www.sandboxie.com :: View topic - Experimental Protection [64-bit]

Posted: Wed Apr 06, 2011 12:53 pm

n1 wrote:

is the user left free to choose whether to use this feature or not, am i wrong?

The user can enable or disable it.

Posted: Wed Apr 06, 2011 2:48 pm

@D1G1T@L: Oh well, thanks for the reply. With over 300 million Windows 7 licenses sold, I don't imagine they're too concerned about a few Sandboxie users.

Posted: Wed Apr 06, 2011 3:21 pm

tzuk wrote:

1. There is no kernel mode protection for use of the EndTask API to terminate processes outside the sandbox.

_Harry_ wrote:

Excellent work indeed. I thought that was an April fools joke someone posted on another forum, but luckily its true!

I think that the very small differences are not a big deal at all. If its possible to know when an EndTask API call is directed to an unsandboxed process, maybe Sbie could also cancel anything that attempts to do this instead of blocking this request directly since thats not supported.

Could this work? If not, can tzuk or anyone please explain why. I have no idea how to code so I'm asking. Just curious thats all.

Posted: Wed Apr 06, 2011 8:33 pm

DuckTales wrote:

My admin account that I use all the time (got no other account on the computer) got no password, does this mean a virus can lock me off from my own computer by setting a password?

(I'm not using a password because I want my computer to boot faster by login in right away)

I'm not qualified to answer your question directly, but here's a suggestion. Set a password, which is good practice anyway, and then enable auto-login.

Posted: Wed Apr 06, 2011 11:52 pm

Easier to just use Autologon from Sysinternals.

Edit:
And if you want to be really slick, then try THIS. I schedule the script to run this way though -

1) open Group Policy Editor (gpedit.msc)
2) User Configuration -> Windows Settings -> Scripts (Logon/Logoff)
3) Open Logon and add your script

Posted: Thu Apr 07, 2011 12:57 am

I see there is some interest in the EndTask thing. As I said Sandboxie does what it can by supervising this at the user mode / application level. Supervising this at the kernel level is not possible on 64-bit Windows, except perhaps by messing with the system csrss.exe processes, which would then cause other security software to rightly say that Sandboxie is a saboteur.

Other than that I refer you to D1G1T@L's closing statement of an earlier post in this topic.

Posted: Fri Apr 08, 2011 7:20 am

Seems to be running OK on Vista 64-bit.

I am more than happy with the extra protection provided.

Posted: Fri Apr 08, 2011 4:15 pm

Ok thanks for the reply. One last thing I want to know, in this case could Endtask be used to shutdown or crash the system deliberately?

Posted: Sat Apr 09, 2011 1:00 pm

KBFloYd wrote:

Ok thanks for the reply. One last thing I want to know, in this case could Endtask be used to shutdown or crash the system deliberately?

I don't think so, at least Matousec kill5 can only kill processes with a window.
Unlikely to happen.

Posted: Sat Apr 09, 2011 4:57 pm

tzuk wrote:

In version 3.55.01, Sandboxie still enables Drop Rights by default on 64-bit Windows, but I plan to change this behavior in version 3.55.02, when 64-bit Experimental Protection is enabled.

Maybe you haven't gotten around to this yet, but I have experimental protection enabled on 3.55.02 and when I create a new sandbox, Drop Rights is still enabled by default.

wraithdu wrote:

And if you want to be really slick, then try THIS. I schedule the script to run this way though ...

Good tip. Very slick.

Posted: Sat Apr 09, 2011 5:19 pm

Mike wrote:

when I create a new sandbox, Drop Rights is still enabled by default.

Yep, I noticed this myself. Razz

Posted: Sat Apr 09, 2011 5:56 pm

Yeah, I didn't get around to addressing that Drop Rights thing yet. Still planning to take care of it though.

Posted: Mon Apr 11, 2011 9:02 pm

Alright so I will repost this here for informational purposes to add info that might anwser other similar future questions. Tzuk I thought you'd move the posts either way nvm now Smile

SnDPhoenix wrote:

Hmm, ok, so it seems Sandboxie is too sensitive right now as it's terminating simple installers.
May I ask though, whats the point in terminating a process that's trying to access/mis-use a particular resource? If Sandboxie is able to prevent a program from abusing some resource, then whats the problem? Why not just let Sandboxie handle the programs access/use of some particular resource, instead of just outright terminating the process, what does that achieve?

P.S.
A quick question. If x64 Sandboxie is unable to deny programs from accessing resources, then how come denying programs access to the internet still works?

My reply:

Me wrote:

Sandboxie relies on closed file paths to deny programs internet access rather than use closed IPC paths. Thats why in this case the Kernel would support actual blocking of file access, but in the case of IPC, according to Tzuk this can't be accomplished so instead the process is blocked from running so it can't misuse the potentially poweful resource. Thats a very smart approach if you think about it an excellent way to make ends meet.

So just for the sake of discussion, are things like internet access/ ports and the EndTask API (mentioned many times already) not reliant on IPC?

Posted: Mon Apr 11, 2011 9:53 pm

D1G1T@L wrote:

Tzuk I thought you'd move the posts either way nvm now

To answer your (plural) questions about program termination. There is a protection layer at the application level and there is a protection level on the kernel level. Normally a program never reaches the kernel level with a request that Sandboxie would have to block.

If this does happen then the program must have messed with the protection at the application level. (The exception of course is when the new kernel protection is still new and a bit buggy, and wrongly terminates programs in some cases.)

Now on 32-bit Windows, even if a program can bypass the protection at the application level, Sandboxie is able to completely prevent the program from accessing the resource.

On 64-bit Windows, Sandboxie cannot completely prevent the program from accessing the resource, it can only tell Windows to not let the program do anything with the resource. This is a fine distinction which probably makes zero difference in practical terms. But again the program is never supposed to be in this situation unless something wrong happened to the protection at the application level. Therefore I feel it is reasonable to terminate the program at this point.

As for EndTask, this is not a standalone resource in the system that you can allow or deny access to. It is one of many possible requests on a main channel between a program and the CSRSS process. In other words it is a sequence of bytes going into one end of some communication channel, and causing CSRSS to end programs. It is not possible to supervise what goes into this channel, as with other necessary things, there are no supported kernel interfaces for doing something like this.

So hopefully this finally clarifies everything for everyone.

Posted: Mon Apr 11, 2011 11:14 pm

tzuk wrote:

If this does happen then the program must have messed with the protection at the application level. (The exception of course is when the new kernel protection is still new and a bit buggy, and wrongly terminates programs in some cases.)

Does that explain why firefox 4 keep on crashing while using 3.55.02?
I use win 7 64bit btw
Hopefully the problem will be gone with 3.55.03 Smile