3 ms·

RunInSandbox: Run/extract files in Windows Sandbox with a right-click

92 points by akyuu 3y ago

d0100 3y ago
What's different from running in Sandboxy?
- beardog 3y ago
  Windows Sandbox is an official Microsoft feature that uses hardware virtualization for quickly made disposable Windows VMs. Sandboxie is an OS-level 3rd party app that uses syscall hacks to sandbox applications. I say use Windows Sandbox if you care about security more than convenience.
- andersa 3y ago
  Windows Sandbox is a full VM with all the advantages that brings, like most definitely a stronger security boundary around it, as well as all the disadvantages, like not properly sharing RAM and GPU access. You also can't make a Windows Sandbox persistent in any way which makes the feature entirely useless for most uses cases I can think of. Don't understand the decision.
  - eviks 3y ago
    Yeah, lack of persistence is a bummer
    - akyuu 3y ago
      You can more or less get around this by using shared folders and logon commands on the .wsb configuration file [1]. For example, suppose you want to sandbox your torrent client. You can create a .wsb file to give the sandbox access to the torrent client application folder as well as your downloads folder, and specify a logon command like "C:\Shared\Torrent client\torrent.exe". When you click the .wsb file, a sandbox will spawn and the torrent client will automatically start, but it will only have access to the two folders you shared, not all the filesystem. And once you close it, the sandbox will be wiped, but the data on the shared folders will remain. This can work for many programs, especially portable applications, games, and other software that doesn't interact with the broader OS. Just by sharing the program folder, you can get "persistence" in a way. [1] https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file https://learn.microsoft.com/en-us/windows/security/applicati...
      - eviks 3y ago
        Thanks for the tip
apatheticonion 3y ago
My understanding is that Sandbox runs on top of Hyper-V. Is it a VM? Is it some kind of native Windows container? Why can you only run one instance at a time?
- lifthrasiir 3y ago
  It's a VM plus lightweight guest OS to leverage the host resource as much as possible, so can be thought as a container (but not as independent as typical containers, the guest OS should be synchronized with the host OS). And I think multiple sandbox instances can coexist.
  - apatheticonion 3y ago
    Thanks for the insight > And I think multiple sandbox instances can coexist. Maybe I need to know the magic registry edit to allow it. Windows tells me it's not allowed when I try to spawn more than one
    - lifthrasiir 3y ago
      Ah! Sorry for the confusion, you are right that there can be at most one Windows Sandbox running at a time. But Windows Sandbox is based on Windows Containers [1] which can coexist (Defender already uses the same technology, so this must be true), and it seems that the single instance limitation of Sandbox is more or less artificial [2]. I haven't yet seen a third-party attempt to emulate Sandbox but it looks in principle possible. [1] https://learn.microsoft.com/en-us/virtualization/windowscontainers/about/ https://learn.microsoft.com/en-us/virtualization/windowscont... [2] https://research.checkpoint.com/2021/playing-in-the-windows-sandbox/ https://research.checkpoint.com/2021/playing-in-the-windows-...
dustyharddrive 3y ago
Is there anything like this for Linux aside from Qubes?
- the8472 3y ago
  Kata containers, gvisor? Or if you want GUI application sandboxed then I've heard of people assembling VM filesystems on the fly and booting up a VM in qemu/kvm, but idk if that's available in a neat package.
- _____k 3y ago
  The one I am aware of is SELinux sandbox, however it is not a vm. 1. https://manpages.debian.org/stretch/policycoreutils-python-utils/sandbox.8.en.html https://manpages.debian.org/stretch/policycoreutils-python-u... 2. https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/chap-security-enhanced_linux-securing_programs_using_sandbox https://access.redhat.com/documentation/en-us/red_hat_enterp...
x3874 3y ago
How is this 'better' / different than Sandboxie? Edit: i see.
haunter 3y ago
> Context menus issues. If context menus are not displayed Windows right click context menus are pita. I don’t know but for some applications I could never make them work. Case in point I struggle with recently: Windows Explorer > open a Windows Terminal in the current folder. I can do it if I right click the folder itself but once I open the folder and I right click the empty space inside there it doesn’t work (but I can open a Powershell there to make it even more confusing). Wasted so many hours on that but never could make it work.
- finger 3y ago
  In Windows Explorer you can write "cmd" (without quotes) in the address bar to open a command prompt in the current directory. Similarly you can write "powershell" (without quotes) to open a powershell window in the current directory. Also there is the shortcut Ctrl+L to move input focus to the address bar.

92 points by akyuu 3y ago

d0100 3y ago

What's different from running in Sandboxy?

beardog 3y ago
Windows Sandbox is an official Microsoft feature that uses hardware virtualization for quickly made disposable Windows VMs. Sandboxie is an OS-level 3rd party app that uses syscall hacks to sandbox applications. I say use Windows Sandbox if you care about security more than convenience.
andersa 3y ago
Windows Sandbox is a full VM with all the advantages that brings, like most definitely a stronger security boundary around it, as well as all the disadvantages, like not properly sharing RAM and GPU access. You also can't make a Windows Sandbox persistent in any way which makes the feature entirely useless for most uses cases I can think of. Don't understand the decision.
- eviks 3y ago
  Yeah, lack of persistence is a bummer
  - akyuu 3y ago
    You can more or less get around this by using shared folders and logon commands on the .wsb configuration file [1]. For example, suppose you want to sandbox your torrent client. You can create a .wsb file to give the sandbox access to the torrent client application folder as well as your downloads folder, and specify a logon command like "C:\Shared\Torrent client\torrent.exe". When you click the .wsb file, a sandbox will spawn and the torrent client will automatically start, but it will only have access to the two folders you shared, not all the filesystem. And once you close it, the sandbox will be wiped, but the data on the shared folders will remain. This can work for many programs, especially portable applications, games, and other software that doesn't interact with the broader OS. Just by sharing the program folder, you can get "persistence" in a way. [1] https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file https://learn.microsoft.com/en-us/windows/security/applicati...
    - eviks 3y ago
      Thanks for the tip

apatheticonion 3y ago

My understanding is that Sandbox runs on top of Hyper-V. Is it a VM? Is it some kind of native Windows container? Why can you only run one instance at a time?

lifthrasiir 3y ago
It's a VM plus lightweight guest OS to leverage the host resource as much as possible, so can be thought as a container (but not as independent as typical containers, the guest OS should be synchronized with the host OS). And I think multiple sandbox instances can coexist.
- apatheticonion 3y ago
  Thanks for the insight > And I think multiple sandbox instances can coexist. Maybe I need to know the magic registry edit to allow it. Windows tells me it's not allowed when I try to spawn more than one
  - lifthrasiir 3y ago
    Ah! Sorry for the confusion, you are right that there can be at most one Windows Sandbox running at a time. But Windows Sandbox is based on Windows Containers [1] which can coexist (Defender already uses the same technology, so this must be true), and it seems that the single instance limitation of Sandbox is more or less artificial [2]. I haven't yet seen a third-party attempt to emulate Sandbox but it looks in principle possible. [1] https://learn.microsoft.com/en-us/virtualization/windowscontainers/about/ https://learn.microsoft.com/en-us/virtualization/windowscont... [2] https://research.checkpoint.com/2021/playing-in-the-windows-sandbox/ https://research.checkpoint.com/2021/playing-in-the-windows-...

dustyharddrive 3y ago

Is there anything like this for Linux aside from Qubes?

the8472 3y ago
Kata containers, gvisor? Or if you want GUI application sandboxed then I've heard of people assembling VM filesystems on the fly and booting up a VM in qemu/kvm, but idk if that's available in a neat package.
_____k 3y ago
The one I am aware of is SELinux sandbox, however it is not a vm. 1. https://manpages.debian.org/stretch/policycoreutils-python-utils/sandbox.8.en.html https://manpages.debian.org/stretch/policycoreutils-python-u... 2. https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/chap-security-enhanced_linux-securing_programs_using_sandbox https://access.redhat.com/documentation/en-us/red_hat_enterp...

x3874 3y ago

How is this 'better' / different than Sandboxie? Edit: i see.

haunter 3y ago

> Context menus issues. If context menus are not displayed Windows right click context menus are pita. I don’t know but for some applications I could never make them work. Case in point I struggle with recently: Windows Explorer > open a Windows Terminal in the current folder. I can do it if I right click the folder itself but once I open the folder and I right click the empty space inside there it doesn’t work (but I can open a Powershell there to make it even more confusing). Wasted so many hours on that but never could make it work.

finger 3y ago
In Windows Explorer you can write "cmd" (without quotes) in the address bar to open a command prompt in the current directory. Similarly you can write "powershell" (without quotes) to open a powershell window in the current directory. Also there is the shortcut Ctrl+L to move input focus to the address bar.