diff --git a/.github/workflows/action.yml b/.github/workflows/action.yml index e8edd31ca..ef9f4878a 100644 --- a/.github/workflows/action.yml +++ b/.github/workflows/action.yml @@ -30,7 +30,7 @@ jobs: uses: lycheeverse/lychee-action@v1.9.1 with: # Check all markdown files in repo - args: -vvv --no-progress --accept 200,429 './**/*.md' + args: -vvv --no-progress --max-redirects 50 --accept 200,429 './**/*.md' fail: true # To avoid automated spam, try to find an existing open issue before opening a new one diff --git a/Content/FileRootPath.md b/Content/FileRootPath.md index c5393bf59..d3de1861b 100644 --- a/Content/FileRootPath.md +++ b/Content/FileRootPath.md @@ -16,6 +16,12 @@ Usage: FileRootPath=C:\Sandbox\MySandbox ``` +Related [Sandboxie Control](SandboxieControl.md) setting: [Sandbox menu > Set Container Folder](SandboxMenu.md#set-container-folder) + +Related Sandboxie Plus setting: Options menu > Global Settings > Advanced Config > Sandboxie Config > Sandbox file system root + +**Technical Details** + The following substitution variables may be useful in this path. * [Shell Folders](ShellFolders.md) variables such as %Personal% which expands to the user's Documents folder diff --git a/Content/PrivacyConcerns.md b/Content/PrivacyConcerns.md index 7cfb8a52f..1c1c5a10d 100644 --- a/Content/PrivacyConcerns.md +++ b/Content/PrivacyConcerns.md @@ -2,7 +2,6 @@ This is an advanced topic, which explains that even after running a program under Sandboxie, your computer may still record _which_ programs were executed or what they did. It is important to emphasize that this is not a security breach as it will never allow sandboxed programs to infect or otherwise abuse your computer. However, this may be interesting reading for those concerned with the privacy aspects of using Sandboxie. - **Overview** The guiding principle of Sandboxie is to isolate and contain any actions taken by programs that Sandboxie supervises, for the purpose of keeping your computer and operating system in a clean and healthy state. @@ -25,37 +24,33 @@ This component is designed to improve application start up time by keeping copie Windows may store copies of programs files in this Prefetch folder even when the programs were executed under Sandboxie. -Prefetch behavior can be reduced to caching only programs using during the boot sequence, or to not cache anything at all. Follow these links for more information: +Prefetch behavior can be reduced to caching only programs using during the boot sequence, or to not cache anything at all. For more information: [https://www.ghacks.net/2008/01/13/enableprefetcher-in-prefetchparameters](https://www.ghacks.net/2008/01/13/enableprefetcher-in-prefetchparameters) +
[https://www.howtogeek.com/998/change-superfetch-to-only-cache-system-boot-files-in-vista](https://www.howtogeek.com/998/change-superfetch-to-only-cache-system-boot-files-in-vista) +
[https://www.howtogeek.com/989/how-to-disable-superfetch-on-windows-vista](https://www.howtogeek.com/989/how-to-disable-superfetch-on-windows-vista) **MUI Cache** Windows Explorer records in the registry the names of programs that are launched directly through it. This includes launching programs through the Start menu, the desktop, the quick launch area, or any folder views. It is true even if the right-click "Run Sandboxed" action is used to launch the program under Sandboxie. -The recorded information is kept in this registry key: -``` - HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache -``` +The recorded information is kept in this registry key: _HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache_ If launch a program through a Sandboxie facility (such as the Sandboxie Start menu) or through a program which is already running under Sandboxie, then this information is kept in the registry inside the sandbox. -There are various third-party registry clearing tools that can erase this information. +There are various third-party registry cleaning tools that can erase this information. + +**Windows Taskbar** -**Windows 7 Taskbar** +On Windows 7 and later, Windows Explorer stores information associated with icons on the taskbar. This information includes the icon for the program and the command used to launch it. The information is stored in files in the following folder, within the user profile folder: _%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts_ -On Windows 7 and later, Windows Explorer stores information associated with icons on the taskbar. This information includes the icon for the program and the command used to launch it. The information is stored in files in the following folder, within the user profile folder. -``` - %Appdata%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts -``` +The [Sandbox Settings > Applications > Miscellaneous](ApplicationsSettings.md#miscellaneous) settings page includes the setting "Permit programs to update jump lists in the Windows 7 taskbar". If this setting is enabled, additional files are created in the following folders, within the user profile folder: -The [Sandbox Settings > Applications > Miscellaneous](ApplicationsSettings.md#miscellaneous) settings page includes the setting "Permit programs to update jump lists in the Windows 7 taskbar". If this setting is enabled, additional files are created in the following folders, within the user profile folder. -``` - %Appdata%\Microsoft\Windows\Recent\CustomDestinations - %Appdata%\Microsoft\Windows\Recent\AutomaticDestinations -``` +_%AppData%\Microsoft\Windows\Recent\CustomDestinations_ +
+_%AppData%\Microsoft\Windows\Recent\AutomaticDestinations_ **Windows Page File** @@ -65,15 +60,14 @@ Programs that run under Sandboxie are still running in the same Windows operatin It is possible to configure Windows to clear the contents of the page file at shutdown. More information [here](https://winaero.com/clear-pagefile-shutdown-windows-10) and [here](https://www.vistax64.com/threads/virtual-memory-paging-file-clear-at-shutdown.157323). -It is possible to configure Windows Vista to encrypt the contents of the page file: -``` - * Run _secpol.msc_ to open the Local Security Policy editor - * Expand the group labeled _Public Key Policies_ - * Right-click _Properties_ on the item labeled _Encrypting File System_ - * Select _Allow_ to enable Encrypting File System - * Check the box to _Enable pagefile encryption_. - * Click OK and reboot to put the new setting into effect. -``` +It is possible to configure Windows to encrypt the contents of the page file: + +* Run _secpol.msc_ to open the _Local Security Policy_ editor +* Expand the group labeled _Public Key Policies_ +* Right-click _Properties_ on the item labeled _Encrypting File System_ +* Select _Allow_ to enable Encrypting File System (EFS) +* Click _Apply_ and then _OK_ +* Reboot to put the new setting into effect **Windows Hibernate File** @@ -81,19 +75,19 @@ Similar to the Windows Page File, the hibernate file stores a copy of the memory **System Restore** -Restore points are snapshots of the state of the operating system at some points in time. The System Restore components in Windows XP and later versions of Windows records and restores these snapshots. +Restore points are snapshots of the state of the operating system at some points in time. The System Restore component in Windows XP and later versions records and restores these snapshots. Snapshots are recorded in the (typically inaccessible) folder called _System Volume Information_ and may include [many types of files](https://docs.microsoft.com/en-us/windows/win32/sr/monitored-file-extensions) found throughout the system, including within the folders of the sandbox. Thus it is possible that System Restore will create backup copies in its folders for files or programs that exist only in the sandbox. -The System Restore component ignores files and folders in temporary folders, so [moving the sandbox](SandboxMenu.md) to C:\TEMP\SANDBOX instead of the default C:\SANDBOX should cause System Restore to ignore the sandbox when creating a snapshot. +The System Restore component can be set to ignore files and folders in temporary folders, so [moving the sandbox](FileRootPath.md) to _%TEMP%\SANDBOX_ (instead of the default _C:\SANDBOX_) and adding the path within the registry key [FilesNotToSnapshot](https://learn.microsoft.com/en-us/windows/win32/vss/excluding-files-from-shadow-copies#using-the-filesnottosnapshot-registry-key), System Restore should ignore the sandbox when creating a Shadow Copy snapshot. More information [here](https://learn.microsoft.com/en-us/windows/win32/backup/registry-keys-for-backup-and-restore). **System, Audit and Other Event Logs** Windows sometimes records bits of information about running programs in its various [event logs](https://en.wikipedia.org/wiki/Event_Viewer). Typically, very little if any information is logged about a program. However, if security auditing has been enabled for some aspects of the system, Windows will have no trouble logging the details of any actions taken by a program running under Sandboxie. -Windows has an Event Viewer program which can be used to view and delete the event logs. [More information here](https://www.howtogeek.com/123646/htg-explains-what-the-windows-event-viewer-is-and-how-you-can-use-it). +Windows has an Event Viewer program which can be used to view and delete the event logs. More information [here](https://www.howtogeek.com/123646/htg-explains-what-the-windows-event-viewer-is-and-how-you-can-use-it). **Windows System Tray Icons** @@ -101,7 +95,7 @@ When a programs which is running under Sandboxie asks to place an icon in the [s This has the advantage that interaction with the tray icon of the sandboxed program is as easy as interacting with any other tray icon. However, it also means that Windows will record this icon and its description in the history of all tray icons it has ever displayed. -It is possible to manually clear this history in [Windows](https://www.howtogeek.com/739/clean-up-past-notification-icons-in-windows-vista). There may also be third-party registry clearing tools that can erase this information. +It is possible to manually clear this history in [Windows](https://www.howtogeek.com/739/clean-up-past-notification-icons-in-windows-vista). There may also be third-party registry cleaning tools that can erase this information. **Disk Defragmentation** @@ -119,4 +113,4 @@ There are various third-party solutions for anonymous Web access. More informati **Windows DNS Host Cache** -Sandboxie does not prevent the logging and storage of DNS Hosts files (Your DNS cache) on your Windows machine. This is written to C:\Windows\System32\drivers\etc in Windows. +Sandboxie does not prevent the logging and storage of the _hosts_ file (DNS cache) on your Windows machine. This is written to _C:\Windows\System32\drivers\etc_. diff --git a/Content/SandboxMenu.md b/Content/SandboxMenu.md index 7962476ca..1c521b7a1 100644 --- a/Content/SandboxMenu.md +++ b/Content/SandboxMenu.md @@ -57,7 +57,7 @@ The _Create New Sandbox_ command defines a new sandbox in Sandboxie. A dialog bo ### Set Container Folder -The _Set Container Folder_ command selects the container (or master, or parent) folder which will contain all other sandboxes. The default location is **X:\Sandbox\%USER%\%SANDBOX%**, where **X:** stands for the drive where Windows is installed, typically **C:**. +The _Set Container Folder_ command selects the container (or master, or parent) folder which will contain all other sandboxes. The default location is **X:\\Sandbox\\%USER%\\%SANDBOX%**, where **X:** stands for the drive where Windows is installed, typically **C:**. The special variable **%SANDBOX%** is replaced by the name of the sandbox.