing whether it's ok for browsers to load drivers, can anyone please tell me the name of the driver that Google Chrome supposedly loads? :) ]]> The developer of defensewall had this to say: [quote:1dffe0748a]Chrome's sandboxing is totaly based on Windows built-in mechanisms and doesn't refer to Greenborder's technologies. I found no additional drivers after its installation.[/quote:1dffe0748a]Original source here: [url]http://www.wilderssecurity.com/showpost.php?p=1311655&postcount=9[/url] So, no drivers and no greenborder connection apparently.

mart:

Fri Sep 05, 2008 11:00 am

]]>Quoting SnDPhoenix: ]]> Also about this sandboxing issue, no Googles chrome does not have sandboxing builtin. They acquired greenborder some time ago, but we all know they discontinued it, so I doubt they'd use its technology in their browser. However, that aside, when they say "sandboxing" they dont mean that what the browser does wont affect your PC, it is like what tzuk said [url=http://www.sandboxie.com/phpbb/viewtopic.php?p=26136#26136]here[/url], all they mean is that each window/tab is running in its own memory, process, etc.. which can be thought of as each tab being "sandboxed" away from the other tabs. Which is why if you go to a site in one tab and it causes a hang, you can just close that tab without the other tabs hanging and/or crashing. Doubt that the tabs are actually "sandboxed" though, which would imply there is some kind of isolation away from the PC... ]]> I read [url=http://www.scmagazineus.com/Googles-inaugural-browser-comes-with-security-focus-including-sandboxed-sessions/article/116222/]this[/url] article that says Chrome's sandboxing does protect the computer from malware, rather than only the tabs from one another. If that is the case, would Chrome actually need to run under the protection of Sandboxie?

Lode:

Fri Sep 05, 2008 7:30 am

I was thinking of using Chrome only for sites I know and trust, and otherwise continue to surf IE in Sandboxie. But since I have a complete back-up -Image- (Acronis) of everything on my machine in its protected back-up space on my hard disk, I am willing to run the risk of letting Chrome run in the lesser safety mode of Sandboxie. See what happens... I can always set my complete Image -clone- back on my machine if I get a bug. If that would happen too often for my taste, I will return to the "use Chrome only for trusted sites" mode. In the mean time it looks like I am only able to save Bookmarks in Chrome outside of Sandboxie.

SnDPhoenix:

Fri Sep 05, 2008 3:30 am

Xellos, Internet Explorers useragent says it is a Mozilla browser, but is it really? No... It really isn't built off of Safari, the only reason it is affected by the same bug as in Safari is because of that webkit engine. Chrome uses an older version of the webkit engine which is why it is vuln to that bug, whereas Safari uses the most recent webkit that isn't vulnerable. But seriously all this aside, whether or not it is actually built off of safari or not, I agree. Chrome is a fast, simple browser, with some unique features. I would love to see how it progresses, though I will admit, I do miss being able to extend the functionality of the browser with addons as in Firefox. :cry: Btw, I have heard that Chrome has "plugins" coming (I guess like for IE) but I haven't seen them anywhere, you guys? Also, is there any place to get themes for the browser? On Vista, Chrome looks nice with all the transparency and glassy look, but Chrome on XP = Bleh. I hate this blue look it has on XP...

xellos:

Fri Sep 05, 2008 2:16 am

]]>Quoting SnDPhoenix: ]]> ]]>Quoting xellos: ]]>well chrome is just a modified safari browser, has anyone tried normal safari and see if that works any differnet ]]> No it is not. Safari is closed source and belongs to Apple, there is no way they'd let Google modify their Safari browser and distribute it as the "opensource" Chrome. Only thing Chrome has in common with Safari, is that chrome uses the Webkit engine, otherwise, they are 2 differet browsers. Also yes, I have installed Safari and used it sandboxed in the past and it has worked fine. Although I wouldn't bother installing the "Bonjour" service... ]]> Google Inc. Copyright c 2006-2008 Google Inc. All Rights Reserved. Portions of this software were licensed from third parties as described at: http://www.google.com/support/chrome/bin/answer.py?answer=100336 Official Build 1583 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13 taken from help - about google chrome, unless the applewebkit requires them to put that in (and that essentially is the browsers main heart). but really they are both similar even have the same attack bug (the download exploit http://www.palluxo.com/2008/09/03/apple-safari-carpet-bomb-flaw-hits-google-chrome-browser/), that doesnt effect other browsers. obviously google built alot into it , sandboxing and other features, but it still relies on apples technology anyways i like chrome its fast loading heh blows firefox's and ie's load time away although it is slow on pages with a ton of images. and lacks plugin support like firefox (maybe that can change in the future. overall im happy with the beta.

macman:

Thu Sep 04, 2008 11:41 pm

I confirm that. I have successfully run Safari sandboxed in its various versions since release without any problems. Chrome with low level access checked continues to work just fine, including for downloads on my machine (XP SP3). I am unable to find any drivers loaded by it.

SnDPhoenix:

Thu Sep 04, 2008 11:16 pm

]]>Quoting xellos: ]]>well chrome is just a modified safari browser, has anyone tried normal safari and see if that works any differnet ]]> No it is not. Safari is closed source and belongs to Apple, there is no way they'd let Google modify their Safari browser and distribute it as the "opensource" Chrome. Only thing Chrome has in common with Safari, is that chrome uses the Webkit engine, otherwise, they are 2 differet browsers. Also yes, I have installed Safari and used it sandboxed in the past and it has worked fine. Although I wouldn't bother installing the "Bonjour" service...

xellos:

Thu Sep 04, 2008 10:39 pm

well chrome is just a modified safari browser, has anyone tried normal safari and see if that works any differnet

SnDPhoenix:

Thu Sep 04, 2008 9:52 pm

]]>Quoting tzuk: ]]>I don't know yet why that particular checkbox in Sandbox Settings is needed to make it work, but I would be really surprised if it did install a driver. With Windows Vista and UAC it is almost unthinkable that a new and modern browser would try something like this. ]]> Would running chrome on Vista and/or with UAC really make a difference?

tzuk:

Thu Sep 04, 2008 8:47 pm

]]>Quoting xellos: ]]>seems to be a bug even with load drivers checked (downloads wont start), anyways i couldnt find the driver but it does load kernel.dll maybe thats what sandboxie is catching. (was looking at what it does with filemon, its got me puzzled) ]]> Well I meant to suggest the possibility that Google Chrome does not actually load any drivers. I don't know yet why that particular checkbox in Sandbox Settings is needed to make it work, but I would be really surprised if it did install a driver. With Windows Vista and UAC it is almost unthinkable that a new and modern browser would try something like this.

SnDPhoenix:

Thu Sep 04, 2008 8:17 pm

Anyone been able to find out what driver chrome is loading/installing? I haven't gotten the chance to look cause I've had a lot of things to do today and traveling alot plus meeting up with some people, etc..

street011:

Thu Sep 04, 2008 7:49 pm

confirmed, not working here.

sb726551: Registery search for "chrome" that has been sandbo

Thu Sep 04, 2008 3:36 pm

FYI - the only references to "chrome" are those that point to the sandboxed location - such as Winpatrol etc. :D

SnDPhoenix:

Thu Sep 04, 2008 2:57 pm

Haha, against the better judgment of every Sandboxie user who probably wouldn't do this, I went ahead and installed Chrome unsandboxed instead. :lol: Gotta say, it is friggin blazing! I click Chrome in my start menu and it launches faster then the start menu can close. :shock: To sb726551, I dont know where the bookmarks are stored, but I'll give it a look in a bit.

MitchE323:

Thu Sep 04, 2008 2:54 pm

I started with an empty test sandbox and used MajoMo's SandboxDiff on the install. http://sandboxie.com/phpbb/viewtopic.php?p=23711#23711 For some reason, the ''comp-files.txt'' file that SandboxDiff creates listed every file on my computer. :shock: I don't know why that would be. (snapshotting the system?) Also the registry changes listed "elevated privleges" type changes. I don't use SandboxDiff a whole heck of a lot, if anyone can confirm?

Oneder:

Thu Sep 04, 2008 1:53 pm

I monitored the install of Chrome into an admin account of Vista using Total Uninstall and saved the text file which I've rarred and uploaded to Rapid Share if anyone wants to peruse it. Bit beyond me but some of the whizzes here may be able to pick if any drivers are installed? http://rapidshare.com/files/142573768/Chrome_Install_Vista.zip.html

sb726551: Chrome Bookmarks

Thu Sep 04, 2008 1:52 pm

Has anyone found out where the Chrome Bookmarks are stored and if they can be accesses as HTML? :?: :idea: :!: :mrgreen:

xellos:

Wed Sep 03, 2008 8:55 pm

seems to be a bug even with load drivers checked (downloads wont start), anyways i couldnt find the driver but it does load kernel.dll maybe thats what sandboxie is catching. (was looking at what it does with filemon, its got me puzzled)

sb726551: Google Chrome and SandboxIE 3.30

Wed Sep 03, 2008 7:26 pm

I just created a sandbox for Chrome and installed it after copying the exe into it. I had to do the allow low level trick and now am surfing the net. The speed seems quite fast and so FAR so GOOD... I hope some one can find out WHY we have to allow the low level access and either WE or Google can cap that one. :roll:

kwismer:

Wed Sep 03, 2008 5:21 pm

]]>Quoting SnDPhoenix: ]]>Hmm btw, contrary to my above post, it seems Chrome does use sandboxing! :shock: ]]> indeed, but google themselves admit that they are unable to sandbox plugins at this time so their sandboxing is insufficient...

tzuk:

Wed Sep 03, 2008 2:34 pm

Before discussing whether it's ok for browsers to load drivers, can anyone please tell me the name of the driver that Google Chrome supposedly loads? :)

soccerfan:

Wed Sep 03, 2008 2:04 pm

]]>Quoting xellos: ]]>hm found out how to get it to work but .. i dont like it , under sandboxie options you need to check low-level access -> Permit programs in this sandbox to load kernel mode drivers into the operating system. (i guess it needs to load a driver) ]]> This could compromise security. Do any other browsers use or install kernel mode drivers?

giorom60:

Wed Sep 03, 2008 1:47 pm

]]>Quoting SnDPhoenix: ]]> On a side note though, I dont know why you guys need to load drivers for it to run properly, it should just work automatically out of the box. Actually, better question, is how does it work fine for me? :shock: ]]> That is an interesting question and I would like to know the answer, but I can only confirm that if I uncheck the option to allow kernel mode drivers Chrome does not work. Concerning the sand boxing technology issue, if you look at the Chrome presentation at http://blogoscoped.com/google-chrome/ (from page 26) it is clear that Chrome includes some kind of policy based sand boxing functionality (with a big hole related to the fact that plugins are not sandboxed)

SnDPhoenix:

Wed Sep 03, 2008 1:10 pm

Hmm btw, contrary to my above post, it seems Chrome does use sandboxing! :shock: There are two things listed in an article that imply sandboxing. First: [quote:ef74524e66]The Incognito window, which is Google Chrome's privacy mode, is also a key feature that Goodger explained was meant to keep stuff off a users computer so sites won't appear in history and cookies aren't saved.[/quote:ef74524e66] Now this doesnt actually say chrome uses sandboxing, but "to keep stuff off a users computer" seems to imply sandboxing. Secondly: [quote:ef74524e66]Fischer explained that prior to Chrome for a bad guy to get onto your PC all an attacker had to do was to find a bug in the rendering engine. "With Google Chrome they have to find a bug and then find [b:ef74524e66]a bug in the sandbox[/b:ef74524e66] to get out," Fischer said.[/quote:ef74524e66] So security wise it uses sandboxing. Is this why people seem to have a hard time sandboxing the browser? Since your technically installing a sandbox in a sandbox?

Guest10:

Wed Sep 03, 2008 12:53 pm

A vulnerability in Chrome has already shown up: [url=http://www.theregister.co.uk/2008/09/03/google_chrome_vuln/]Carpetbomb bug tarnishes Google Chrome[/url]

SnDPhoenix:

Wed Sep 03, 2008 12:48 pm

]]>Quoting giorom60: ]]>The question is: does this reduces somehow the level of security of Sandoxie? ]]> YES! You're allowing any drivers (actually, kernel drivers, even worse...) to load unsandboxed. Now for something like Chrome browser, you'd be safe since Google is not malicious, however, if you run a malicious program in that sandbox that uses a kernel driver, it is going to load unsandboxed and could take over your PC. Be careful. On a side note though, I dont know why you guys need to load drivers for it to run properly, it should just work automatically out of the box. Actually, better question, is how does it work fine for me? :shock: Also about this sandboxing issue, no Googles chrome does not have sandboxing builtin. They acquired greenborder some time ago, but we all know they discontinued it, so I doubt they'd use its technology in their browser. However, that aside, when they say "sandboxing" they dont mean that what the browser does wont affect your PC, it is like what tzuk said [url=http://www.sandboxie.com/phpbb/viewtopic.php?p=26136#26136]here[/url], all they mean is that each window/tab is running in its own memory, process, etc.. which can be thought of as each tab being "sandboxed" away from the other tabs. Which is why if you go to a site in one tab and it causes a hang, you can just close that tab without the other tabs hanging and/or crashing. Doubt that the tabs are actually "sandboxed" though, which would imply there is some kind of isolation away from the PC...

MitchE323:

Wed Sep 03, 2008 11:48 am

Guest105:

Wed Sep 03, 2008 9:50 am

Google Chrome is probably using its own sandbox, I remember they acquired Green Border sandbox application some time ago.

giorom60:

Wed Sep 03, 2008 9:12 am

]]>Quoting xellos: ]]>hm found out how to get it to work but .. i dont like it , under sandboxie options you need to check low-level access -> Permit programs in this sandbox to load kernel mode drivers into the operating system. (i guess it needs to load a driver) ]]> This solution works also for me. The question is: does this reduces somehow the level of security of Sandoxie?

xellos:

Wed Sep 03, 2008 8:41 am

hm found out how to get it to work but .. i dont like it , under sandboxie options you need to check low-level access -> Permit programs in this sandbox to load kernel mode drivers into the operating system. (i guess it needs to load a driver)

giorom60:

Wed Sep 03, 2008 8:40 am

Not working here (Windows XP home SP3). I tried both to install Chrome sandboxed (installation OK but then not working) and unsandboxed (works fine if executed unsandboxed but same behavior if executed sandboxed, it does not load any page) Here is the resource access monitor log: (Drive) \Device\CdRom0 (Drive) \Device\HarddiskVolume1 (Drive) \Device\HarddiskVolume2 (Drive) \Device\HarddiskVolume3 (Unk) 00000022 \Device\SandboxieDriverApi (Unk) 00000022 \Device\WMIDataDevice (Unk) 00000039 \Device\KsecDD (Unk) 000000F1 \Device\RasAcd Clsid ------------------------------- Ipc ------------------------------- Ipc \BaseNamedObjects\c:!documents and settings!giancarlo!impostazioni locali!dati applicazioni!google!chrome!application!chrome.exe Ipc \BaseNamedObjects\ChromeStats Ipc \BaseNamedObjects\ChromeStatslock Ipc \BaseNamedObjects\oleacc-msaa-loaded Ipc \BaseNamedObjects\SbieDllDummyEvent_2484 Ipc \BaseNamedObjects\SbieDllDummyEvent_3148 Ipc \BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D} Ipc \BaseNamedObjects\shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57} Ipc \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1} Ipc \BaseNamedObjects\SynTPFcsMemMap Ipc \BaseNamedObjects\SynTPFcsMutex Ipc \BaseNamedObjects\UrlZonesSM_Giancarlo Ipc \BaseNamedObjects\ZoneAttributeCacheCounterMutex Ipc \BaseNamedObjects\ZonesCacheCounterMutex Ipc \BaseNamedObjects\ZonesCounterMutex Ipc \BaseNamedObjects\ZonesLockedCacheCounterMutex Ipc O \BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-1606980848-879983540-682003330-1005 Ipc O \BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-1606980848-879983540-682003330-1005 Ipc O \BaseNamedObjects\CTF.AsmListCache.FMPDefaultS-1-5-21-1606980848-879983540-682003330-1005 Ipc O \BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-1606980848-879983540-682003330-1005 Ipc O \BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-1606980848-879983540-682003330-1005 Ipc O \BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-1606980848-879983540-682003330-1005 Ipc O \BaseNamedObjects\CTF.ThreadMarshalInterfaceEvent.0000031C.00000000.0000000D Ipc O \BaseNamedObjects\CTF.ThreadMIConnectionEvent.0000031C.00000000.0000000D Ipc O \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-1606980848-879983540-682003330-1005MUTEX.DefaultS-1-5-21-1606980848-879983540-682003330-1005 Ipc O \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-1606980848-879983540-682003330-1005SFM.DefaultS-1-5-21-1606980848-879983540-682003330-1005 Ipc O \BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-1606980848-879983540-682003330-1005 Ipc O \BaseNamedObjects\MSCTF.CheckThreadInptIdle.Event.ILJ.IABOK Ipc O \BaseNamedObjects\MSCTF.CheckThreadInptIdle.Event.ILJ.MGAOK Ipc O \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ILJ..IABOK Ipc O \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ILJ.B.IABOK Ipc O \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ILJ.C.IABOK Ipc O \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ILJ.D.IABOK Ipc O \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ILJ.E.IABOK Ipc O \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ILJ.F.IBBOK Ipc O \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ILJ.G.IBBOK Ipc O \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MBD.KC.IBBOK Ipc O \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MBD.LC.IBBOK Ipc O \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MBD.MC.IBBOK Ipc O \BaseNamedObjects\MSCTF.SendReceive.Event.MBD.IC Ipc O \BaseNamedObjects\MSCTF.SendReceiveConection.Event.MBD.IC Ipc O \BaseNamedObjects\MSCTF.Shared.MUTEX.MBD Ipc O \BaseNamedObjects\MSCTF.Shared.SFM.MBD Ipc O \BaseNamedObjects\Sandboxie_DeviceIdList Ipc O \BaseNamedObjects\Sandboxie_DeviceSetupClasses Ipc O \BaseNamedObjects\ShimCacheMutex Ipc O \BaseNamedObjects\ShimSharedMemory Ipc O \KnownDlls\advapi32.dll Ipc O \KnownDlls\appHelp.dll Ipc O \KnownDlls\gdi32.dll Ipc O \KnownDlls\iertutil.dll Ipc O \KnownDlls\kernel32.dll Ipc O \KnownDlls\msvcrt.dll Ipc O \KnownDlls\NETAPI32.dll Ipc O \KnownDlls\ole32.dll Ipc O \KnownDlls\oleaut32.dll Ipc O \KnownDlls\rpcrt4.dll Ipc O \KnownDlls\Secur32.dll Ipc O \KnownDlls\shell32.dll Ipc O \KnownDlls\SHLWAPI.dll Ipc O \KnownDlls\user32.dll Ipc O \KnownDlls\version.dll Ipc O \KnownDlls\wldap32.dll Ipc O \LsaAuthenticationPort Ipc O \NLS\NlsSectionCType Ipc O \NLS\NlsSectionLocale Ipc O \NLS\NlsSectionSortkey Ipc O \NLS\NlsSectionSortTbls Ipc O \NLS\NlsSectionUnicode Ipc O \RPC Control\SbieSvcPort Ipc O \Security\LSA_AUTHENTICATION_INITIALIZED Ipc O \ThemeApiPort Ipc O \Windows\ApiPort Ipc X \BaseNamedObjects\Anvir_HookShared1 Ipc X \BaseNamedObjects\FdMe Pipe ------------------------------- Pipe \Device\NamedPipe\chrome.2484.f859d0.661260106 Pipe \Device\NamedPipe\GoogleCrashServices\S-1-5-21-1606980848-879983540-682003330-1005 Pipe O \Device\Afd Pipe O \Device\Afd\Endpoint Pipe X \Device\NamedPipe\chrome.2484.f859d0.661260106 Pipe X \Device\NamedPipe\GoogleCrashServices Pipe X \Device\NamedPipe\GoogleCrashServices\S-1-5-21-1606980848-879983540-682003330-1005 Pipe X \Device\NamedPipe\lsarpc Pipe X \Device\NamedPipe\wkssvc WinCls ------------------------------- WinCls O Shell_TrayWnd WinCls X (unknown) WinCls X AnVirMainFrame WinCls X Chrome_MessageWindow WinCls X Progman WinCls X ROCKETDOCK WinCls X SUPERANTISPYWARE

dynarx: Chrome installation

Wed Sep 03, 2008 5:36 am

I found that GC would install into SB only when my AV (BitDefender9) was disabled - but then it wouldn't talk. Doh. It's gone for now. :) Dynarx

Chromer:

Wed Sep 03, 2008 5:19 am

This is the installer file http://www.mediafire.com/?sharekey=badf528d4394dfa9ab1eab3e9fa335caf986a560f9eddb06

macman: google browser

Wed Sep 03, 2008 5:06 am

I'm running XP with sandboxie 3.30. Google browser won't run snadboxed on my machine either

xellos:

Wed Sep 03, 2008 3:50 am

doesnt work for me either. :)

MitchE323:

Tue Sep 02, 2008 11:00 pm

Strange, I tried it every way that I could and still no good - but I was only confirming anyway, it's gone now.

SnDPhoenix:

Tue Sep 02, 2008 10:33 pm

And so, the Google takeover begins... They have their Google OS, now they have their browser. On a side note, I got it working fine in v3.30 for me as well...

Bob Smith:

Tue Sep 02, 2008 9:29 pm

Oddly enough, after upgrading to 3.30 (to use the resource monitor), Google Chrome is now working fine in the sandbox. Also, this restarted Firefox and Windows Live Messenger, both of which were running in other sandboxes. Perhaps this fixed it.

MitchE323:

Tue Sep 02, 2008 9:13 pm

Same here with Sandboxie 3.30 on XP. Bob, you might want to run the Resource Access Monitor and post your results here. I could post mine but it should be applicable to your machine. A curious thing I noticed was that UNsandboxed, the Task Manager shows two instances of Chrome.exe running after you start the browser. There is only one Chrome.exe with the installation.

huukiller29a:

Tue Sep 02, 2008 9:11 pm

i am using the version 3.30

huukiller29a:

Tue Sep 02, 2008 9:11 pm

I had the same problem, inside the sandboxie chrome does not work =/ It wanted to know the because of not working =/

Bob Smith: Google Chrome

Tue Sep 02, 2008 8:27 pm

I just installed Google's new web browser, Google Chrome (http://www.google.com/chrome/). Running chrome outside of sandboxie, everything works fine. Inside sandboxie, I cannot navigate to any web page. Sometimes the tab stays blank, sometimes I get a generic error message, and sometimes I get a message telling me that the tab is not responding. This happens both if 'This program is the only program that can access the internet' is on or off. I'm running Sandboxie version 3.24.