Win10 - SandboxieCrypto.exe prevents Windows updates from installing

I can confirm this behaviour.

It seems that there is no other way to report Sandboxie problems than to post it in this forum.

Has this post been noted by the Sandboxie maintainers? Is there anything I am supposed to do in order to report this (probable) bug?

That would mean that SandboxCrypto.exe has a handle open to the file outside of the sandbox. Can you verify that on your machine? You can use a tool like "Process Explorer" to determine if that is happening.

Yes, it has opened handles in the "C:\Windows\system32\catroot2" folder, as I have written, every time Firefox is opened. I don't know where to find the list of opened handles in the Process Explorer, but I see that using another tool (without further information).

I cannot repro this because my Firefox install does not cause the SandboxCrypto.exe to launch. This might be due to some plugin that is running. There might also be an program outside injecting code that performs operations that require the Crypt Service.

Even if I couldn't reproduce this, we think the source of this problem is that recently Sandboxie opens the CatRoot2 folder by default. We are looking at the code why we had to do so.

[EDIT] Actually I retract my last statement. We are not opening up the CatRoot2 folder by default. So while sandboxie can copy the content of the folder into the sandboxie, it should not hold onto the file. You might want to look at the sandbox configuration for any customization that opens up the CatRoot2 folder.

[Akhilesh@Sophos] I cannot repro this because my Firefox install does not cause the SandboxieCrypto.exe to launch. This might be due to some plugin that is running.

That's strange. I've got two notebooks with similar setup, and on both the SandboxieCrypto.exe is immediately started by Firefox. Even when I create a new Firefox profile without addons and default config, SandboxieCrypto.exe is started every time.

Configuration:

Win10 Home + Sandboxie 5.31.2 x64 + Firefox 68.2.0esr x64,

Win10 Enterprise + Sandboxie 5.31.6 x64 + Firefox 68.4.2esr x64.

Edit:

Maybe these SB messages are related?

SBIE2214 Request to start service 'bits' was denied due to dropped rights
SBIE2219 Request was issued by program SandboxieDcomLaunch.exe [Internet]
SBIE2220 To permit use of Administrator privileges, please double-click on this message line

[Akhilesh@Sophos] I cannot repro this because my Firefox install does not cause the SandboxieCrypto.exe to launch. This might be due to some plugin that is running.

That's strange. I've got two notebooks with similar setup, and on both the SandboxieCrypto.exe is immediately started by Firefox. Even when I create a new Firefox profile without addons and default config, SandboxieCrypto.exe is started every time.

Configuration:

Win10 Home + Sandboxie 5.31.2 x64 + Firefox 68.2.0esr x64,

Win10 Enterprise + Sandboxie 5.31.6 x64 + Firefox 68.4.2esr x64.

Edit:

Maybe these SB messages are related?

SBIE2214 Request to start service 'bits' was denied due to dropped rights
SBIE2219 Request was issued by program SandboxieDcomLaunch.exe [Internet]
SBIE2220 To permit use of Administrator privileges, please double-click on this message line

@Akhilesh@Sophos More information:

SandboxieCrypto is a wrapper for the Windows cryptosvc (https://www.sandboxie.com/ServicePrograms). Without it, Firefox cannot access HTTPS sites. Hence it seems very improbable to me that your Firefox doesn't start this program.

I've played a bit with the Sandboxie configuration, cut it to the minimum, and Firefox still starts SandboxieCrypto.exe. I also temporarily upgraded FF to the latest version 75.0, and still the same. In fact, Firefox starts SandboxieCrypto.exe even in Windows 7, but this program doesn't lock the catroot2 directory there.

When I disallowed start of SandboxieCrypto.exe in the Sandboxie.ini, Firefox was unable to open HTTPS sites and I immediately got these errors:

SBIE2312 Could not enable BrowseNewProcess setting:  [99 / C0000001] (repeatedly, every few seconds)

Sanboxie Crypto - Could not load service DLL - cryptsvc.dll (a dialog window)

Here is my reduced Sandboxie.ini:

[GlobalSettings]

BoxNameTitle=y
Template=WindowsLive
Template=OfficeClickToRun
Template=SystemAudioStream
Template=WindowsRasMan
Template=WindowsFontCache
Template=WindowsDefender
Template=Avira_Antivirus
Template=NOD32
Template=SynapticsTouchPad
Template=FinePrint
Template=OfficeLicensing
ActivationPrompt=n
ForceDisableSeconds=180
ProcessGroup=<SandboxieApps>,Start.exe,SandboxieDcomLaunch.exe,SandboxieRpcSs.exe,SandboxieCrypto.exe
ProcessGroup=<FirefoxPrograms>,firefox.exe,crashreporter.exe

[Internet]

Enabled=y
BoxNameTitle=y
BorderColor=#00FFFF,ttl
ConfigLevel=7
AutoRecover=y
AutoDelete=y
NeverDelete=n
DropAdminRights=y
Template=AutoRecoverIgnore
Template=BlockPorts
Template=LingerPrograms
Template=Firefox_Phishing_DirectAccess
Template=Firefox_Profile_DirectAccess
ForceProcess=<FirefoxPrograms>
ClosedFilePath=!<InternetAccess>,InternetAccessDevices
ClosedFilePath=!<StartRunAccess>,*
ClosedKeyPath=!<StartRunAccess>,*
ProcessGroup=<StartRunAccess>,<SandboxieApps>,<InternetAccess>,<FirefoxPrograms>
ProcessGroup=<InternetAccess>,<FirefoxPrograms>
ClosedIpcPath=!<StartRunAccess>,*
NotifyInternetAccessDenied=n
NotifyStartRunAccessDenied=n

I think, however, that the problem is not in that SyndboxieCrypto.exe is started by FF, but in that in Win10 (not in Win7) it locks the catroot2 directory.

Could you, please, check that? Thank you.

Still cannot reproduce this with Firefox on Windows 10 (1909). Even with HTTPS sites.

It appears the folder is open for SandboxieCrypto, have to dig into the code. I think it's been that way for a long time (maybe even during Ronen's time).

In the source code, this might be relevant:

In dll\file.c(2736):
                // special case for SandboxieCrypto on Windows Vista,
                // which tries to open catdb that are locked by
                // the real CryptSvc process.  convert read-only access
                // to write access so the files can be migrated

This code has been around for a long time.

It may be worth trying to comment out the code and seeing if it's still relevant.

    [Akhilesh@Sophos] Still cannot reproduce this with Firefox on Windows 10 (1909). Even with HTTPS sites.

Do you mean that Firefox doesn't start SandboxieCrypto, or that SandboxieCrypto doesn't lock the catroot2 folder?

In the first case, does your Sandboxie.ini allow execution of SandboxieCrypto.exe? Explicitly, or implicitly? (In my Sandboxie.ini, there it is allowed explicitly.) What happens when you prohibit execution of SandboxieCrypto in Sandboxie.ini?

Or maybe you use a development version of Sandboxie that behaves differently? It's hard to believe that your FF would be able to use cryptosvc.dll without help from SandboxieCrypto.exe.

[Akhilesh@Sophos] In the source code, this might be relevant

I don't know where to find the source files, so I cannot comment on that. But it's definitely worth trying. It seems that the "real CryptSvc process" no longer locks catdb(2). It does that not even in Win7. On the other hand, the comment says that SandboxieCrypto asks for write locks, but in Win7 the catdb2 files are not locked, they are locked in Win10 only.

If you send me a custom build where you disable that lock, I can test that so that we know whether it helps. Thank you.