sandboxie-plus/Sandboxie

Installing the Firefox browser in an application compartment type sandbox with FakeAdminRights, the installation terminates before it's complete.

Open

#2783 opened on Apr 2, 2023

View on GitHub
 (1 comment) (0 reactions) (0 assignees)C (18,328 stars) (1,985 forks)batch import
Box: GreenHelp WantedIssue: ReproducedToDo

Description

Describe what you noticed and did

  1. Try to install Firefox to application compartment type sandbox with FakeAdminRights enabled.
  2. Installation end after the extraction of the files.

Fails:

NoSecurityIsolation=y
DropAdminRights=y
FakeAdminRights=y

Fails:

NoSecurityIsolation=y
DropAdminRights=n
FakeAdminRights=y

Works:

NoSecurityIsolation=n
DropAdminRights=y
FakeAdminRights=y

Works:

NoSecurityIsolation=n
DropAdminRights=n
FakeAdminRights=y

Works:

NoSecurityIsolation=n
DropAdminRights=n
FakeAdminRights=n

Works:

NoSecurityIsolation=y
DropAdminRights=n
FakeAdminRights=n

Works:

NoSecurityIsolation=y
DropAdminRights=y
FakeAdminRights=n

Works:

NoSecurityIsolation=n
DropAdminRights=y
FakeAdminRights=n

How often did you encounter it so far?

Every time

Affected program

Firefox Setup *.exe

Download link

https://ftp.mozilla.org/pub/firefox/releases/111.0.1/win64/en-US/Firefox%20Setup%20111.0.1.exe

Where is the program located?

I tried to install it only inside a sandbox, but I wasn't able to achieve it.

Expected behavior

It should work just like any other sandbox type.

What is your Windows edition and version?

Windows 10 Pro 22H2 64-bit (19045.2728)

In which Windows account you have this problem?

User account with UAC protection set to Always notify.

Please mention any installed security software

Microsoft Windows Defender

What version of Sandboxie are you running?

Sandboxie-Plus 1.5.3-1.8.2a

Is it a new installation of Sandboxie?

I recently did a new clean installation.

Is it a regression?

No response

In which sandbox type you have this problem?

In an Application Compartment sandbox with no isolation (green sandbox icon).

Can you reproduce this problem on a new empty sandbox?

I can confirm it also on a new empty sandbox.

Did you previously enable some security policy settings outside Sandboxie?

No response

Crash dump

No response

Trace log

No response

Sandboxie.ini configuration

NoSecurityIsolation=y
FakeAdminRights=y

Contributor guide

Tech stack
c
Domain
securitydesktop
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Windows sandboxing conceptsC programmingFamiliarity with Sandboxie architecture
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
35
Research direction
Investigate the code in Sandboxie that handles installation processes within application compartment sandboxes, focusing on the interaction between NoSecurityIsolation and FakeAdminRights flags. The bug occurs when both are set to 'y', causing installation to terminate after file extraction. Look for conditional logic that might incorrectly skip post extraction steps. Examine source files related to process creation and sandbox initialization, particularly around dropping admin rights. Check the GitHub issue for any maintainer comments or additional context.