Cannot run GOG Galaxy inside Sandboxie

[thejavascriptman]

Describe the bug
Installing GOG Galaxy inside of Sandboxie causes various errors related to GalaxyClientService.exe / GalaxyCommunication.exe which seem to request administrator permissions while the UI GalaxyClient.exe does not (this is just a guess)

To Reproduce
Steps to reproduce the behavior:

1. Download GOG Galaxy from https://www.gog.com/galaxy
2. Create a new sandbox with default template
3. Run the installer inside of the new sandbox
4. You will get an error like "Essential components are missing...", however installer will finish anyway
5. After closing the installer, GOG galaxy will not launch without being unusable and slow (even if the "Run after closing the installer" checkbox is checked)
6. If GOG Galaxy is started manually you will get various errors related to GalaxyClientService.exe / GalaxyCommunication.exe and the UI will be unusable due to slowness

Expected behavior
GOG Galaxy should start quick and GalaxyClientService.exe / GalaxyCommunication.exe shouldn't crash

Screenshots

System details and installed software (please provide the following information):

• Windows 7 x64 / Windows 10 21H1 / Windows 10 22H2
• Sandboxie Plus 0.9.6 up to Sandboxie-Plus-x64-v1.11.2
• Please mention in which version this bug got introduced: Not sure, haven't used Sandboxie before
• Please mention any security software running in the background: None, Windows defender disabled

Additional context
Tested a lot of settings combinations including

DropAdminRights=y
FakeAdminRights=y
UnrestrictedSCM=y
OpenDevCMApi=y
OpenSamEndpoint=y
OpenLsaEndpoint=y
BlockNetworkFiles=n
OpenWinClass=#
MsiInstallerExemptions=y

If I use PipeTrace=AD and IpcTrace=AD I get
https://gist.github.com/thejavascriptman/ebbbb1e0360d3b0c1ca89fe43ee6feb5

Sandboxie configuration

Minimal configuration

Enabled=y
AutoRecover=n
BlockNetworkFiles=y
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
RecoverFolder=%Personal%
RecoverFolder=%Desktop%
BorderColor=#00FFFF,ttl
Template=OpenBluetooth
Template=SkipHook
Template=FileCopy
Template=qWave
Template=BlockPorts
Template=LingerPrograms
Template=Chrome_Phishing_DirectAccess
Template=Firefox_Phishing_DirectAccess
Template=AutoRecoverIgnore
ConfigLevel=9

[isaak654]

This is a known issue since 2016, when Invincea developed Sandboxie:
https://sandboxie-website-archive.github.io/www.sandboxie.com/old-forums/viewtopic59fa59fa.html?f=5&t=23233

I think that the issue (or part of it) is the GalaxyCommunication.exe process that keeps terminating itself and recreated continuosly in a sort of loop... if you try to block it with a ClosedFilePath, the program will still crash.

I tried these settings too, but they won't help: #1227

A few GOG threads about it:

• https://www.gog.com/forum/general/gog_galaxy_tanking_my_upload
• https://www.gog.com/forum/general_beta_gog_galaxy_2.0/connection_to_communication_service_was_lost_and_could_not_be_restored_gog_galaxy_will_now_shutdown_
• https://www.gog.com/forum/general/connect_to_gog_galaxy_communication_service_was_lost_and_could_not_be_restored/page5

[thejavascriptman]

Thank you for the explanation, should we keep this issue open or would you prefer to have it closed?

[isaak654]

Thank you for the explanation, should we keep this issue open or would you prefer to have it closed?

I think this issue should stay open, unless there is a technical reason provided by the current maintainer.

[Vincent14]

Doest it worked previously for Gog Galaxy?

[isaak654]

This is a known issue since 2016, when Invincea developed Sandboxie:
https://sandboxie-website-archive.github.io/www.sandboxie.com/old-forums/viewtopic59fa59fa.html?f=5&t=23233

I think it never worked if installed in a sandbox. The only workaround is installing it outside of the sandbox and set it as forced program to load on Sandboxie.

[DavidXanatos]

the underlying issue with service handling will be fixed in the next build to run gog a green compartment type box is required with the following options

UnrestrictedSCM=y
RunServicesAsSystem=y
NoSecurityIsolation=y
Template=RpcPortBindingsExt

I'll look if its possible to add workarounds to make this obsolete but that will take time as there are at least two more issues when trying to run in a yellow box