Printing outside of Sandbox

[MS2001]

In order for me to be able to print from Firefox I have had to add the following lines to my firefox settings

OpenFilePath=firefox.exe,C:\Windows\Temp\SPL*
OpenFilePath=firefox.exe,C:\Windows\dellstat.ini

Is this an acceptable security risk ?

Also I have seen others recommend adding C:\WIndows as a Readonly file path I assume that this would override the above settings although I have not tested this

So is omiting this entry also an acceptable security risk

Thanks

[Barb@Invincea]

Hello MS2001,

What are your OS, Antivirus and Sandboxie versions?
What are you using to print? What errors were your receiving prior to opening those paths?

Here's a similar thread in which we suggested a user to open "C:\Windows\Temp\SPL*" :
http://forums.sandboxie.com/phpBB3/view ... nt#p124221

Regards,
Barb.-

[MS2001]

WIN7 64 Bit ESET NOD32 V 10.0.369 Sandboxie V 5.16 firefox V 51.0.1

I am printing using the firefox menu item the contents of a web page to a local printer (not PDF although I think the same problem is here also)
See attachment for error Note that after I double click th SBIE1320 message line the report can be found in the printer queue however it does not actually print unless I restart Windows All other non sandboxed reports are then held up even if I try to cancel the print job which doesnt actually happen Only thing to fix this is a windows restart

printing.JPG (47.65 KiB) Viewed 1886 times

[Barb@Invincea]

Hello MS2001,

If you are trying to print to pdf, there are different templates that you can use, depending on which application are you running.
As for "dellstat.ini" ---> I am not familiar with that file. Are you unable to print if you remove access to it?
[To test, remove it from your Sandbox, reload configuration, restart the print spooler service on your computer (that might save you the reboot), try printing again].

Regarding your second question (sorry I missed it the first time). Please see this entry:
https://www.sandboxie.com/index.php?ReadFilePath

Regards,
Barb.-

[MS2001]

Hello MS2001,

If you are trying to print to pdf, there are different templates that you can use, depending on which application are you running.
As for "dellstat.ini" ---> I am not familiar with that file. Are you unable to print if you remove access to it?
[To test, remove it from your Sandbox, reload configuration, restart the print spooler service on your computer (that might save you the reboot), try printing again].

I can print OK provided i include OpenFilePath=firefox.exe,C:\Windows\Temp\SPL* but I then get a second error mesage regarding the ini file
This is more of a nuisance so the reason for OpenFilePath=firefox.exe,C:\Windows\dellstat.ini is to just prevent the error message from displayiing

Do you think including these sandbox exceptions should be of concern or are the risks negligble

Regarding your second question (sorry I missed it the first time). Please see this entry:
https://www.sandboxie.com/index.php?ReadFilePath

What I would like to know here is whether omitting C:\WIndows as a Readonly file path is something that should be of concern or whether the risks are negligble ie a judgement call

Thanks


Regards,
Barb.-

[Barb@Invincea]

Hello MS2001 ,

OpenFilePath=firefox.exe,C:\Windows\Temp\SPL* ---> This is necessary in some cases to be able to print to files, etc, so it is fine to add to your Sandbox (you are punching a small hole in it, however).
OpenFilePath=firefox.exe,C:\Windows\dellstat.ini ---> What happens if you do not OpenFilePath for this one? What error do you receive?

We do not recommend changing settings for the C:\WIndows folder, unless necessary.
What are you trying to do, exactly?

Regards,
Barb.-

[MS2001]

"Barb@Invincea"]Hello MS2001 ,

OpenFilePath=firefox.exe,C:\Windows\Temp\SPL* ---> This is necessary in some cases to be able to print to files, etc, so it is fine to add to your Sandbox (you are punching a small hole in it, however).
OpenFilePath=firefox.exe,C:\Windows\dellstat.ini ---> What happens if you do not OpenFilePath for this one? What error do you receive?

Please see attachment

We do not recommend changing settings for the C:\WIndows folder, unless necessary.
What are you trying to do, exactly?

As I said in my first post I have seen in other threads that some people recommend to add C:\WIndows as a Readonly file path Can I take it that you do not think that this really necessary


MERGED POST
Cannot seem to upload the attachment
I get a 1319 Blocked spooler print to file .......\dellstat.ini follwed by a 1320 double click to allow etc

[Barb@Invincea]

Hello MS2001,

There is no real need to modify C:\Windows folder to read only. The default setting should work fine for you.

As for the errors, if you ignore them (try closing them), can you print?

Regards,
Barb.-

[MS2001]

I cannot print unless i either include the Openfilepath lines or I restart Windows because if I dont include the Openfilepath lines then the Print queue locks up regardless of whether I ignore or double click the 1320 error message

Thanks

[Barb@Invincea]

Hello MS2001,

So if you restart, it does print? If Sbie was blocking the file, it would not print at all.
Does printing outside Sbie work as expected from Firefox?

Try this, please:
Create a new Sandbox or clear the contents of the current one.
Send a file to your printer, from Firefox.
Double -click on a message if applicable.
If nothing prints, restart the printer Spooler (In Windows, type "Services", run as admin, find "Print Spooler", right-click on it--> restart).

Let us know if that works.

Regards,
Barb.-

[Curt@invincea]

I cannot print unless i either include the Openfilepath lines or I restart Windows because if I dont include the Openfilepath lines then the Print queue locks up regardless of whether I ignore or double click the 1320 error message

Thanks

This can occur if your print drivers/apps are not able to handle a STATUS_ACCESS_DENIED coming from the print spooler. If the user has access to the folder, they expect the spooler does as well, so they may not have coded for the denial. Manually clearing your print queue will probably fix the problem without rebooting.

Do not mess with c:\windows. And I don't see a reason to OpenFilePath=firefox.exe,C:\Windows\dellstat.ini unless this file is written to every time you print (which would require elevation as well). Your other opens are fine.

[MS2001]

I tried what you suggested When I try to print an entry appears in the print queue with a status as 'Printing'

I then get the 2 sandbox error messages I double click on the 2nd but nothing changes and I cannot print

I tried resstarting the print queue but again nothing changes The entry remains stuck in the print queue with a status as Printing ( I was in Admin mode)

I suppose I shall just need to add those opoen path lines

Thanks

[Barb@Invincea]

Hello MS2001,

You can leave those 2 paths open since you are restricting them to Firefox only.
It not a huge deal.

However, here's something else you can test (without opening the dellstat.ini path):
Run Firefox Sandboxed.
Try to print a file.
If you are presented with the SBIE message, double click on it accordingly.
After that, double click on your printer icon (system tray).
Find the file that attempted to print and cancel it.
Go back to Firefox and try to print the same file again.

Let us know if that works.

Regards,
Barb.-