WIN 10 1703/1709 SB v 5.22 and Beta 5.23.3 Forced Folder Behavior

[Needaname]

Hello everybody.

There is a strange issue with the forced folders settings. If you open a forced folder on a networkshare (i.e. \\fileserver\newfolder) directly in windows explorer, the settings work as intended. Only the programs/files opened in the folder start sandboxed. If you open it with %systemroot%\explorer.exe \\fileserver\newfolder the whole folder opens sandboxed. This didn't happen before. Unfortunately i can't recall what causes this behavior or since when. Closest is before the start of december 2017 and i'm pretty sure its caused by a windows update. Reasons are Sandboxie wasn't updatet since october 2017 and it doesn't happen on windows 7.

Best regards,
needaname

Ressource-montior:
Clsid -------------------------------
File/Key -------------------------------
Image -------------------------------
Ipc -------------------------------
Ipc \BaseNamedObjects\[CoreUI]-PID(4328)-TID(10628) 1de54a72-4601-44cc-9e6b-92db8b96e422
Pipe -------------------------------
WinCls -------------------------------

[Barb@Invincea]

Hello Needaname,

I cannot reproduce this behavior with network shares nor with local drives. Can you please provide more information as well as a copy of your Sandboxie configuration file?
(Configure--> Edit configuration. Copy/paste the contents here , highlight them and click on the "</>" button for formatting purposes).

Are you able to reproduce this in a new Sandbox with default settings? (you will need to disable the force folder setting from the previous one).

Regards,
Barb.-

[Needaname]

Hello again.

Sorry for the late response. Anyway here is the sandboxconfig. I had to remove the forcedfolder-paths due to company-restrictions. Same goes for usernames.

Code: Select all

[GlobalSettings]

Template=WindowsRasMan
Template=7zipShellEx
Template=WindowsLive
Template=OfficeLicensing
ForceDisableSeconds=1800
ActivationPrompt=n

[DefaultBox]

ConfigLevel=7
BlockPort=22,137-139,445
AutoRecover=y
BlockNetworkFiles=n
Template=Firefox_Session_DirectAccess
Template=Firefox_Passwords_DirectAccess
Template=Firefox_Cookies_DirectAccess
Template=Firefox_Bookmarks_DirectAccess
Template=Firefox_Force
Template=qWave
Template=WindowsFontCache
Template=LingerPrograms
Template=Chrome_Phishing_DirectAccess
Template=Firefox_Phishing_DirectAccess
Template=AutoRecoverIgnore
RecoverFolder=I:
RecoverFolder=P:
RecoverFolder=K:
RecoverFolder=E:
RecoverFolder=D:
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
RecoverFolder=%Personal%
RecoverFolder=%Favorites%
RecoverFolder=%Desktop%
BorderColor=#00FFFF,ttl
Enabled=y
ForceFolder=
ForceFolder=
ForceFolder=
ForceFolder=
ForceFolder=
ForceFolder=
ForceFolder=
ForceFolder=
ForceFolder=
BoxNameTitle=n

[UserSettings_0C02020A]

SbieCtrl_UserName=
SbieCtrl_BoxExpandedView=DefaultBox
SbieCtrl_ShowWelcome=n
SbieCtrl_NextUpdateCheck=1508138960
SbieCtrl_UpdateCheckNotify=n
SbieCtrl_WindowCoords=197,163,660,450
SbieCtrl_ActiveView=40021

[UserSettings_25D403C9]

SbieCtrl_UserName=
SbieCtrl_ShowWelcome=n
SbieCtrl_NextUpdateCheck=1510742353
SbieCtrl_UpdateCheckNotify=y
SbieCtrl_AutoApplySettings=n
SbieCtrl_WindowCoords=579,108,1237,670
SbieCtrl_ActiveView=40021
SbieCtrl_RecoverTarget=E:\
SbieCtrl_SaveRecoverTargets=y
SbieCtrl_BoxExpandedView=DefaultBox
SbieCtrl_ShouldDeleteNotify=n
SbieCtrl_HideWindowNotify=n

Kind Regards,
Needaname

edit: Now it happens with Windows 7 too. To be more specific about the exact problem:
If you open the forced folder "normally" by double clicking it everything works as intended. If you open it with a .bat-file like :
%systemroot%\eplorer.exe \\forcedfolderpath
or by typing this line into cmd/windows explorer, the whole folder opens sandboxed.

[Barb@Invincea]

Hello Needaname,

I re-tested using cmd and a bat file, I did not see the behavior you are seeing.

I cannot analyze your logs without the forced folder information. Can you re-upload it with fake names /letters/ ip addresses ? I really need to understand what kind of setup you are using since I cannot reproduce this behavior. Be sure to keep whatever relation is involved between the folders (if they have similar names, or belong in the same path, etc... ).

Maybe you are invoking a folder that resides inside a forced folder ?
Example:
Force folder---> \\yourpath\Folder1
Folder inside forced folder---> \\yourpath\Folder1\Folder2

If you launch Folder1 it will not open Sandboxed, but if you invoke Folder2 via explorer/bat/cmd it wil open Sandboxed as it is inside Folder1 (which is forced).

Regards,
Barb.-

[Needaname]

Hello Barb.

Folder inside forced folder---> \\yourpath\Folder1\Folder2

Excatly this is the case.

If you launch Folder1 it will not open Sandboxed, but if you invoke Folder2 via explorer/bat/cmd it wil open Sandboxed as it is inside Folder1 (which is forced).

I'm sure it wasn't like this before (~until december 2017) and there wasn't a sandboxie update in this time.
I used v5.22 the whole time and this changed "over night". So my prediction is, it changed because of an update for Windows.

But if this is how the forced folders should behave now, like u say, then I'm really sorry for wasting your time.

Best Regrads,
Needaname

[Barb@Invincea]

Hello Needaname,

We do not push changes "overnight" to Sandboxie. Users will either receive a new release version, or manually download a beta from the beta section.
I am not seeing how this Force Folder behavior is an issue, there were changes made on beta 5.21.6 that improved the Forced Folder functionality:
viewtopic.php?f=62&t=24741

Here's the Force Folder entry:
https://www.sandboxie.com/ForceFolder

Regards,
Barb.-

[Needaname]

Code: Select all

We do not push changes "overnight" to Sandboxie

I know that. And thats why I wrote:

Code: Select all

So my prediction is, it changed because of an update for Windows.

I'm just curious what caused this change of behavior. I can confirm that it wasn't the case "before"(until december 2017) and i would appreciate to have the old functionality back.
To explane this:

We have a special email-attachment-solution at our company. If a user gets an email with attachment, the attachment is saved to a folder and the user recieves an email with a link to this folder. The link is %systemroot%\explorer.exe \\forcedfolder\%username% because every employee has its own personalised folder. All these personalised folders are within a forced folder.
If the user opens the recieved file it opens sandboxed because it is inside a forced folder. But if he/she wants to copy&paste, drag&drop or attach the file to the email again, he/she could do it without restrictions caused by the sandbox because the folder didn't open sandboxed. So you had a safe way to open the file but could also process it conveniently.
Now the whole folder opens sandboxed which causes trouble by processing files to unsandboxed programms or folders. Thats it.

Regards,
Needaname

[Barb@Invincea]

Hello Needaname,

At this point, the feature is working as intended (after the changes I provided above were applied).
However, I have made the devs aware of your request/situation.

I'll update this thread if anything new comes up.

Regards,
Barb.-