Build 0.2.2 / 5.41.2

sandboxie-plus · Jun 19, 2020 · 3bb41c4 · 3bb41c4
1 parent 6112497
commit 3bb41c4
Show file tree

Hide file tree

Showing 24 changed files with 194 additions and 99 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,19 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [0.2.2 / 5.41.2] - 2020-06-19
+
+### Added
+- added option SeparateUserFolders=n to no longer have the user profile files stored separately in the sandbox
+- added SandboxieLogon=y it makes processes run under the SID of the "Sandboxie" user instead of the Anonymous user
+-- Note: the global option AllowSandboxieLogon=y must be enabled, the "Sandboxie" user account must be manually created first and the driver reloaded, else process start will fail
+- improved debugging around process creation errors in the driver
+
+### Fixed
+- fixed some log messages going lost after driver reload
+- found a workable fix for the MSI installer issue, see Proc_CreateProcessInternalW_RS5
+
+
 
 ## [0.2.1 / 5.41.1] - 2020-06-18
 

diff --git a/Sandboxie/common/my_version.h b/Sandboxie/common/my_version.h
@@ -22,7 +22,7 @@
 
 #define MY_VERSION_BINARY       5,41
 #define MY_VERSION_STRING       "5.41"
-#define MY_VERSION_STRING_EX	"5.41.1"
+#define MY_VERSION_STRING_EX	"5.41.2"
 
 // These #defines are used by either Resource Compiler, or by NSIC installer
 #define SBIE_INSTALLER_PATH		"..\\Bin\\"
@@ -36,6 +36,8 @@
 #define SANDBOXIE               L"Sandboxie"
 #define SBIE                    L"SBIE"
 
+#define SANDBOXIE_USER			L"Sandboxie"
+
 #define SBIE_BOXED_             SBIE L"_BOXED_"
 #define SBIE_BOXED_LEN          (4 + 7)
 

diff --git a/Sandboxie/core/dll/file.c b/Sandboxie/core/dll/file.c
@@ -368,6 +368,7 @@ _FX NTSTATUS File_GetName(
     static const ULONG _ShareLen = 7;
     static const WCHAR *_Drive = L"\\drive\\";
     static const ULONG _DriveLen = 7;
+
     static const WCHAR *_User = L"\\user";
     static const ULONG _UserLen = 5;
     static const WCHAR *_UserAll = L"\\user\\all";
@@ -376,7 +377,7 @@ _FX NTSTATUS File_GetName(
     static const ULONG _UserCurrentLen = 13;
     static const WCHAR *_UserPublic = L"\\user\\public";
     static const ULONG _UserPublicLen = 12;
-
+	
     THREAD_DATA *TlsData = Dll_GetTlsData(NULL);
 
     NTSTATUS status;
@@ -791,7 +792,8 @@ _FX NTSTATUS File_GetName(
     // that's ok because it hasn't been initialized yet
     //
 
-    else if (length >= _UserLen &&
+    else if (//SbieApi_QueryConfBool(NULL, L"SeparateUserFolders", TRUE) && // if we disable File_InitUsers we dont need to do it here and below
+			 length >= _UserLen &&
                 _wcsnicmp(*OutTruePath, _User, _UserLen) == 0) {
 
         if (File_AllUsersLen && length >= _UserAllLen &&
@@ -1045,7 +1047,8 @@ _FX NTSTATUS File_GetName(
     // "\user\current", respectively
     //
 
-    else if (File_AllUsersLen && length >= File_AllUsersLen &&
+    else if (//SbieApi_QueryConfBool(NULL, L"SeparateUserFolders", TRUE) && 
+			 File_AllUsersLen && length >= File_AllUsersLen &&
                 0 == Dll_NlsStrCmp(
                         TruePath, File_AllUsers, File_AllUsersLen))
     {
@@ -1057,7 +1060,8 @@ _FX NTSTATUS File_GetName(
 
     }
 
-    else if (File_CurrentUserLen && length >= File_CurrentUserLen &&
+    else if (//SbieApi_QueryConfBool(NULL, L"SeparateUserFolders", TRUE) && 
+			 File_CurrentUserLen && length >= File_CurrentUserLen &&
                 0 == Dll_NlsStrCmp(
                         TruePath, File_CurrentUser, File_CurrentUserLen))
     {
@@ -1069,7 +1073,8 @@ _FX NTSTATUS File_GetName(
 
     }
 
-    else if (File_PublicUserLen && length >= File_PublicUserLen &&
+    else if (//SbieApi_QueryConfBool(NULL, L"SeparateUserFolders", TRUE) && 
+			 File_PublicUserLen && length >= File_PublicUserLen &&
                 0 == Dll_NlsStrCmp(
                         TruePath, File_PublicUser, File_PublicUserLen))
     {

diff --git a/Sandboxie/core/dll/file_init.c b/Sandboxie/core/dll/file_init.c
@@ -144,8 +144,10 @@ _FX BOOLEAN File_Init(void)
     if (! File_InitDrives(0xFFFFFFFF))
         return FALSE;
 
-    if (! File_InitUsers())
-        return FALSE;
+	if (SbieApi_QueryConfBool(NULL, L"SeparateUserFolders", TRUE)) {
+		if (!File_InitUsers())
+			return FALSE;
+	}
 
     File_InitRecoverFolders();
 

diff --git a/Sandboxie/core/dll/gui.c b/Sandboxie/core/dll/gui.c
@@ -952,11 +952,6 @@ _FX BOOLEAN Gui_ConnectToWindowStationAndDesktop(HMODULE User32)
 
                 rc = (ULONG_PTR)NtCurrentThread();
 
-				// OpenBox1 BEGIN
-				if (SbieApi_QueryConfBool(NULL, L"OriginalToken", FALSE))
-					rc = 0;
-				else
-				// OpenBox1 END
                 if (__sys_NtSetInformationThread)
                 {
                     rc = __sys_NtSetInformationThread(NtCurrentThread(),

diff --git a/Sandboxie/core/dll/proc.c b/Sandboxie/core/dll/proc.c
@@ -1085,6 +1085,11 @@ _FX BOOL Proc_CreateProcessInternalW_RS5(
         lpApplicationName = TlsData->proc_image_path;
     }
 
+	if (Dll_OsBuild >= 17763) {
+		// Fix-Me: this is a workaround for the MSI installer to work properly
+		lpProcessAttributes = NULL;
+	}
+
     ok = __sys_CreateProcessInternalW_RS5(
         NULL, lpApplicationName, lpCommandLine,
         lpProcessAttributes, lpThreadAttributes, bInheritHandles,
@@ -1106,9 +1111,6 @@ _FX BOOL Proc_CreateProcessInternalW_RS5(
             err = GetLastError();
         }
 
-		// OpenBox1 BEGIN
-		if (!SbieApi_QueryConfBool(NULL, L"OriginalToken", FALSE))
-		// OpenBox1 END
         if (ok) {
 
             //

diff --git a/Sandboxie/core/dll/scm_create.c b/Sandboxie/core/dll/scm_create.c
@@ -1305,9 +1305,6 @@ _FX BOOL Scm_StartServiceCtrlDispatcherX(
     }
 
 	if (_wcsicmp(ServiceName, Scm_MsiServer) == 0) {
-		if (Dll_OsBuild >= 17763 && SbieApi_QueryConfBool(NULL, L"AnonymousLogon", TRUE) == TRUE) {
-			SbieApi_Log(2194, L"");
-		}
 		Scm_IsMsiServer = TRUE;
 	}
 

diff --git a/Sandboxie/core/drv/SboxDrv.vcxproj b/Sandboxie/core/drv/SboxDrv.vcxproj
@@ -105,7 +105,7 @@
     </ClCompile>
     <Link>
       <SubSystem>Native</SubSystem>
-      <AdditionalDependencies>ntoskrnl.lib;hal.lib;wmilib.lib;fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>ntoskrnl.lib;hal.lib;wmilib.lib;fltmgr.lib;Ksecdd.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <EntryPointSymbol>DriverEntry</EntryPointSymbol>
       <RandomizedBaseAddress>
       </RandomizedBaseAddress>
@@ -135,7 +135,7 @@
     </ClCompile>
     <Link>
       <SubSystem>Native</SubSystem>
-      <AdditionalDependencies>ntoskrnl.lib;hal.lib;wmilib.lib;fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>ntoskrnl.lib;hal.lib;wmilib.lib;fltmgr.lib;Ksecdd.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <EntryPointSymbol>DriverEntry</EntryPointSymbol>
       <RandomizedBaseAddress>
       </RandomizedBaseAddress>
@@ -173,7 +173,7 @@
     </ClCompile>
     <Link>
       <SubSystem>Native</SubSystem>
-      <AdditionalDependencies>ntoskrnl.lib;hal.lib;wmilib.lib;fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>ntoskrnl.lib;hal.lib;wmilib.lib;fltmgr.lib;Ksecdd.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <EntryPointSymbol>DriverEntry</EntryPointSymbol>
       <RandomizedBaseAddress>
       </RandomizedBaseAddress>
@@ -201,7 +201,7 @@
     </ClCompile>
     <Link>
       <SubSystem>Native</SubSystem>
-      <AdditionalDependencies>ntoskrnl.lib;hal.lib;wmilib.lib;fltmgr.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>ntoskrnl.lib;hal.lib;wmilib.lib;fltmgr.lib;Ksecdd.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <EntryPointSymbol>DriverEntry</EntryPointSymbol>
       <RandomizedBaseAddress>
       </RandomizedBaseAddress>

diff --git a/Sandboxie/core/drv/process.c b/Sandboxie/core/drv/process.c
@@ -1166,7 +1166,7 @@ _FX void Process_NotifyImage(
 {
     static const WCHAR *_Ntdll32 = L"\\syswow64\\ntdll.dll";    // 19 chars
     PROCESS *proc;
-    BOOLEAN ok;
+    ULONG fail = 0;
 
     //
     // the notify routine is invoked for any image mapped for any purpose.
@@ -1216,56 +1216,58 @@ _FX void Process_NotifyImage(
     // create the sandbox space
     //
 
-    ok = TRUE;
-
     if (!proc->bHostInject)
     {
-        if (ok)
-            ok = File_CreateBoxPath(proc);
+		if (!fail && !File_CreateBoxPath(proc))
+			fail = 0x01;
 
-        if (ok)
-            ok = Ipc_CreateBoxPath(proc);
+        if (!fail && !Ipc_CreateBoxPath(proc))
+			fail = 0x02;
 
-        if (ok)
-            ok = Key_MountHive(proc);
+        if (!fail && !Key_MountHive(proc))
+			fail = 0x03;
 
         //
         // initialize the filtering components
         //
 
-        if (ok)
-            ok = File_InitProcess(proc);
+        if (!fail && !File_InitProcess(proc))
+			fail = 0x04;
 
-        if (ok)
-            ok = Key_InitProcess(proc);
+        if (!fail && !Key_InitProcess(proc))
+			fail = 0x05;
 
-        if (ok)
-            ok = Ipc_InitProcess(proc);
+        if (!fail && !Ipc_InitProcess(proc))
+			fail = 0x06;
 
-        if (ok)
-            ok = Gui_InitProcess(proc);
+        if (!fail && !Gui_InitProcess(proc))
+			fail = 0x07;
 
-        if (ok)
-            ok = Process_Low_InitConsole(proc);
+        if (!fail && !Process_Low_InitConsole(proc))
+			fail = 0x08;
 
-		if (ok)
-			ok = Token_ReplacePrimary(proc);
+		if (!fail && !Token_ReplacePrimary(proc))
+			fail = 0x09;
 
-        if (ok)
-            ok = Thread_InitProcess(proc);
+        if (!fail && !Thread_InitProcess(proc))
+			fail = 0x0A;
     }
 
     //
     // terminate process if initialization failed
     //
 
-    if (ok) {
+    if (!fail) {
 
         proc->initialized = TRUE;
 
     } else {
 
+		Log_Status_Ex_Session(
+			MSG_1231, fail, STATUS_UNSUCCESSFUL, NULL, proc->box->session_id);
+
         proc->terminated = TRUE;
+		proc->reason = 0xA0 + fail;
         Process_CancelProcess(proc);
     }
 

diff --git a/Sandboxie/core/drv/syscall_open.c b/Sandboxie/core/drv/syscall_open.c
@@ -644,9 +644,9 @@ _FX NTSTATUS Syscall_DuplicateHandle_2(
         // thread_token.c has a function for this specific case.
         //
 
-		// OpenBox2 BEGIN
+		// OpenToken BEGIN
 		if (!(Conf_Get_Boolean(proc->box->name, L"OpenToken", 0, FALSE) || Conf_Get_Boolean(proc->box->name, L"UnfilteredToken", 0, FALSE)))
-		// OpenBox2 END
+		// OpenToken END
         status = Thread_CheckTokenObject(
                     proc, OpenedObject, HandleInfo.GrantedAccess);
     }

diff --git a/Sandboxie/core/drv/thread_token.c b/Sandboxie/core/drv/thread_token.c
@@ -1243,9 +1243,9 @@ _FX NTSTATUS Thread_SetInformationThread_ImpersonationToken(
                     MyTokenHandle, TOKEN_IMPERSONATE,
                     *SeTokenObjectType, UserMode, &TokenObject, NULL);
 
-		// OpenBox2 BEGIN
+		// OpenToken BEGIN
 		if (!(Conf_Get_Boolean(proc->box->name, L"OpenToken", 0, FALSE) || Conf_Get_Boolean(proc->box->name, L"UnfilteredToken", 0, FALSE)))
-		// OpenBox2 END
+		// OpenToken END
         if (NT_SUCCESS(status)) {
 
             status = Thread_CheckTokenForImpersonation(