Restrict Access of Sandboxie Folder from Host

[builder-main]

Hi there,
I searched for the following but didn't find the answer. I saw information question for the other way round only (#2573)

Right now the Host system can read, write, execute anything from the sandbox folder. Is there a way for the host to have a restricted access ? (Best would be no rights at all)

If I change the owner of the sandbox folder would it suffice ? Isn't there a way to specify this in Sandboxie's settings. I'm surprised I couldn't find the info as you'd typically want your host to avoid indexing/scanning this folder.

Maybe I'm missing something ?
Thanks for any pointers

(Sandboxie Plus 1.4.10, Up-to-date Win10)

[offhub]

If you have an Advanced Supporter Certificate, you can use encrypted boxes for added security.

[builder-main]

Hi thanks, Two questions :

• Wouldn't encryption slow down the sandbox use drastically ?
• Encryption seems great for enhanced security indeed, now if someone just want to use it for privacy such as you would with an "incognito" tab, wouldn't there be a way without encryption ?

I'm mostly looking for a role based option, equivalent to unix right access

[offhub]

Wouldn't encryption slow down the sandbox use drastically?

Yes, but I don't think it would slow down daily use to the point of being impractical.

Encryption seems great for enhanced security indeed, but if someone just wants to use it for privacy, like you would with an "incognito" tab, wouldn't there be a way without encryption?

Without encryption, any application that can access the file can read it. If you're not saving files in the sandbox, you can use a RAMDisk, but then the files won't be persistent.

I'm mostly looking for a role-based option, equivalent to Unix-style access rights

You can try setting file permissions through Windows, but this won't prevent applications running under the same user account. You can block access to files for different users with the setting below.

[builder-main]

All good, mostly mean I need to create a user for the sandbox and then it'll work the way I want !