From 7ad047b219a5486fd94ffe6cf68fe15c615136fc Mon Sep 17 00:00:00 2001
From: DavidXanatos <3890945+DavidXanatos@users.noreply.github.com>
Date: Wed, 28 Aug 2024 09:13:23 +0200
Subject: [PATCH] new option
---
SandboxiePlus/SandMan/Forms/OptionsWindow.ui | 167 +++++++++---------
.../SandMan/Windows/OptionsAdvanced.cpp | 3 +
2 files changed, 90 insertions(+), 80 deletions(-)
diff --git a/SandboxiePlus/SandMan/Forms/OptionsWindow.ui b/SandboxiePlus/SandMan/Forms/OptionsWindow.ui
index 60bde68b..ad2b7aac 100644
--- a/SandboxiePlus/SandMan/Forms/OptionsWindow.ui
+++ b/SandboxiePlus/SandMan/Forms/OptionsWindow.ui
@@ -45,7 +45,7 @@
QTabWidget::North
- 10
+ 1
@@ -1780,23 +1780,6 @@
-
-
-
-
-
-
- 75
- true
- true
-
-
-
- Protect the sandbox integrity itself
-
-
- Sandboxie token
-
-
-
-
@@ -1811,63 +1794,6 @@
- -
-
-
- Start the sandboxed RpcSs as a SYSTEM process (not recommended)
-
-
-
- -
-
-
- Qt::Horizontal
-
-
-
- 40
- 20
-
-
-
-
- -
-
-
- Using a custom Sandboxie Token allows to isolate individual sandboxes from each other better, and it shows in the user column of task managers the name of the box a process belongs to. Some 3rd party security solutions may however have problems with custom tokens.
-
-
- true
-
-
-
- -
-
-
- Do not start sandboxed services using a system token (recommended)
-
-
-
- -
-
-
- Use a Sandboxie login instead of an anonymous token
-
-
-
- -
-
-
- Qt::Vertical
-
-
-
- 20
- 5
-
-
-
-
-
@@ -1889,6 +1815,40 @@
+ -
+
+
+ Protect sandboxed SYSTEM processes from unprivileged processes
+
+
+
+ -
+
+
+
+ 75
+ true
+ true
+
+
+
+ Protect the sandbox integrity itself
+
+
+ Sandboxie token
+
+
+
+ -
+
+
+ Using a custom Sandboxie Token allows to isolate individual sandboxes from each other better, and it shows in the user column of task managers the name of the box a process belongs to. Some 3rd party security solutions may however have problems with custom tokens.
+
+
+ true
+
+
+
-
@@ -1896,6 +1856,19 @@
+ -
+
+
+ Qt::Horizontal
+
+
+
+ 40
+ 20
+
+
+
+
-
@@ -1913,14 +1886,41 @@
- -
-
+
-
+
- Protect sandboxed SYSTEM processes from unprivileged processes
+ Start the sandboxed RpcSs as a SYSTEM process (not recommended)
- -
+
-
+
+
+ Use a Sandboxie login instead of an anonymous token
+
+
+
+ -
+
+
+ Do not start sandboxed services using a system token (recommended)
+
+
+
+ -
+
+
+ Qt::Vertical
+
+
+
+ 20
+ 5
+
+
+
+
+ -
Checked: A local group will also be added to the newly created sandboxed token, which allows addressing all sandboxes at once. Would be useful for auditing policies.
@@ -1934,6 +1934,13 @@ Partially checked: No groups will be added to the newly created sandboxed token.
+ -
+
+
+ Drop ConHost.exe Process Integrity Level
+
+
+
@@ -5256,7 +5263,7 @@ instead of "*".
0
0
- 75
+ 92
16
diff --git a/SandboxiePlus/SandMan/Windows/OptionsAdvanced.cpp b/SandboxiePlus/SandMan/Windows/OptionsAdvanced.cpp
index 732b4117..aa841631 100644
--- a/SandboxiePlus/SandMan/Windows/OptionsAdvanced.cpp
+++ b/SandboxiePlus/SandMan/Windows/OptionsAdvanced.cpp
@@ -31,6 +31,7 @@ void COptionsWindow::CreateAdvanced()
connect(ui.chkElevateRpcss, SIGNAL(clicked(bool)), this, SLOT(OnAdvancedChanged()));
connect(ui.chkProtectSystem, SIGNAL(clicked(bool)), this, SLOT(OnAdvancedChanged()));
connect(ui.chkDropPrivileges, SIGNAL(clicked(bool)), this, SLOT(OnAdvancedChanged()));
+ connect(ui.chkDropConHostIntegrity, SIGNAL(clicked(bool)), this, SLOT(OnAdvancedChanged()));
connect(ui.chkOpenCOM, SIGNAL(clicked(bool)), this, SLOT(OnOpenCOM()));
connect(ui.chkComTimeout, SIGNAL(clicked(bool)), this, SLOT(OnAdvancedChanged()));
@@ -168,6 +169,7 @@ void COptionsWindow::LoadAdvanced()
ui.chkElevateRpcss->setChecked(m_pBox->GetBool("RunRpcssAsSystem", false));
ui.chkProtectSystem->setChecked(!m_pBox->GetBool("ExposeBoxedSystem", false));
ui.chkDropPrivileges->setChecked(m_pBox->GetBool("StripSystemPrivileges", true));
+ ui.chkDropConHostIntegrity->setChecked(m_pBox->GetBool("DropConHostIntegrity", false));
ui.chkForceRestart->setChecked(m_pBox->GetBool("ForceRestartAll", false));
@@ -424,6 +426,7 @@ void COptionsWindow::SaveAdvanced()
WriteAdvancedCheck(ui.chkElevateRpcss, "RunRpcssAsSystem", "y", "");
WriteAdvancedCheck(ui.chkProtectSystem, "ExposeBoxedSystem", "", "y");
WriteAdvancedCheck(ui.chkDropPrivileges, "StripSystemPrivileges", "", "n");
+ WriteAdvancedCheck(ui.chkDropConHostIntegrity, "DropConHostIntegrity", "y", "");
WriteAdvancedCheck(ui.chkComTimeout, "RpcMgmtSetComTimeout", "n", "");