Sandboxie Support

additional on the dropright feature
so a user can choose to use low integrity level instead of medium integrity (if UAC is tuned On)

No, that can't work. Low integrity level means a program can't access anything and is supposed to be designed so another process does the "sensitive" stuff on its behalf. For example, a low integrity IE tab process uses the medium integrity IE main process.

tzuk wrote:No, that can't work. Low integrity level means a program can't access anything and is supposed to be designed so another process does the "sensitive" stuff on its behalf. For example, a low integrity IE tab process uses the medium integrity IE main process.

Perhaps there could be a way to manage that.

I run Chromium with an explicit low integrity level. That is, both the broker and children processes run with a low integrity level. It's possible to use it as normal, one just needs to set certain places to a low integrity level as well, so that we can download files, for example.

But, that aside, even if I just set Chromium to a low integrity level only, and nothing else, by running Chromium inside Sandboxie, I can download, etc just fine. Sandboxie functions as the broker "process" (medium integrity).

Perhaps you could work something around that?

I don't have any plans to add this feature into Sandboxie at this time.

But since you say that you can start Chrome in the sandbox with low integrity, then I'm not sure why you need Sandboxie to address this issue in some way.

However, if you explain here how to start programs in the sandbox with low integrity, and if some months from now, enough people report that they've been regularly using this and not seeing any problems with most programs, then I might add something like this similar to Drop Rights.

tzuk wrote:[...]
But since you say that you can start Chrome in the sandbox with low integrity, then I'm not sure why you need Sandboxie to address this issue in some way.[...]

Oh, I don't need Sandboxie to do that. I can do it on my own. ;D

I just thought of mentioning it, due to Blasev's request. Nothing else, really.

Thx for the straight answer tzuk

I was thingking that I can use other internet browser with low integrity to add another layer of protection. But it seem it won't be necessary for now