diff --git a/CHANGELOG.md b/CHANGELOG.md index 221b47c7..65657666 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,7 +24,7 @@ This project adheres to [Semantic Versioning](http://semver.org/). ### Fixed - fixed privacy mode, NormalFilePath and symbolic link issue [#3660](https://github.com/sandboxie-plus/Sandboxie/issues/3660) -- fixed Recycle Bin access in a sandbox with data protection [#3665](https://github.com/sandboxie-plus/Sandboxie/issues/3665) +- fixed access to Recycle Bin in an Application Compartment sandbox with data protection [#3665](https://github.com/sandboxie-plus/Sandboxie/issues/3665) @@ -43,13 +43,13 @@ This project adheres to [Semantic Versioning](http://semver.org/). - added missing checkbox for API tracing - fixed incompatibility with Windows ARM64 Insider build 26052 and later - fixed symlink issue [#3537](https://github.com/sandboxie-plus/Sandboxie/issues/3537#issuecomment-1954496527) -- fixed bug with file redirection in Application Compartment sandbox [#3637](https://github.com/sandboxie-plus/Sandboxie/issues/3637) +- fixed file redirection issue in an Application Compartment sandbox [#3637](https://github.com/sandboxie-plus/Sandboxie/issues/3637) - fixed issues with compartment mode compatibility fallback - fixed missing maximum password length check [#3639](https://github.com/sandboxie-plus/Sandboxie/issues/3639) - fixed issue with launching executables from volumes without a drive letter in a sandbox on Windows 1803 and earlier [#3627](https://github.com/sandboxie-plus/Sandboxie/issues/3627) ### Removed -- removed UseNewSymlinkResolver setting, new mechanism is always used +- removed UseNewSymlinkResolver setting, as the new mechanism is always used @@ -1827,7 +1827,7 @@ This project adheres to [Semantic Versioning](http://semver.org/). ### Added - replaced "Open with" with a Sandboxie dialog to work on Windows 10 [#1138](https://github.com/sandboxie-plus/Sandboxie/issues/1138) -- added ability to run Win32 store apps in app compartment mode (requires COM to be open in Windows 11) +- added ability to run Win32 store apps in Application Compartment mode (requires COM to be open in Windows 11) - Note: this does not mean UWP store apps, just regular Win32 apps packaged to be deployed via the store - added new debug options "UnstrippedToken=y" and "KeepUserGroup=y" - added double-click to recover files and folders in recovery window [#1466](https://github.com/sandboxie-plus/Sandboxie/issues/1466) @@ -1897,7 +1897,7 @@ This project adheres to [Semantic Versioning](http://semver.org/). - "EnableWin32kHooks=y" is now enabled by default, as no issues were reported in 1.0.3 - Note: currently only the GdiDdDDI* hooks are applied, required for Chromium HW acceleration - cleaned up low-level hooking code -- "RunRpcssAsSystem=y" is now auto applied for boxes in app compartment mode when "RunServicesAsSystem=y" or "MsiInstallerExemptions=y" are present +- "RunRpcssAsSystem=y" is now auto applied for sandboxes in Application Compartment mode when "RunServicesAsSystem=y" or "MsiInstallerExemptions=y" are present ### Fixed - fixed RPC handling in case a requested open service is not running [#1443](https://github.com/sandboxie-plus/Sandboxie/issues/1443) @@ -1960,18 +1960,18 @@ This project adheres to [Semantic Versioning](http://semver.org/). - added Privacy Enhanced mode, sandboxes with "UsePrivacyMode=y" will not allow read access to locations containing user data - all locations except generic Windows system paths will need to be opened explicitly for read and/or write access - using "NormalFilePath=...", "NormalKeyPath=...", "NormalIpcPath=..." allows to open locations to be readable and sandboxed -- added new app compartment mode of operation, it is enabled by adding "NoSecurityIsolation=y" to the box config +- added new Application Compartment mode of operation, it is enabled by adding "NoSecurityIsolation=y" to the sandbox config - in this mode, security is traded in for compatibility, it should not be used for untrusted applications - Note: in this mode, file and registry filtering are still in place, hence processes run without administrative privileges - it is reasonably safe, all filtering can be disabled with "NoSecurityFiltering=y" - added experimental use of ObRegisterCallbacks to filter object creation and duplication - - this filtering is independent from the regular SbieDrv's syscall-based filtering, hence it also applies to app compartments + - this filtering is independent from the regular SbieDrv's syscall-based filtering, hence it also applies to Application Compartments - with it enabled, an application running in a compartment will not be able to manipulate processes running outside the sandbox - - Note: this feature improves the security of non-isolated app compartment boxes + - Note: this feature improves the security of non-isolated Application Compartment sandboxes - to enable this feature, set "EnableObjectFiltering=y" in the global section and reload the driver - when globally activated, the filtering can be disabled for individual boxes with "DisableObjectFilter=y" - added "DontOpenForBoxed=n", this option disables the discrimination of boxed processes for open file and open key directives - - this behaviour does not really improve security anyway, but may be annoying, also app compartments always disable this + - this behaviour does not really improve security anyway, but may be annoying, also Application Compartments always disable this - added setting to entirely open access to the COM infrastructure ### Changed