Prevent application from restarting computer

[Domochevsky]

Can this already be done? I basically don't want any application inside of a sandbox to automatically restart the computer without explicit consent by any means.

[Craig@Invincea]

Usually programs give you the option to restart now / restart later.

[Domochevsky]

Usually, yes. In this case it didn't, deeming itself too important to wait.

[Curt@invincea]

The Sbie code specifically allows sandboxed apps to restart/shutdown the system. I don't know the history on why this was done. Has it been discussed in the past? What are the views of the users?

[btm]

I don't see why a sandboxed program should be able to do this. In most instances a reboot is needed to finish a driver/service install which doesn't work within sbie anyhow.... Perhaps some timed/event driven auto shut down app might have a legit reason to do so but I'd prefer to have a choice to explicitly enable this (eg setting) for a specific sandbox but have it disabled by default. Failing that, IMO, block it entirely.. :-/

[Domochevsky]

I would also prefer to have a per-sandbox option for this, disabled by default. There is very little legitimate reason for a sandboxed application to restart the host system, as said.

[Dun]

+1 to prevent by default

[BatmanCatman]

I also totally think programs should be prevented from restarting the computer by default. Maybe a message should pop up asking "Chrome wants to restart your computer. Should we allow it?" then with options of Yes and No?

[Laitues]

+1 for this.

[Curt@invincea]

Can this already be done? I basically don't want any application inside of a sandbox to automatically restart the computer without explicit consent by any means.

One of our new developers has been looking into this. From the post above, and looking at the code, I assumed that sandboxed apps were being allowed to reboot/shutdown the machine. But apparently, Sbie was already blocking this. The hook code in Sbie that I thought was allowing this apparently is dead code from a time long past.

So according to our testing, Sbie is already blocking this. Sandboxed apps cannot reboot/shutdown the machine.

[Syrinx]

Thanks for the update, refreshing news. Now I'm confused though, I was using TeamViewer (sandboxed at the start) on Mr. X's PC the other day [he later removed the box so I could really hack him, erm um test things] and was able to reboot the pc (didn't try a shutdown) but I know it uses a service on the host [outside of the scope of SBIE] so that might explain it why it worked....nm!

[Mr.X]

Thanks for the update, refreshing news. Now I'm confused though, I was using TeamViewer (sandboxed at the start) on Mr. X's PC the other day [he later removed the box so I could really hack him, erm um test things] and was able to reboot the pc (didn't try a shutdown) but I know it uses a service on the host [outside of the scope of SBIE] so that might explain it why it worked....nm!

Now I understand why my computer started behaving so strange. Thankfully I have a full image backup to manage this things out

[Craig@Invincea]

Thanks for the update, refreshing news. Now I'm confused though, I was using TeamViewer (sandboxed at the start) on Mr. X's PC the other day [he later removed the box so I could really hack him, erm um test things] and was able to reboot the pc (didn't try a shutdown) but I know it uses a service on the host [outside of the scope of SBIE] so that might explain it why it worked....nm!

Now I understand why my computer started behaving so strange. Thankfully I have a full image backup to manage this things out

It could, if it had a valid request. If malware started to write, etc in the SB...say trying to write a new MBR (sandboxeds) and then rebooted....that's all that would happen. A reboot. As everything is contained in the SB.

But that's moot now.

[Klausel]

In my case a sandboxed app were still be able to perform a reboot and it was not malware. A normal installer that I've ran sandboxed where I forgot the tick off the mark "reboot now" after sandboxed installation.

[Craig@Invincea]

In my case a sandboxed app were still be able to perform a reboot and it was not malware. A normal installer that I've ran sandboxed where I forgot the tick off the mark "reboot now" after sandboxed installation.

If it's a valid reboot command, yes. If it was malware attempting to write and then reboot, it wouldn't matter. The "writing" is happening in the SB, which is gone when the computer reboots. The only harm is...you've rebooted. That's all..MBR, etc are not changed by a program that is running/writing in the SB.