Yes, previously the 'Everyone' (S-1-1-0) rules worked for dlls and exes in Program Files or Windows\System32 & SysWOW64
eg
Code: Select all
<FilePathRule Id="297fce9c-3f54-4403-ad73-47576f2f64d3" Name="(Default Rule) Windows DLLs" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
<Conditions>
<FilePathCondition Path="%WINDIR%\*" />
</Conditions>
</FilePathRule>
was fine. As I found
however (previously) they didn't work with specific users though that's a bit offtopic.
But suddenly with 5.15.3 they were being blocked and resulting in even Sandboxies own exes running inside being unable to load the dlls and in turn the errors reported above being shown in SbieCtrl.
Here's a couple sample Event Log errors:
Code: Select all
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-AppLocker" Guid="{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}" />
<EventID>8004</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2016-11-04T19:11:32.170424000Z" />
<EventRecordID>88832</EventRecordID>
<Correlation />
<Execution ProcessID="1328" ThreadID="2144" />
<Channel>Microsoft-Windows-AppLocker/EXE and DLL</Channel>
<Computer>SNIPPED</Computer>
<Security UserID="SNIPPED" />
</System>
- <UserData>
- <RuleAndFileData xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0">
<PolicyName>DLL</PolicyName>
<RuleId>{00000000-0000-0000-0000-000000000000}</RuleId>
<RuleName>-</RuleName>
<RuleSddl>-</RuleSddl>
<TargetUser>S-1-5-7</TargetUser>
<TargetProcessId>1328</TargetProcessId>
<FilePath>%SYSTEM32%\MSVCR100.DLL</FilePath>
<FileHash />
<Fqbn>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT® VISUAL STUDIO® 2010\MSVCR100_CLR0400.DLL\10.0.40219.325</Fqbn>
</RuleAndFileData>
</UserData>
</Event>
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-AppLocker" Guid="{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}" />
<EventID>8004</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2016-11-04T19:11:04.261975300Z" />
<EventRecordID>88757</EventRecordID>
<Correlation />
<Execution ProcessID="1164" ThreadID="2364" />
<Channel>Microsoft-Windows-AppLocker/EXE and DLL</Channel>
<Computer>SNIPPED</Computer>
<Security UserID="SNIPPED" />
</System>
- <UserData>
- <RuleAndFileData xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0">
<PolicyName>DLL</PolicyName>
<RuleId>{00000000-0000-0000-0000-000000000000}</RuleId>
<RuleName>-</RuleName>
<RuleSddl>-</RuleSddl>
<TargetUser>S-1-5-7</TargetUser>
<TargetProcessId>1164</TargetProcessId>
<FilePath>%SYSTEM32%\IMM32.DLL</FilePath>
<FileHash />
<Fqbn>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT® WINDOWS® OPERATING SYSTEM\IMM32\6.1.7600.16385</Fqbn>
</RuleAndFileData>
</UserData>
</Event>
Adding just DLL rules for ANONYMOUS LOGON then caused events like this to be logged and a different set of errors:
Code: Select all
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-AppLocker" Guid="{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}" />
<EventID>8004</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2016-11-04T19:15:56.072295000Z" />
<EventRecordID>89027</EventRecordID>
<Correlation />
<Execution ProcessID="2276" ThreadID="2440" />
<Channel>Microsoft-Windows-AppLocker/EXE and DLL</Channel>
<Computer>SNIPPED</Computer>
<Security UserID="SNIPPED" />
</System>
- <UserData>
- <RuleAndFileData xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0">
<PolicyName>EXE</PolicyName>
<RuleId>{00000000-0000-0000-0000-000000000000}</RuleId>
<RuleName>-</RuleName>
<RuleSddl>-</RuleSddl>
<TargetUser>S-1-5-7</TargetUser>
<TargetProcessId>3456</TargetProcessId>
<FilePath>%PROGRAMFILES%\SANDBOXIE\SANDBOXIEDCOMLAUNCH.EXE</FilePath>
<FileHash />
<Fqbn>O=INVINCEA, INC., L=FAIRFAX, S=VIRGINIA, C=US\SANDBOXIE\SANDBOXIEDCOMLAUNCH.EXE\5.15.3.00</Fqbn>
</RuleAndFileData>
</UserData>
</Event>
SBIE2204 Cannot start sandboxed service DcomLaunch (1260)
So after adding 2 rules for ANONYMOUS LOGON to both the EXE and DLL rules in addition to the existing EVERYONE (S-1-1-0) rules for Program Files & the Windows folders, AppLocker was once again allowing them to launch.
This is more like what I experienced before with specific user rules and other areas but for some reason the EVERYONE rule worked for those areas before but now it doesn't.
Either way it's not a complaint and
I'm unsure if there is even anything to correct. As I said in the last post, now at least things are much more
constant in the way AppLocker handles the paths/rules and detection of ANONYMOUS LOGON. It was just weird that in one version it worked without the extra rules and one suddenly needed them.
