Sample C++ project for launching executables and out-of-process COM servers in a sandboxed low integrity level (IL) or AppContainer process on the same machine. There's no need to create any additional user accounts.
Related project: Microsoft SandboxSecurityTools for testing of AppContainer Sandboxing.
Run RunInSandbox.exe [ac|li|mi|hi] ExePath [-b] to launch the ExePath application in an AppContainer, low IL, medium IL or high IL process. This works for STARTUPINFOEX-based process creation. The -b option is used to break execution immediately after process creation to enable debugging of startup problems.
Run RunInSandbox.exe [ac|li|mi|hi] ProgID [-g][-b] to launch the ProgID COM server in an AppContainer, low IL, medium IL or high IL process. The -g option is used to grant AppContainer permissions for the COM server, which only need to be done once.
Example usage:
RunInSandbox.exe ac TestControl.TestControl -gto start the TestControl project in a AppContainer process and test its COM API.RunInSandbox.exe li PowerPoint.Applicationto start Microsoft PowerPoint in a low IL process connected using COM automation.
This approach performs client-side user impersonation with ImpersonateLoggedOnUser for the current thread. Then the COM server is created with CLSCTX_ENABLE_CLOAKING to allow the COM server to be created with the current thread credentials.
| Token impersonation overview | |
|---|---|
| Low integrity level | Always works. |
| AppContainer | Works if ALL_APPLICATION_PACKAGES have been granted read&execute permissions for the COM EXE and the corresponding LaunchPermission AppID registry key grant ALL_APPLICATION_PACKAGES local activation permission. |
- How to apply
removableStoragecapability to enable USB stick access for the AppContainer. - Why is
SetCursorPosfailing at medium IL if the host is elevated (high IL). Impersonating the shell process (explorer.exe) to escape elevation doesn't seem to help. The problem appear to be caused by UIPI limitations tied to the foreground window.
Command-line tool for configuring COM servers to be started through a specific user account. Requires the COM server to already have an AppID registry entry. Very similar to dcompermex.
Instructions for how to configure COM servers to always run elevated, either with or without UAC.
Command-line tool to make a file or path writable by AppContainers and low IL process. Useful for whitelisting specific folders that should not be subject to application sandboxing.
For serious usage, it's recommended to instead use icacls for tweaking file security settings, since icacls is a official Microsoft tool bundled with Windows.
Examples:
icacls.exe <path> /setintegritylevel Lowto make a file or folder writable from low IL processes.icacls.exe <path> /grant *S-1-15-2-1:(OI)(CI)(F)to grant ALL_APP_PACKAGES full access to a given path.
C#/.Net sample code for launching an executable or COM class in an "elevated" process with admin privileges. The same functionality is also included in the RunInSandbox project.