Which functions does Classic UI support?

[ghost]

Sandboxie Documentaiton appears inaccurate. Sandboxie Classic supports some features (through Sandboxie.ini editing) that are marked as "Sandboxie-Plus Features". Is there an accurate list?

Some other quesitons:

• How to edit allowed/disallowed system calls for Security Hardened boxes via Sandboxie.ini in Classic Sandboxie?
• How to enable SID randomization via Sandboxie.ini in Classic Sandboxie?

[bastik-1001]

There are features, that have been added to Sandboxie, for which there are graphical user interface options in Sandboxie-Plus's sandbox manager, SandMan, but not in the older Sandboxie Control, since that is not being worked on, as stated by David.

How to edit allowed/disallowed system calls for Security Hardened boxes via Sandboxie.ini in Classic Sandboxie?

ApproveWinNtSysCall= entries can be added in the global section and requires the driver to be reloaded. I assume that this means rebooting for the Classic version. Default ApproveWinNtSysCall= entries are in the templates.ini, removing them works temporarily, until the file is update via a new release or if the file is updated by other means, like the updater.

How to enable SID randomization via Sandboxie.ini in Classic Sandboxie?

You have to add SandboxieLogon=y, which can be done globally or per sandbox.

[ghost]

Thanks a bunch! I think it would be even better if Sandboxie could randomly generate and assign one of those Windows InBox/LowBox AppContainer SID ("ALL APPLICATION PACKAGES" or "ALL RESTRICTED APPLICATION PACKAGES") because "Sandboxie/BoxName" SID gives away that application is running inside Sandboxie in case SID leaks somehow. "ANONYMOUS LOGON" is more private, I think.

How do I go about blocking system calls? DisapproveNtSysCall?

I want to prevent duplicate NamedPipe instances and NamedPipe client impersonation.

[bastik-1001]

I can't address this. and I am just saying that so you don't think I ignore you.

[ghost]

Thanks! I decided to edit my reply and make it real short. I just need to know how to block system calls because vanilla template only lists rules for how to allow them, not block them.

[bastik-1001]

Whenever calls have been approved, they are applied globally. I asked for DisproveWinNtSysCall (#3641) where I know this from, since my idea was to be able to fine-tune it per box. So far, it appears that you can only remove an approved call, which then applies to all security hardened boxes.