Resource Access
Resource Access Settings control how sandboxed programs access resources. Some rules distinguish whether the requesting program's executable file is loaded from outside or inside the sandbox.
Both columns below describe programs running under Sandboxie. "Yes" means that a rule is eligible to apply to a program at that executable location, not that access is allowed. Program selectors, rule precedence, and other security restrictions still affect the result.
| Setting | Executable outside the sandbox | Executable inside the sandbox |
|---|---|---|
| ClosedClsid | Yes | Yes |
| ClosedFilePath | Yes | Yes |
| ClosedIpcPath | Yes | Yes |
| ClosedKeyPath | Yes | Yes |
| ClosedRT | Yes | Yes |
| NoRenameWinClass | Yes | Yes |
| NormalFilePath | Yes | Yes |
| NormalIpcPath | Yes | Yes |
| NormalKeyPath | Yes | Yes |
| OpenClsid | Yes | Yes |
| OpenConfPath | Yes | Yes |
| OpenFilePath | Yes | No by default |
| OpenIpcPath | Yes | Yes |
| OpenKeyPath | Yes | No by default |
| OpenPipePath | Yes | Yes |
| OpenWinClass | Yes | Yes |
| ReadFilePath | Yes | Yes |
| ReadIpcPath | Yes | Yes |
| ReadKeyPath | Yes | Yes |
| WriteFilePath | Yes | Yes |
| WriteKeyPath | Yes | Yes |
The "No by default" entries describe the exclusion of ordinary OpenFilePath and OpenKeyPath rules for executables loaded from inside the sandbox. DontOpenForBoxed=n disables this exclusion, as does Application Compartment mode. OpenPipePath and OpenConfPath are not subject to this exclusion.
ReadIpcPath refers here to its $:... target-process rules. These permit limited read access to another process and use a separate policy from generic named IPC-object matching; see Read IPC Path.
When AlwaysCloseForBoxed is active (the default outside Application Compartment mode), a negated program selector such as !program.exe on ClosedFilePath, ClosedKeyPath, or ClosedIpcPath does not exempt an executable loaded from inside the sandbox. Setting AlwaysCloseForBoxed=n restores normal selector matching. Sandboxie components have an additional exception for negated ClosedIpcPath entries.