diff --git a/CHANGELOG.md b/CHANGELOG.md index 45db33fa..33ea9785 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,7 @@ This project adheres to [Semantic Versioning](http://semver.org/). - Add new option "AllowCoverTaskbar" for [#3975](https://github.com/sandboxie-plus/Sandboxie/issues/3975) - added RPC Port message filter mechanism to block unsafe RDP calls via the driver [#3930](https://github.com/sandboxie-plus/Sandboxie/issues/3930) - Usage: "RpcPortFilter=Port,ID,Label" label is optional +- added "Job Object" Options page to colelct all job object related options ### Changed - Extend "Temp Template" to make it could delete local template section. @@ -36,6 +37,7 @@ This project adheres to [Semantic Versioning](http://semver.org/). + ## [1.14.1 / 5.69.1] - 2024-06-06 ### Added diff --git a/SandboxiePlus/SandMan/Forms/OptionsWindow.ui b/SandboxiePlus/SandMan/Forms/OptionsWindow.ui index 22544996..fb23b793 100644 --- a/SandboxiePlus/SandMan/Forms/OptionsWindow.ui +++ b/SandboxiePlus/SandMan/Forms/OptionsWindow.ui @@ -1572,49 +1572,31 @@ - - - - 50 - false - true - - + - Advanced Security + Job Object - - - - - + + + + + - Using a custom Sandboxie Token allows to isolate individual sandboxes from each other better, and it shows in the user column of task managers the name of the box a process belongs to. Some 3rd party security solutions may however have problems with custom tokens. - - - true + Total Processes Number Limit: - - + + - Do not start sandboxed services using a system token (recommended) + Add sandboxed processes to job objects (recommended) - - - - Allow only privileged processes to access the Service Control Manager - - - - - + + - 75 true true @@ -1627,31 +1609,134 @@ - - + + - Use a Sandboxie login instead of an anonymous token + Total Processes Memory Limit: - - + + + + Single Process Memory Limit: + + + + + + + Leave it blank to disable the setting(Unit:KB) + + + + + + + Leave it blank to disable the setting(Unit:KB) + + + + + + + Leave it blank to disable the setting + + + + + + + Allow use of nested job objects (works on Windows 8 and later) + + + + + + + Qt::Horizontal + + + + 40 + 20 + + + + + + + + Qt::Vertical + + + + 20 + 40 + + + + + + + + + 0 + 0 + + + + + 16 + 0 + + + + + + + + + - 75 true true - Protect the sandbox integrity itself + Protect the system from sandboxed processes - Privilege isolation + Limit restrictions - + + + + + + + + false + true + + + + Advanced Security + + + + + + + + Drop critical privileges from processes running with a SYSTEM token + + + + Qt::Horizontal @@ -1664,10 +1749,20 @@ - - + + - Add sandboxed processes to job objects (recommended) + Allow only privileged processes to access the Service Control Manager + + + + + + + Using a custom Sandboxie Token allows to isolate individual sandboxes from each other better, and it shows in the user column of task managers the name of the box a process belongs to. Some 3rd party security solutions may however have problems with custom tokens. + + + true @@ -1675,7 +1770,6 @@ - 75 true true @@ -1685,7 +1779,37 @@ - + + + + + true + true + + + + Protect the sandbox integrity itself + + + Privilege isolation + + + + + + + Do not start sandboxed services using a system token (recommended) + + + + + + + Use a Sandboxie login instead of an anonymous token + + + + Qt::Vertical @@ -1716,7 +1840,6 @@ - 75 true true @@ -1726,18 +1849,10 @@ - - - - Drop critical privileges from processes running with a SYSTEM token - - - - + - 75 true true @@ -3927,7 +4042,6 @@ The process match level has a higher priority than the specificity and describes - 50 false true @@ -3949,49 +4063,31 @@ The process match level has a higher priority than the specificity and describes + + + + When the global hotkey is pressed 3 times in short succession this exception will be ignored. + + + Exclude this sandbox from being terminated when "Terminate All Processes" is invoked. + + + - - - Emulate sandboxed window station for all processes - - - - - - - - 75 - true - true - - - - Compatibility - - - - Disable the use of RpcMgmtSetComTimeout by default (this may resolve compatibility issues) - - - - Force usage of custom dummy Manifest files (legacy behaviour) - - - - + Use desktop object workaround for all processes - + Qt::Vertical @@ -4004,121 +4100,35 @@ The process match level has a higher priority than the specificity and describes - - - - Qt::Horizontal - - - - 40 - 20 - - - - - - - - Allow use of nested job objects (works on Windows 8 and later) - - - - - - - When the global hotkey is pressed 3 times in short succession this exception will be ignored. - - - Exclude this sandbox from being terminated when "Terminate All Processes" is invoked. - - - - - - - - - - Process Limits - - - - - - - - Qt::Vertical - - - - 20 - 40 - - - - - - + + - 75 true true - - Protect the system from sandboxed processes - - Limit restrictions - - - - - - - Leave it blank to disable the setting(Unit:KB) - - - - - - - Leave it blank to disable the setting - - - - - - - Leave it blank to disable the setting(Unit:KB) - - - - - - - Total Processes Number Limit: + Compatibility - + - Total Processes Memory Limit: + Force usage of custom dummy Manifest files (legacy behaviour) - - + + - Single Process Memory Limit: + Emulate sandboxed window station for all processes - - + + Qt::Horizontal diff --git a/SandboxiePlus/SandMan/Resources/Actions/Job.png b/SandboxiePlus/SandMan/Resources/Actions/Job.png new file mode 100644 index 00000000..7dd24941 Binary files /dev/null and b/SandboxiePlus/SandMan/Resources/Actions/Job.png differ diff --git a/SandboxiePlus/SandMan/Resources/Actions/Job2.png b/SandboxiePlus/SandMan/Resources/Actions/Job2.png new file mode 100644 index 00000000..b6c253e5 Binary files /dev/null and b/SandboxiePlus/SandMan/Resources/Actions/Job2.png differ diff --git a/SandboxiePlus/SandMan/Resources/Actions/Job3.png b/SandboxiePlus/SandMan/Resources/Actions/Job3.png new file mode 100644 index 00000000..26f2f006 Binary files /dev/null and b/SandboxiePlus/SandMan/Resources/Actions/Job3.png differ diff --git a/SandboxiePlus/SandMan/Resources/Actions/Job4.png b/SandboxiePlus/SandMan/Resources/Actions/Job4.png new file mode 100644 index 00000000..df5f4d0e Binary files /dev/null and b/SandboxiePlus/SandMan/Resources/Actions/Job4.png differ diff --git a/SandboxiePlus/SandMan/Resources/SandMan.qrc b/SandboxiePlus/SandMan/Resources/SandMan.qrc index acf7546b..429a4b5c 100644 --- a/SandboxiePlus/SandMan/Resources/SandMan.qrc +++ b/SandboxiePlus/SandMan/Resources/SandMan.qrc @@ -182,6 +182,10 @@ Actions/TaskBar.png Actions/Desktop.png Actions/Pause.png + Actions/Job.png + Actions/Job2.png + Actions/Job4.png + Actions/Job3.png Boxes/BusyOverlay.png diff --git a/SandboxiePlus/SandMan/Windows/OptionsAccess.cpp b/SandboxiePlus/SandMan/Windows/OptionsAccess.cpp index 110a61c4..0eb62b24 100644 --- a/SandboxiePlus/SandMan/Windows/OptionsAccess.cpp +++ b/SandboxiePlus/SandMan/Windows/OptionsAccess.cpp @@ -13,11 +13,11 @@ void COptionsWindow::CreateAccess() { // Resource Access - connect(ui.chkPrivacy, SIGNAL(clicked(bool)), this, SLOT(OnAccessChanged())); - connect(ui.chkUseSpecificity, SIGNAL(clicked(bool)), this, SLOT(OnAccessChanged())); - connect(ui.chkBlockWMI, SIGNAL(clicked(bool)), this, SLOT(OnAccessChanged())); - connect(ui.chkCloseForBox, SIGNAL(clicked(bool)), this, SLOT(OnAccessChanged())); - connect(ui.chkNoOpenForBox, SIGNAL(clicked(bool)), this, SLOT(OnAccessChanged())); + connect(ui.chkPrivacy, SIGNAL(clicked(bool)), this, SLOT(OnAccessChangedEx())); + connect(ui.chkUseSpecificity, SIGNAL(clicked(bool)), this, SLOT(OnAccessChangedEx())); + connect(ui.chkBlockWMI, SIGNAL(clicked(bool)), this, SLOT(OnAccessChangedEx())); + connect(ui.chkCloseForBox, SIGNAL(clicked(bool)), this, SLOT(OnAccessChangedEx())); + connect(ui.chkNoOpenForBox, SIGNAL(clicked(bool)), this, SLOT(OnAccessChangedEx())); // connect(ui.btnAddFile, SIGNAL(clicked(bool)), this, SLOT(OnAddFile())); @@ -54,8 +54,8 @@ void COptionsWindow::CreateAccess() connect(ui.tabsAccess, SIGNAL(currentChanged(int)), this, SLOT(OnAccessTab())); } -void COptionsWindow::OnAccessChanged() -{ +void COptionsWindow::OnAccessChangedEx() +{ if (sender() == ui.chkPrivacy || sender() == ui.chkUseSpecificity) { if (ui.chkPrivacy->isChecked() || (ui.chkUseSpecificity->isEnabled() && ui.chkUseSpecificity->isChecked())) theGUI->CheckCertificate(this); @@ -67,7 +67,14 @@ void COptionsWindow::OnAccessChanged() ui.chkUseSpecificity->setChecked(m_pBox->GetBool("UseRuleSpecificity", false)); } - m_AccessChanged = true; + OnAccessChanged(); +} + +void COptionsWindow::OnAccessChanged() +{ + UpdateJobOptions(); + + m_AccessChanged = true; OnOptChanged(); } @@ -105,8 +112,7 @@ void COptionsWindow::SetAccessEntry(EAccessType Type, const QString& Program, EA { if (GetAccessEntry(Type, Program, Mode, Path) != NULL) return; // already set - m_AccessChanged = true; - OnOptChanged(); + OnAccessChanged(); AddAccessEntry(Type, Mode, Program, Path); } @@ -115,8 +121,7 @@ void COptionsWindow::DelAccessEntry(EAccessType Type, const QString& Program, EA if(QTreeWidgetItem* pItem = GetAccessEntry(Type, Program, Mode, Path)) { delete pItem; - m_AccessChanged = true; - OnOptChanged(); + OnAccessChanged(); } } @@ -365,8 +370,7 @@ void COptionsWindow::OnBrowseFile() AddAccessEntry(eFile, eOpen, "", Value); - m_AccessChanged = true; - OnOptChanged(); + OnAccessChanged(); } void COptionsWindow::OnBrowseFolder() @@ -377,8 +381,7 @@ void COptionsWindow::OnBrowseFolder() AddAccessEntry(eFile, eOpen, "", Value); - m_AccessChanged = true; - OnOptChanged(); + OnAccessChanged(); } QString COptionsWindow::ExpandPath(EAccessType Type, const QString& Path) @@ -586,8 +589,7 @@ void COptionsWindow::CloseAccessEdit(QTreeWidgetItem* pItem, bool bSave) pItem->setText(3, ExpandPath(Type, Path)); pItem->setData(3, Qt::UserRole, Path); - m_AccessChanged = true; - OnOptChanged(); + OnAccessChanged(); } pTree->setItemWidget(pItem, 1, NULL); @@ -675,8 +677,7 @@ void COptionsWindow::OnAccessChanged(QTreeWidgetItem* pItem, int Column) if (Column != 0) return; - m_AccessChanged = true; - OnOptChanged(); + OnAccessChanged(); } void COptionsWindow::DeleteAccessEntry(QTreeWidgetItem* pItem, int Column) diff --git a/SandboxiePlus/SandMan/Windows/OptionsAdvanced.cpp b/SandboxiePlus/SandMan/Windows/OptionsAdvanced.cpp index 6e788f52..f7f590c6 100644 --- a/SandboxiePlus/SandMan/Windows/OptionsAdvanced.cpp +++ b/SandboxiePlus/SandMan/Windows/OptionsAdvanced.cpp @@ -129,7 +129,9 @@ void COptionsWindow::LoadAdvanced() ui.chkPreferExternalManifest->setChecked(m_pBox->GetBool("PreferExternalManifest", false)); ui.chkElevateCreateProcessFix->setChecked(m_pBox->GetBool("ApplyElevateCreateProcessFix", false)); + ui.chkAddToJob->setChecked(!m_pBox->GetBool("NoAddProcessToJob", false)); ui.chkNestedJobs->setChecked(m_pBox->GetBool("AllowBoxedJobs", false)); + ui.chkUseSbieDeskHack->setChecked(m_pBox->GetBool("UseSbieDeskHack", true)); ui.chkUseSbieWndStation->setChecked(m_pBox->GetBool("UseSbieWndStation", true)); @@ -302,6 +304,8 @@ void COptionsWindow::LoadAdvanced() if (!ui.chkOpenCredentials->isEnabled()) ui.chkOpenCredentials->setChecked(true); m_AdvancedChanged = false; + + UpdateJobOptions(); } void COptionsWindow::OnPSTChanged() @@ -553,16 +557,16 @@ void COptionsWindow::OnIsolationChanged() ui.chkNoOpenForBox->setChecked(m_pBox->GetBool("DontOpenForBoxed", true)); } - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::UpdateBoxIsolation() { ui.chkNoSecurityFiltering->setEnabled(ui.chkNoSecurityIsolation->isChecked()); - ui.chkAddToJob->setEnabled(!IsAccessEntrySet(eWnd, "", eOpen, "*") && !ui.chkNoSecurityIsolation->isChecked()); - ui.chkNestedJobs->setEnabled(!ui.chkNoSecurityIsolation->isChecked()); + //ui.chkNotUntrusted->setEnabled(!ui.chkNoSecurityIsolation->isChecked()); + + UpdateJobOptions(); ui.chkOpenDevCMApi->setEnabled(!ui.chkNoSecurityIsolation->isChecked()); ui.chkOpenSamEndpoint->setEnabled(!ui.chkNoSecurityIsolation->isChecked()); @@ -592,13 +596,9 @@ void COptionsWindow::UpdateBoxIsolation() if (ui.chkNoSecurityIsolation->isChecked()) { ui.chkCloseForBox->setChecked(false); ui.chkNoOpenForBox->setChecked(false); - if (!IsAccessEntrySet(eWnd, "", eOpen, "*")) - ui.chkAddToJob->setChecked(false); ui.chkSbieLogon->setChecked(false); } else { - if (!IsAccessEntrySet(eWnd, "", eOpen, "*")) - ui.chkAddToJob->setChecked(!m_pBox->GetBool("NoAddProcessToJob", false)); ReadGlobalCheck(ui.chkSbieLogon, "SandboxieLogon", false); } } @@ -606,8 +606,7 @@ void COptionsWindow::UpdateBoxIsolation() void COptionsWindow::OnSysSvcChanged() { ui.chkElevateRpcss->setDisabled(ui.chkNoSecurityIsolation->isChecked() && (!ui.chkRestrictServices->isChecked() || ui.chkMsiExemptions->isChecked())); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnConfidentialChanged() @@ -623,10 +622,25 @@ void COptionsWindow::OnLessConfidentialChanged() void COptionsWindow::OnAdvancedChanged() { + UpdateJobOptions(); + m_AdvancedChanged = true; OnOptChanged(); } +void COptionsWindow::UpdateJobOptions() +{ + bool IsAllWndOpen = ui.chkNoSecurityIsolation->isChecked() || IsAccessEntrySet(eWnd, "", eOpen, "*"); + ui.chkAddToJob->setEnabled(!IsAllWndOpen); + + bool bUseJobObject = !IsAllWndOpen && ui.chkAddToJob->isChecked(); + ui.chkNestedJobs->setEnabled(bUseJobObject); + + ui.lineSingleMemory->setEnabled(bUseJobObject); + ui.lineTotalMemory->setEnabled(bUseJobObject); + ui.lineTotalNumber->setEnabled(bUseJobObject); +} + void COptionsWindow::CheckOpenCOM() { bool bComIpcOpen = IsAccessEntrySet(eIPC, "", eOpen, "\\RPC Control\\epmapper") || IsAccessEntrySet(eIPC, "", eOpen, "*"); @@ -808,8 +822,7 @@ void COptionsWindow::OnAddOption() void COptionsWindow::OnDelOption() { DeleteAccessEntry(ui.treeOptions->currentItem()); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnOptionItemDoubleClicked(QTreeWidgetItem* pItem, int Column) @@ -880,8 +893,7 @@ void COptionsWindow::OnOptionChanged(QTreeWidgetItem* pItem, int Column) if (Column != 0) return; - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::CloseOptionEdit(bool bSave) @@ -923,8 +935,7 @@ void COptionsWindow::CloseOptionEdit(QTreeWidgetItem* pItem, bool bSave) pItem->setText(2, pValue->currentText()); pItem->setData(2, Qt::UserRole, pValue->currentText()); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } ui.treeOptions->setItemWidget(pItem, 1, NULL); @@ -979,8 +990,7 @@ void COptionsWindow::OnAddAutoRun() return; AddTriggerItem(Value, eOnStartCmd); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnAddAutoSvc() @@ -990,8 +1000,7 @@ void COptionsWindow::OnAddAutoSvc() return; AddTriggerItem(Value, eOnStartSvc); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnAddAutoExec() @@ -1001,8 +1010,7 @@ void COptionsWindow::OnAddAutoExec() return; AddTriggerItem(Value, eAutoExec); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnAddDeleteCmd() @@ -1012,8 +1020,7 @@ void COptionsWindow::OnAddDeleteCmd() return; AddTriggerItem(Value, eDeleteCmd); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnAddTerminateCmd() @@ -1023,8 +1030,7 @@ void COptionsWindow::OnAddTerminateCmd() return; AddTriggerItem(Value, eTerminateCmd); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnAddRecoveryCheck() @@ -1034,15 +1040,13 @@ void COptionsWindow::OnAddRecoveryCheck() return; AddTriggerItem(Value, eRecoveryCheck); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnDelAuto() { DeleteAccessEntry(ui.treeTriggers->currentItem()); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } // @@ -1054,15 +1058,13 @@ void COptionsWindow::OnAddProcess() AddHiddenProcEntry(Process); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnDelProcess() { DeleteAccessEntry(ui.treeHideProc->currentItem()); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnHostProcessAllow() @@ -1073,8 +1075,7 @@ void COptionsWindow::OnHostProcessAllow() AddHostProcEntry(Process, false); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnHostProcessDeny() @@ -1085,15 +1086,13 @@ void COptionsWindow::OnHostProcessDeny() AddHostProcEntry(Process, true); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnDelHostProcess() { DeleteAccessEntry(ui.treeHostProc->currentItem()); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::ShowHiddenProcTmpl(bool bUpdate) @@ -1234,8 +1233,7 @@ void COptionsWindow::OnAddUser() ui.lstUsers->addItems(Users); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnDelUser() @@ -1243,8 +1241,7 @@ void COptionsWindow::OnDelUser() foreach(QListWidgetItem* pItem, ui.lstUsers->selectedItems()) delete pItem; - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::CreateDebug() diff --git a/SandboxiePlus/SandMan/Windows/OptionsGeneral.cpp b/SandboxiePlus/SandMan/Windows/OptionsGeneral.cpp index 68d656be..c2bd7864 100644 --- a/SandboxiePlus/SandMan/Windows/OptionsGeneral.cpp +++ b/SandboxiePlus/SandMan/Windows/OptionsGeneral.cpp @@ -283,11 +283,8 @@ void COptionsWindow::LoadGeneral() ui.chkPrintToFile->setChecked(m_pBox->GetBool("AllowSpoolerPrintToFile", false)); ui.lineSingleMemory->setText(m_pBox->GetText("ProcessMemoryLimit", "")); - ui.lineSingleMemory->setEnabled(true); ui.lineTotalMemory->setText(m_pBox->GetText("TotalMemoryLimit", "")); - ui.lineTotalMemory->setEnabled(true); ui.lineTotalNumber->setText(m_pBox->GetText("TotalNumberLimit", "")); - ui.lineTotalNumber->setEnabled(true); //ui.chkOpenProtectedStorage->setChecked(m_pBox->GetBool("OpenProtectedStorage", false)); ui.chkOpenProtectedStorage->setChecked(m_BoxTemplates.contains("OpenProtectedStorage")); @@ -429,12 +426,12 @@ void COptionsWindow::SaveGeneral() WriteAdvancedCheck(ui.chkOpenSpooler, "OpenPrintSpooler", "y", ""); WriteAdvancedCheck(ui.chkPrintToFile, "AllowSpoolerPrintToFile", "y", ""); - if (!ui.lineSingleMemory->text().isEmpty()) - WriteText("ProcessMemoryLimit", ui.lineSingleMemory->text()); - if (!ui.lineTotalMemory->text().isEmpty()) - WriteText("TotalMemoryLimit", ui.lineTotalMemory->text()); - if (!ui.lineTotalNumber->text().isEmpty()) - WriteText("ProcessNumberLimit", ui.lineTotalNumber->text()); + if (!ui.lineSingleMemory->text().isEmpty()) WriteText("ProcessMemoryLimit", ui.lineSingleMemory->text()); + else m_pBox->DelValue("ProcessMemoryLimit"); + if (!ui.lineTotalMemory->text().isEmpty()) WriteText("TotalMemoryLimit", ui.lineTotalMemory->text()); + else m_pBox->DelValue("TotalMemoryLimit"); + if (!ui.lineTotalNumber->text().isEmpty()) WriteText("ProcessNumberLimit", ui.lineTotalNumber->text()); + else m_pBox->DelValue("ProcessNumberLimit"); //WriteAdvancedCheck(ui.chkOpenProtectedStorage, "OpenProtectedStorage", "y", ""); SetTemplate("OpenProtectedStorage", ui.chkOpenProtectedStorage->isChecked()); @@ -815,10 +812,6 @@ void COptionsWindow::OnGeneralChanged() ui.chkOpenSpooler->setEnabled(!ui.chkBlockSpooler->isChecked() && !ui.chkNoSecurityIsolation->isChecked()); ui.chkPrintToFile->setEnabled(!ui.chkBlockSpooler->isChecked() && !ui.chkNoSecurityFiltering->isChecked()); - ui.lineSingleMemory->setEnabled(ui.chkAddToJob->isChecked()); - ui.lineTotalMemory->setEnabled(ui.chkAddToJob->isChecked()); - ui.lineTotalNumber->setEnabled(ui.chkAddToJob->isChecked()); - ui.chkCoverBar->setEnabled(ui.chkUserOperation->isChecked()); ui.chkOpenCredentials->setEnabled(!ui.chkOpenProtectedStorage->isChecked()); @@ -866,7 +859,7 @@ void COptionsWindow::OnSecurityMode() m_GeneralChanged = true; OnOptChanged(); - OnAccessChanged(); // for rule specificity + OnAccessChangedEx(); // for rule specificity } void COptionsWindow::OnUseIcon(bool bUse) @@ -1142,8 +1135,7 @@ void COptionsWindow::OnVmRead() SetAccessEntry(eIPC, "", eReadOnly, "$:*"); else DelAccessEntry(eIPC, "", eReadOnly, "$:*"); - m_AdvancedChanged = true; - OnOptChanged(); + OnAdvancedChanged(); } void COptionsWindow::OnDiskChanged() diff --git a/SandboxiePlus/SandMan/Windows/OptionsWindow.cpp b/SandboxiePlus/SandMan/Windows/OptionsWindow.cpp index dda21b5d..bea8481b 100644 --- a/SandboxiePlus/SandMan/Windows/OptionsWindow.cpp +++ b/SandboxiePlus/SandMan/Windows/OptionsWindow.cpp @@ -207,14 +207,15 @@ COptionsWindow::COptionsWindow(const QSharedPointer& pBox, const QStri ui.tabsGeneral->setTabIcon(1, CSandMan::GetIcon("Folder")); ui.tabsGeneral->setTabIcon(2, CSandMan::GetIcon("Move")); ui.tabsGeneral->setTabIcon(3, CSandMan::GetIcon("NoAccess")); - ui.tabsGeneral->setTabIcon(4, CSandMan::GetIcon("Fence")); + ui.tabsGeneral->setTabIcon(4, CSandMan::GetIcon("EFence")); ui.tabsGeneral->setTabIcon(5, CSandMan::GetIcon("Run")); ui.tabsSecurity->setCurrentIndex(0); ui.tabsSecurity->setTabIcon(0, CSandMan::GetIcon("Shield7")); ui.tabsSecurity->setTabIcon(1, CSandMan::GetIcon("Fence")); ui.tabsSecurity->setTabIcon(2, CSandMan::GetIcon("Shield15")); - ui.tabsSecurity->setTabIcon(3, CSandMan::GetIcon("Shield12")); + ui.tabsSecurity->setTabIcon(3, CSandMan::GetIcon("Job")); + ui.tabsSecurity->setTabIcon(4, CSandMan::GetIcon("Shield12")); ui.tabsForce->setCurrentIndex(0); ui.tabsForce->setTabIcon(0, CSandMan::GetIcon("Force")); @@ -247,8 +248,7 @@ COptionsWindow::COptionsWindow(const QSharedPointer& pBox, const QStri ui.tabsOther->setCurrentIndex(0); ui.tabsOther->setTabIcon(0, CSandMan::GetIcon("Presets")); - ui.tabsOther->setTabIcon(1, CSandMan::GetIcon("BFance")); - ui.tabsOther->setTabIcon(2, CSandMan::GetIcon("Dll")); + ui.tabsOther->setTabIcon(1, CSandMan::GetIcon("Dll")); ui.tabsAdvanced->setCurrentIndex(0); ui.tabsAdvanced->setTabIcon(0, CSandMan::GetIcon("Presets")); @@ -370,6 +370,8 @@ COptionsWindow::COptionsWindow(const QSharedPointer& pBox, const QStri AddIconToLabel(ui.lblMigration, CSandMan::GetIcon("Move").pixmap(size,size)); AddIconToLabel(ui.lblDelete, CSandMan::GetIcon("Erase").pixmap(size,size)); AddIconToLabel(ui.lblRawDisk, CSandMan::GetIcon("Disk").pixmap(size,size)); + AddIconToLabel(ui.lblJob, CSandMan::GetIcon("Job3").pixmap(size,size)); + AddIconToLabel(ui.lblLimit, CSandMan::GetIcon("Job2").pixmap(size,size)); AddIconToLabel(ui.lblSecurity, CSandMan::GetIcon("Shield5").pixmap(size,size)); AddIconToLabel(ui.lblElevation, CSandMan::GetIcon("Shield9").pixmap(size,size)); AddIconToLabel(ui.lblBoxProtection, CSandMan::GetIcon("BoxConfig").pixmap(size,size)); @@ -385,11 +387,9 @@ COptionsWindow::COptionsWindow(const QSharedPointer& pBox, const QStri AddIconToLabel(ui.lblPolicy, CSandMan::GetIcon("Policy").pixmap(size,size)); AddIconToLabel(ui.lblCompatibility, CSandMan::GetIcon("Compatibility").pixmap(size,size)); - AddIconToLabel(ui.lblLimit, CSandMan::GetIcon("EFence").pixmap(size,size)); //AddIconToLabel(ui.lblComRpc, CSandMan::GetIcon("Objects").pixmap(size,size)); AddIconToLabel(ui.lblPrivilege, CSandMan::GetIcon("Token").pixmap(size,size)); - AddIconToLabel(ui.lblFence, CSandMan::GetIcon("BFance").pixmap(size,size)); AddIconToLabel(ui.lblToken, CSandMan::GetIcon("Sandbox").pixmap(size,size)); AddIconToLabel(ui.lblIsolation, CSandMan::GetIcon("Fence").pixmap(size,size)); AddIconToLabel(ui.lblAccess, CSandMan::GetIcon("NoAccess").pixmap(size,size)); @@ -1173,25 +1173,6 @@ void COptionsWindow::UpdateCurrentTab() { ui.chkVmRead->setChecked(IsAccessEntrySet(eIPC, "", eReadOnly, "$:*")); } - else if (m_pCurrentTab == ui.tabPrivileges || m_pCurrentTab == ui.tabSecurity) - { - if (IsAccessEntrySet(eWnd, "", eOpen, "*")) - { - if (!ui.chkNoSecurityIsolation->isChecked()) - { - ui.chkAddToJob->setEnabled(false); - ui.chkAddToJob->setChecked(false); - } - } - else - { - if (!ui.chkNoSecurityIsolation->isChecked()) - { - ui.chkAddToJob->setEnabled(true); - ui.chkAddToJob->setChecked(!m_pBox->GetBool("NoAddProcessToJob", false)); - } - } - } else if (m_pCurrentTab == ui.tabStart || m_pCurrentTab == ui.tabForce) { if (IsAccessEntrySet(eIPC, "!", eClosed, "*")) diff --git a/SandboxiePlus/SandMan/Windows/OptionsWindow.h b/SandboxiePlus/SandMan/Windows/OptionsWindow.h index c38e70e3..fa612ca8 100644 --- a/SandboxiePlus/SandMan/Windows/OptionsWindow.h +++ b/SandboxiePlus/SandMan/Windows/OptionsWindow.h @@ -159,24 +159,24 @@ private slots: void OnAccessSelectionChanged() { CloseAccessEdit(); OnOptChanged();} void OnAccessChanged(QTreeWidgetItem* pItem, int Column); - void OnAddFile() { AddAccessEntry(eFile, eOpen, "", ""); m_AccessChanged = true; OnOptChanged(); } + void OnAddFile() { AddAccessEntry(eFile, eOpen, "", ""); OnAccessChanged(); } void OnBrowseFile(); void OnBrowseFolder(); - void OnDelFile() { DeleteAccessEntry(ui.treeFiles->currentItem()); m_AccessChanged = true; OnOptChanged(); } + void OnDelFile() { DeleteAccessEntry(ui.treeFiles->currentItem()); OnAccessChanged(); } void OnShowFilesTmpl() { LoadAccessListTmpl(eFile, ui.chkShowFilesTmpl->isChecked(), true); } - void OnAddKey() { AddAccessEntry(eKey, eOpen, "", ""); m_AccessChanged = true; OnOptChanged(); } - void OnDelKey() { DeleteAccessEntry(ui.treeKeys->currentItem()); m_AccessChanged = true; OnOptChanged(); } + void OnAddKey() { AddAccessEntry(eKey, eOpen, "", ""); OnAccessChanged(); } + void OnDelKey() { DeleteAccessEntry(ui.treeKeys->currentItem()); OnAccessChanged(); } void OnShowKeysTmpl() { LoadAccessListTmpl(eKey, ui.chkShowKeysTmpl->isChecked(), true); } - void OnAddIPC() { AddAccessEntry(eIPC, eOpen, "", ""); m_AccessChanged = true; OnOptChanged(); } - void OnDelIPC() { DeleteAccessEntry(ui.treeIPC->currentItem()); m_AccessChanged = true; OnOptChanged(); } + void OnAddIPC() { AddAccessEntry(eIPC, eOpen, "", ""); OnAccessChanged(); } + void OnDelIPC() { DeleteAccessEntry(ui.treeIPC->currentItem()); OnAccessChanged(); } void OnShowIPCTmpl() { LoadAccessListTmpl(eIPC, ui.chkShowIPCTmpl->isChecked(), true); } - void OnAddWnd() { AddAccessEntry(eWnd, eOpen, "", ""); m_AccessChanged = true; OnOptChanged(); } - void OnDelWnd() { DeleteAccessEntry(ui.treeWnd->currentItem()); m_AccessChanged = true; OnOptChanged(); } + void OnAddWnd() { AddAccessEntry(eWnd, eOpen, "", ""); OnAccessChanged(); } + void OnDelWnd() { DeleteAccessEntry(ui.treeWnd->currentItem()); OnAccessChanged(); } void OnShowWndTmpl() { LoadAccessListTmpl(eWnd, ui.chkShowWndTmpl->isChecked(), true); } - void OnAddCOM() { AddAccessEntry(eCOM, eOpen, "", ""); m_AccessChanged = true; OnOptChanged(); } - void OnDelCOM() { DeleteAccessEntry(ui.treeCOM->currentItem()); m_AccessChanged = true; OnOptChanged(); } + void OnAddCOM() { AddAccessEntry(eCOM, eOpen, "", ""); OnAccessChanged(); } + void OnDelCOM() { DeleteAccessEntry(ui.treeCOM->currentItem()); OnAccessChanged(); } void OnShowCOMTmpl() { LoadAccessListTmpl(eCOM, ui.chkShowCOMTmpl->isChecked(), true); } - //void OnDelAccess() { DeleteAccessEntry(ui.treeAccess->currentItem()); m_AccessChanged = true; OnOptChanged(); } + //void OnDelAccess() { DeleteAccessEntry(ui.treeAccess->currentItem()); OnAccessChanged(); } //void OnShowAccessTmpl() { LoadAccessListTmpl(true); } // @@ -249,6 +249,7 @@ private slots: void OnINetBlockChanged() { m_INetBlockChanged = true; OnOptChanged(); } void OnRecoveryChanged() { m_RecoveryChanged = true; OnOptChanged(); } void OnAccessChanged(); + void OnAccessChangedEx(); void OnSysSvcChanged(); void OnAdvancedChanged(); void OnOpenCOM(); @@ -493,6 +494,8 @@ protected: void UpdateAccessPolicy(); + void UpdateJobOptions(); + QTreeWidget* GetAccessTree(EAccessType Type); //