mirrors/Sandboxie
mirrors
/
Sandboxie
mirror of https://github.com/sandboxie-plus/Sandboxie.git
1
0
Fork 0
Code Releases Activity

Merge pull request #3670 from love-code-yeyixiao/master 

Prevents processes in the sandbox from capturing screen images.
This commit is contained in:
DavidXanatos 2024-03-03 11:58:43 +01:00 committed by GitHub
parent 220745f9a1 8d01e8867a
commit 272e6c5f67
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
7 changed files with 294 additions and 183 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGELOG.md
View File

@ -8,7 +8,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
### Added
- added menu entry to restart Sandman as admin [#3581](https://github.com/sandboxie-plus/Sandboxie/issues/3581) (thx Yeyixiao)
- added option to block taking screen capture/screenshot of sandboxed processes [#624](https://github.com/sandboxie-plus/Sandboxie/issues/624) (thx Yeyixiao)
- Added the option to prevent sandboxed programs from accessing the images of the window outside the sandbox [#624](https://github.com/sandboxie-plus/Sandboxie/issues/624) [#1985](https://github.com/sandboxie-plus/Sandboxie/issues/1985) (thx Yeyixiao)
- Sandman, suspend all processes [#3582](https://github.com/sandboxie-plus/Sandboxie/issues/3582)
### Fixed

4
Sandboxie/core/dll/gui.c
View File

@ -380,6 +380,10 @@ _FX BOOLEAN Gui_Init(HMODULE module)
Gui_UseProxyService = !Dll_CompartmentMode && !SbieApi_QueryConfBool(NULL, L"NoSandboxieDesktop", FALSE);
// NoSbieDesk END
GUI_IMPORT___(PrintWindow)
GUI_IMPORT___(GetWindowDC)
GUI_IMPORT___(GetDC)
GUI_IMPORT___(GetDCEx)
GUI_IMPORT___(GetWindowThreadProcessId);
GUI_IMPORT___(SetThreadDesktop);
GUI_IMPORT___(SwitchDesktop);

12
Sandboxie/core/dll/gui_p.h
View File

@ -412,6 +412,14 @@ typedef int (*P_LoadString)(
typedef BOOL (*P_SetProcessWindowStation)(HWINSTA hWinSta);
typedef HDC(*P_GetWindowDC)(HWND hWnd);
typedef HDC(*P_GetDC)(HWND hWnd);
typedef HDC(*P_GetDCEx)(HWND hWnd,HRGN hrgnClip,DWORD flags);
typedef BOOL (*P_PrintWindow)(HWND hwnd,HDC hdcBlt,UINT nFlags);
typedef BOOL (*P_SetThreadDesktop)(HDESK hDesktop);
typedef BOOL (*P_SwitchDesktop)(HDESK hDesktop);
@ -534,6 +542,10 @@ extern ATOM Gui_WindowProcOldA_Atom;
#endif
#define GUI_SYS_VAR_2(nm) GUI_SYS_VAR_AW(nm,A); GUI_SYS_VAR_AW(nm,W);
GUI_SYS_VAR(GetDC)
GUI_SYS_VAR(GetDCEx)
GUI_SYS_VAR(GetWindowDC)
GUI_SYS_VAR(PrintWindow)
GUI_SYS_VAR(ClipCursor)
GUI_SYS_VAR(GetClipCursor)

82
Sandboxie/core/dll/guimisc.c
View File

@ -99,6 +99,10 @@ static LONG Gui_GetRawInputDeviceInfoW(
_In_opt_ HANDLE hDevice, _In_ UINT uiCommand,
_Inout_ LPVOID pData, _Inout_ PUINT pcbSize);
static HDC Gui_GetDC(HWND hWnd);
static HDC Gui_GetWindowDC(HWND hWnd);
static HDC Gui_GetDCEx(HWND hWnd, HRGN hrgnClip, DWORD flags);
static BOOL Gui_PrintWindow(HWND hwnd,HDC hdcBlt,UINT nFlags);
//---------------------------------------------------------------------------
@ -176,7 +180,10 @@ _FX BOOLEAN Gui_InitMisc(HMODULE module)
}
SBIEDLL_HOOK_GUI(SwapMouseButton);
SBIEDLL_HOOK_GUI(SetDoubleClickTime);
SBIEDLL_HOOK_GUI(GetWindowDC);
SBIEDLL_HOOK_GUI(GetDC);
SBIEDLL_HOOK_GUI(GetDCEx);
SBIEDLL_HOOK_GUI(PrintWindow);
if (Dll_OsBuild >= 6000) {
//
@ -1458,3 +1465,76 @@ _FX BOOL Gui_ImmAssociateContextEx(
return ok;
}
//---------------------------------------------------------------------------
// Gui_GetDC
//---------------------------------------------------------------------------
_FX HDC Gui_GetDC(HWND hWnd)
{
if (SbieApi_QueryConfBool(NULL, L"IsBlockCapture", FALSE)) {
if (hWnd == NULL || hWnd == __sys_GetDesktopWindow()) {
SetLastError(ERROR_ACCESS_DENIED);
return NULL;
}
ULONG_PTR pid=0, tid=0;
if (!Gui_IsSameBox(hWnd, &pid, &tid)) {
SetLastError(ERROR_ACCESS_DENIED);
return NULL;
}
}
return __sys_GetDC(hWnd);
}
_FX HDC Gui_GetWindowDC(HWND hWnd)
{
if (SbieApi_QueryConfBool(NULL, L"IsBlockCapture", FALSE)) {
if (hWnd == NULL || hWnd == __sys_GetDesktopWindow()) {
SetLastError(ERROR_ACCESS_DENIED);
return NULL;
}
ULONG_PTR pid = 0, tid = 0;
if (!Gui_IsSameBox(hWnd, &pid, &tid)) {
SetLastError(ERROR_ACCESS_DENIED);
return NULL;
}
}
return __sys_GetWindowDC(hWnd);
}
_FX HDC Gui_GetDCEx(HWND hWnd,HRGN hrgnClip,DWORD flags)
{
if (SbieApi_QueryConfBool(NULL, L"IsBlockCapture", FALSE)) {
if (hWnd == NULL || hWnd == __sys_GetDesktopWindow()) {
SetLastError(ERROR_ACCESS_DENIED);
return NULL;
}
ULONG_PTR pid = 0, tid = 0;
if (!Gui_IsSameBox(hWnd, &pid, &tid)) {
SetLastError(ERROR_ACCESS_DENIED);
return NULL;
}
}
return __sys_GetWindowDC(hWnd);
}
_FX BOOL Gui_PrintWindow(
HWND hwnd,
HDC hdcBlt,
UINT nFlags
) {
if (SbieApi_QueryConfBool(NULL, L"IsBlockCapture", FALSE)) {
if (hwnd == NULL || hwnd == __sys_GetDesktopWindow()) {
SetLastError(ERROR_ACCESS_DENIED);
return 0;
}
ULONG_PTR pid = 0, tid = 0;
if (!Gui_IsSameBox(hwnd, &pid, &tid)) {
SetLastError(ERROR_ACCESS_DENIED);
return 0;
}
}
return __sys_PrintWindow(hwnd, hdcBlt, nFlags);
}

370
SandboxiePlus/SandMan/Forms/OptionsWindow.ui
View File

@ -45,7 +45,7 @@
<enum>QTabWidget::North</enum>
</property>
<property name="currentIndex">
<number>1</number>
<number>0</number>
</property>
<widget class="QWidget" name="tabGeneral">
<attribute name="title">
@ -55,7 +55,7 @@
<item row="0" column="0">
<widget class="QTabWidget" name="tabsGeneral">
<property name="currentIndex">
<number>0</number>
<number>3</number>
</property>
<widget class="QWidget" name="tabOptions">
<attribute name="title">
@ -665,182 +665,192 @@
<attribute name="title">
<string>Restrictions</string>
</attribute>
<layout class="QGridLayout" name="gridLayout_37">
<item row="0" column="0">
<layout class="QGridLayout" name="gridLayout_36">
<item row="9" column="2">
<widget class="QCheckBox" name="chkOpenCredentials">
<property name="text">
<string>Open Windows Credentials Store (user mode)</string>
</property>
</widget>
</item>
<item row="13" column="2">
<spacer name="horizontalSpacer_5">
<property name="orientation">
<enum>Qt::Horizontal</enum>
</property>
<property name="sizeHint" stdset="0">
<size>
<width>40</width>
<height>20</height>
</size>
</property>
</spacer>
</item>
<item row="10" column="1" colspan="2">
<widget class="QCheckBox" name="chkCloseClipBoard">
<property name="text">
<string>Block read access to the clipboard</string>
</property>
</widget>
</item>
<item row="13" column="0">
<spacer name="verticalSpacer_12">
<property name="orientation">
<enum>Qt::Vertical</enum>
</property>
<property name="sizeHint" stdset="0">
<size>
<width>20</width>
<height>40</height>
</size>
</property>
</spacer>
</item>
<item row="2" column="1" colspan="2">
<widget class="QCheckBox" name="chkBlockNetParam">
<property name="text">
<string>Prevent change to network and firewall parameters (user mode)</string>
</property>
</widget>
</item>
<item row="11" column="1" colspan="2">
<widget class="QCheckBox" name="chkVmRead">
<property name="text">
<string>Allow to read memory of unsandboxed processes (not recommended)</string>
</property>
</widget>
</item>
<item row="4" column="1" colspan="2">
<widget class="QCheckBox" name="chkBlockSpooler">
<property name="text">
<string>Block access to the printer spooler</string>
</property>
</widget>
</item>
<item row="6" column="2">
<widget class="QCheckBox" name="chkPrintToFile">
<property name="sizePolicy">
<sizepolicy hsizetype="Minimum" vsizetype="Fixed">
<horstretch>0</horstretch>
<verstretch>0</verstretch>
</sizepolicy>
</property>
<property name="text">
<string>Allow the print spooler to print to files outside the sandbox</string>
</property>
</widget>
</item>
<item row="1" column="1" colspan="2">
<widget class="QCheckBox" name="chkBlockNetShare">
<property name="text">
<string>Block network files and folders, unless specifically opened.</string>
</property>
</widget>
</item>
<item row="5" column="2">
<widget class="QCheckBox" name="chkOpenSpooler">
<property name="text">
<string>Remove spooler restriction, printers can be installed outside the sandbox</string>
</property>
</widget>
</item>
<item row="8" column="1" colspan="2">
<widget class="QCheckBox" name="chkOpenProtectedStorage">
<property name="text">
<string>Open System Protected Storage</string>
</property>
</widget>
</item>
<item row="12" column="2">
<widget class="QCheckBox" name="chkVmReadNotify">
<property name="text">
<string>Issue message 2111 when a process access is denied</string>
</property>
</widget>
</item>
<item row="7" column="0" colspan="2">
<widget class="QLabel" name="lblOther">
<property name="font">
<font>
<weight>75</weight>
<bold>true</bold>
<kerning>true</kerning>
</font>
</property>
<property name="toolTip">
<string>Protect the system from sandboxed processes</string>
</property>
<property name="text">
<string>Other restrictions</string>
</property>
</widget>
</item>
<item row="9" column="1">
<widget class="QLabel" name="label_39">
<property name="minimumSize">
<size>
<width>20</width>
<height>0</height>
</size>
</property>
<property name="maximumSize">
<size>
<width>20</width>
<height>16777215</height>
</size>
</property>
<property name="text">
<string/>
</property>
</widget>
</item>
<item row="3" column="0" colspan="2">
<widget class="QLabel" name="lblPrinting">
<property name="font">
<font>
<weight>75</weight>
<bold>true</bold>
<kerning>true</kerning>
</font>
</property>
<property name="toolTip">
<string>Protect the system from sandboxed processes</string>
</property>
<property name="text">
<string>Printing restrictions</string>
</property>
</widget>
</item>
<item row="0" column="0" colspan="2">
<widget class="QLabel" name="lblNetwork">
<property name="font">
<font>
<weight>75</weight>
<bold>true</bold>
<kerning>true</kerning>
</font>
</property>
<property name="toolTip">
<string>Protect the system from sandboxed processes</string>
</property>
<property name="text">
<string>Network restrictions</string>
</property>
</widget>
</item>
</layout>
<layout class="QGridLayout" name="gridLayout_36">
<item row="0" column="0" colspan="2">
<widget class="QLabel" name="lblNetwork">
<property name="font">
<font>
<weight>75</weight>
<bold>true</bold>
<kerning>true</kerning>
</font>
</property>
<property name="toolTip">
<string>Protect the system from sandboxed processes</string>
</property>
<property name="text">
<string>Network restrictions</string>
</property>
</widget>
</item>
<item row="1" column="1" colspan="2">
<widget class="QCheckBox" name="chkBlockNetShare">
<property name="text">
<string>Block network files and folders, unless specifically opened.</string>
</property>
</widget>
</item>
<item row="2" column="1" colspan="2">
<widget class="QCheckBox" name="chkBlockNetParam">
<property name="text">
<string>Prevent change to network and firewall parameters (user mode)</string>
</property>
</widget>
</item>
<item row="3" column="0" colspan="2">
<widget class="QLabel" name="lblPrinting">
<property name="font">
<font>
<weight>75</weight>
<bold>true</bold>
<kerning>true</kerning>
</font>
</property>
<property name="toolTip">
<string>Protect the system from sandboxed processes</string>
</property>
<property name="text">
<string>Printing restrictions</string>
</property>
</widget>
</item>
<item row="4" column="1" colspan="2">
<widget class="QCheckBox" name="chkBlockSpooler">
<property name="text">
<string>Block access to the printer spooler</string>
</property>
</widget>
</item>
<item row="5" column="2">
<widget class="QCheckBox" name="chkOpenSpooler">
<property name="text">
<string>Remove spooler restriction, printers can be installed outside the sandbox</string>
</property>
</widget>
</item>
<item row="6" column="2">
<widget class="QCheckBox" name="chkPrintToFile">
<property name="sizePolicy">
<sizepolicy hsizetype="Minimum" vsizetype="Fixed">
<horstretch>0</horstretch>
<verstretch>0</verstretch>
</sizepolicy>
</property>
<property name="text">
<string>Allow the print spooler to print to files outside the sandbox</string>
</property>
</widget>
</item>
<item row="7" column="0">
<widget class="QLabel" name="lblOther">
<property name="font">
<font>
<weight>75</weight>
<bold>true</bold>
<kerning>true</kerning>
</font>
</property>
<property name="toolTip">
<string>Protect the system from sandboxed processes</string>
</property>
<property name="text">
<string>Other restrictions</string>
</property>
</widget>
</item>
<item row="8" column="1" colspan="2">
<widget class="QCheckBox" name="chkOpenProtectedStorage">
<property name="text">
<string>Open System Protected Storage</string>
</property>
</widget>
</item>
<item row="9" column="1">
<widget class="QLabel" name="label_39">
<property name="minimumSize">
<size>
<width>20</width>
<height>0</height>
</size>
</property>
<property name="maximumSize">
<size>
<width>20</width>
<height>16777215</height>
</size>
</property>
<property name="text">
<string/>
</property>
</widget>
</item>
<item row="9" column="2">
<widget class="QCheckBox" name="chkOpenCredentials">
<property name="text">
<string>Open Windows Credentials Store (user mode)</string>
</property>
</widget>
</item>
<item row="10" column="1" colspan="2">
<widget class="QCheckBox" name="chkCloseClipBoard">
<property name="text">
<string>Block read access to the clipboard</string>
</property>
</widget>
</item>
<item row="11" column="1" colspan="2">
<widget class="QCheckBox" name="chkVmRead">
<property name="text">
<string>Allow to read memory of unsandboxed processes (not recommended)</string>
</property>
</widget>
</item>
<item row="12" column="2">
<widget class="QCheckBox" name="chkVmReadNotify">
<property name="text">
<string>Issue message 2111 when a process access is denied</string>
</property>
</widget>
</item>
<item row="13" column="0" rowspan="2">
<spacer name="verticalSpacer_12">
<property name="orientation">
<enum>Qt::Vertical</enum>
</property>
<property name="sizeHint" stdset="0">
<size>
<width>20</width>
<height>43</height>
</size>
</property>
</spacer>
</item>
<item row="13" column="1" colspan="2">
<widget class="QCheckBox" name="chkBlockCapture">
<property name="text">
<string>Prevents an in-sandbox process from performing cross-sandbox window image manipulation.</string>
</property>
</widget>
</item>
<item row="14" column="2">
<widget class="QLabel" name="label_19">
<property name="text">
<string>(for example, screenshots) </string>
</property>
</widget>
</item>
<item row="15" column="2">
<spacer name="horizontalSpacer_5">
<property name="orientation">
<enum>Qt::Horizontal</enum>
</property>
<property name="sizeHint" stdset="0">
<size>
<width>556</width>
<height>20</height>
</size>
</property>
</spacer>
</item>
</layout>
</widget>
@ -1004,7 +1014,7 @@
<item row="0" column="0">
<widget class="QTabWidget" name="tabsSecurity">
<property name="currentIndex">
<number>2</number>
<number>1</number>
</property>
<widget class="QWidget" name="tabHarden">
<attribute name="title">
@ -1442,6 +1452,7 @@
<widget class="QLabel" name="lblBoxProtection">
<property name="font">
<font>
<weight>75</weight>
<bold>true</bold>
<kerning>true</kerning>
</font>
@ -4949,7 +4960,6 @@ Please note that this values are currently user specific and saved globally for
</widget>
<tabstops>
<tabstop>tabs</tabstop>
<tabstop>tabsGeneral</tabstop>
<tabstop>cmbBoxIndicator</tabstop>
<tabstop>cmbBoxBorder</tabstop>
<tabstop>btnBorderColor</tabstop>

2
SandboxiePlus/SandMan/Windows/OptionsAdvanced.cpp
View File

@ -521,6 +521,8 @@ void COptionsWindow::UpdateBoxIsolation()
ui.chkCloseClipBoard->setEnabled(!ui.chkNoSecurityIsolation->isChecked());
ui.chkVmRead->setEnabled(!ui.chkNoSecurityIsolation->isChecked());
ui.chkBlockCapture->setEnabled(!ui.chkNoSecurityIsolation->isChecked());
ui.chkCloseForBox->setEnabled(!ui.chkNoSecurityIsolation->isChecked());
ui.chkNoOpenForBox->setEnabled(!ui.chkNoSecurityIsolation->isChecked());

5
SandboxiePlus/SandMan/Windows/OptionsGeneral.cpp
View File

@ -166,6 +166,7 @@ void COptionsWindow::CreateGeneral()
connect(ui.chkOpenProtectedStorage, SIGNAL(clicked(bool)), this, SLOT(OnPSTChanged()));
connect(ui.chkOpenCredentials, SIGNAL(clicked(bool)), this, SLOT(OnGeneralChanged()));
connect(ui.chkCloseClipBoard, SIGNAL(clicked(bool)), this, SLOT(OnGeneralChanged()));
connect(ui.chkBlockCapture, SIGNAL(clicked(bool)), this, SLOT(OnGeneralChanged()));
connect(ui.chkVmRead, SIGNAL(clicked(bool)), this, SLOT(OnVmRead()));
connect(ui.chkVmReadNotify, SIGNAL(clicked(bool)), this, SLOT(OnGeneralChanged()));
//connect(ui.chkOpenSmartCard, SIGNAL(clicked(bool)), this, SLOT(OnGeneralChanged()));
@ -282,6 +283,7 @@ void COptionsWindow::LoadGeneral()
ui.chkOpenProtectedStorage->setChecked(m_BoxTemplates.contains("OpenProtectedStorage"));
ui.chkOpenCredentials->setChecked(!ui.chkOpenCredentials->isEnabled() || m_pBox->GetBool("OpenCredentials", false));
ui.chkCloseClipBoard->setChecked(!m_pBox->GetBool("OpenClipboard", true));
ui.chkBlockCapture->setChecked(m_pBox->GetBool("IsBlockCapture", false));
ui.chkVmReadNotify->setChecked(m_pBox->GetBool("NotifyProcessAccessDenied", false));
//ui.chkOpenSmartCard->setChecked(m_pBox->GetBool("OpenSmartCard", true));
//ui.chkOpenBluetooth->setChecked(m_pBox->GetBool("OpenBluetooth", false));
@ -416,6 +418,7 @@ void COptionsWindow::SaveGeneral()
if (ui.chkOpenCredentials->isEnabled())
WriteAdvancedCheck(ui.chkOpenCredentials, "OpenCredentials", "y", "");
WriteAdvancedCheck(ui.chkCloseClipBoard, "OpenClipboard", "n", "");
WriteAdvancedCheck(ui.chkBlockCapture, "IsBlockCapture", "y", "n");
WriteAdvancedCheck(ui.chkVmReadNotify, "NotifyProcessAccessDenied", "y", "");
//WriteAdvancedCheck(ui.chkOpenSmartCard, "OpenSmartCard", "", "n");
//WriteAdvancedCheck(ui.chkOpenBluetooth, "OpenBluetooth", "y", "");
@ -1204,4 +1207,4 @@ void COptionsWindow::OnRestoreHeader()
if (RunImBox(Arguments))
QMessageBox::information(this, "Sandboxie-Plus", tr("Image Header Restored"));
}
}