Waterfox with data protection enabled can't read your profile

[Dyras]

Describe what you noticed and did

1. Install Waterfox outside of Sandboxie
2. Enable all templates + force it to run in a sandbox
3. Start the program, install some addons or something
4. Close Waterfox
5. Set the box type to one with data protection
6. Start Waterfox and notice that it's now using a new profile. What gives?

Well as it turns out, the files "installs.ini" and "profiles.ini" are in this folder:
%AppData%\Waterfox

For comparison, for Mozilla Firefox they are in this folder:
C:\Users\User\AppData\Roaming\Mozilla\Firefox

For some reason that I can't quite understand, Waterfox seems to care about this file not being included while Firefox doesn't.

Possible solutions I can think of:

Way 1:
Change
Tmpl.Waterfox=%AppData%\Waterfox\Profiles\*

To

Tmpl.Waterfox=%AppData%\Waterfox\Profiles*

^ Seems to work anyway, then again I've learned over the years that this computer is cursed so I'm gonna do some more testing on this, and I'll edit that in if I figure anything out.

Way 2:

Add the files here:

[Template_Waterfox_Profile_DirectAccess]
Tmpl.Title=#4338,Waterfox
Tmpl.Class=WebBrowser
OpenFilePath=waterfox.exe,%Tmpl.Waterfox%\*
%AppData%\Waterfox\installs.ini
%AppData%\Waterfox\profiles.ini

Way 3:

Add a new template for data protection:
[Template_Waterfox_Profile_DirectAccess_DP]
Tmpl.Title=#4338,Waterfox
Tmpl.Class=WebBrowser
OpenFilePath=%AppData%\Waterfox\profiles.ini
OpenFilePath=%AppData%\Waterfox\installs.ini

How often did you encounter it so far?

Whenever I run Waterfox with Data Protection

Expected behavior

The files should be included which means Data Protection will work as intended.

Affected program

Latest Waterfox

Download link

https://www.waterfox.net/

Where is the program located?

The program is installed only outside the sandbox.

Did the program or any related process close unexpectedly?

No, not at all.

Crash dump

No response

What version of Sandboxie are you running now?

1.13.4 64-bit

Is it a new installation of Sandboxie?

I just updated Sandboxie from a previous version (I remember which one it is).

Is it a regression from previous versions?

Nope

In which sandbox type you have this problem?

In a hardened sandbox with data protection (red sandbox icon).

Can you reproduce this problem on a new empty sandbox?

I can confirm it also on a new empty sandbox.

What is your Windows edition and version?

Windows 11 Education, but this also happened on Windows 10

In which Windows account you have this problem?

A Microsoft account (Administrator).

Please mention any installed security software

Windows Defender

Did you previously enable some security policy settings outside Sandboxie?

No response

Trace log

No response

Sandboxie.ini configuration

No response

[Rngexile]

The file profiles.ini have to be read by firefox/waterfox to know what are the available profiles and in data protection mode, exe can't read by default the real %AppData%. You have to explicitely add an access (read only or more).

You could add something similar in your waterfox box :
NormalFilePath=firefox.exe,C:\Users\myusername\AppData\Roaming\Mozilla\Firefox\profiles.ini

Or in your template :
NormalFilePath=waterfox.exe,%Tmpl.Waterfox%*
%AppData%\Waterfox\profiles.ini

I prefer a normal access than a direct acess but whatever suits your needs.

(Tmpl.Waterfox=%AppData%\Waterfox\Profiles* enables the read of directories and files begining by "profiles")

[APMichael]

By the way, we already had a discussion in 2022 about whether there should be templates for sandboxes with data protection:
#2372 (comment)

As @Rngexile has already written, you only need to add a "NormalFilePath" to your sandbox settings:
NormalFilePath=%AppData%\Waterfox\*

[Dyras]

@Rngexile
I know, I was thinking more about a new template or something which is apparently something we've discussed two years ago

@APMichael
Maybe we should have templates to make data protection work better? I'd happily write them if everyone is OK with the idea.

[Rngexile]

Interesting discussion you had in 2022. :)
Whatever solutions you could adopt or propose to David, i'm fine with it (adding rules to existing templates with new inlines privacymode, adding templates, adding normalfilepath to existing templates, ...) even if i probably won't use them more than i currently do, so probably none. :)

I prefer more granular approach, given i take time to check what my accesses and needs are.
So for example i find, as Isaak, the templates often too much open, in particular for "data protection" (advanced user) needs. And with that data protection feature in mind, it's partially counter productive.

As for examples :

[Template_Firefox_Profile_NormalAccess]
Tmpl.Title=#xxx,Mozilla Firefox
Tmpl.Class=WebBrowser
NormalFilePath=firefox.exe,%AppData%\Mozilla\Firefox*
NormalFilePath=firefox.exe,%Local AppData%\Mozilla\Firefox*

=> ALL of my firefox profiles can be read by any of my firefox "data protection box".
If i have a "shopping" (or "casual internet activities") firefox data protected box, it can read my "super privacy bank and stuff" firefox's profile.
It's not granular enought and opens potential exfiltration. I need to specify the particular firefox's profile directory for each data protected box.

[Template_Firefox_Bookmarks_DirectAccess]
Tmpl.Title=#4336,Mozilla Firefox
Tmpl.Class=WebBrowser
OpenFilePath=firefox.exe,%Tmpl.Firefox%\bookmark*
OpenFilePath=firefox.exe,%Tmpl.Firefox%\places*
OpenFilePath=firefox.exe,%Tmpl.Firefox%\favicons.sqlite

=> If i have a data protected box used for a "super privacy bank and stuff" with a particular firefox's profile it can be read and written by any other firefox box having that template active ...
It's not granular enought and opens potential exfiltration and unwilling changes (!).

[Template_Firefox_Passwords_DirectAccess]
Tmpl.Title=#4331,Mozilla Firefox
Tmpl.Class=WebBrowser
OpenFilePath=firefox.exe,%Tmpl.Firefox%\logins.json
OpenFilePath=firefox.exe,%Tmpl.Firefox%\key*.db

=> If i have a data protected box used for a "super privacy bank and stuff" with a particular firefox's profile it can be read and written by any other firefox box having that template active ...
It's not granular enought and opens potential exfiltration and unwilling changes (!).

Probably most people use only one firefox profile for everything, but advanced users with "data protection" needs should be careful with templates.

[APMichael]

@Dyras I had already expressed my opinion on this in 2022. And I personally still believe that special templates are not really necessary. (If they are added at some point anyway, I have no problem with that, of course).

By the way, when selecting a sandbox with data protection in the GUI, you will be informed (with a clickable link to the manual) that access to user data is blocked and that you must first allow this under "Resource Access":

"This box prevents access to all user data locations, except explicitly granted in the Resource Access options."
https://sandboxie-plus.com/privacy-mode/

[Dyras]

I know that it's blocked and that that is the entire purpose, etc. It's definitely not "necessary".

I just think that for the less tech-savvy, it would be nice with a template for this that can be enabled in a few clicks instead of having to go through Resource Access, especially when the file in question is deep inside of the %appdata% folder. I think normie users are more likely to back out than learn how to find which file isn't moving properly, which isn't great for what is essentially a pay-only feature.

Any thoughts @DavidXanatos ?

[bastik-1001]

My take on this is, that by default the data protection should not be reduced, unless data protection breaks the function of normal operation of Windows or general purpose software, e.g. it causes them to crash. This should apply to templates, which the user has to enable on purpose. When data protection is enabled, the user has to make the choice to add resources that need to be allowed to accomplish what the user had in mind. This could be too broad with templates that set NormalFilePath for the user, which is why I don't suggest adding them, but at the same time I am not opposing (which I am not in the position in, anyway) separate templates that aid less tech-savvy users.

There could be weak spots with this approach, but a sandbox with data protection that uses a too broad template (or templates) is still better than a sandbox without it, in terms of privacy. What needs to be avoided is one getting lazy and enable templates as it is quicker; users that can set it up to suit their needs should do so and not assume that the template will cover every use-case.

Maybe another approach to this is creating tutorials on how to find the required folders. Users would need to find and read them, which is a drawback. The point is to enable the user to learn about how these things work. Empowering them to make use of Sandboxie, to make it work in their way and get just a bit more used to dealing with folders. Abstractions are good in many cases (clicking to update something, instead of typing a command) and helpful, like with templates, but they can also go too far (some browsers hide parts of the URL, stripping https:// and www), so that there needs to be a balance. It's hard to chose where to draw the line. This requires some insight on how users deal with it.

[DavidXanatos]

I think we should create explicit templates which the user can enable in privacy mode, this is a secure and strait forward approach
@Dyras if you could create those templates that would be really helpful :D

[Dyras]

Howdy!

[Template_Waterfox_Profile_Data_Protection_Compatibility]
Tmpl.Title=#4343,Waterfox
Tmpl.Class=WebBrowser
NormalFilePath=waterfox.exe,%AppData%\Waterfox\profiles.ini
NormalFilePath=waterfox.exe,%AppData%\Waterfox\installs.ini

4343;txt;01
Enable %2 compatibility workarounds for the Data Protection sandbox types
.

I tried to keep the text as generic as possible so that we won't have 30 of them. But maybe we want that so that the user knows what is being allowed by the template?

If so, I propose something like

4343;txt;01
Allow %2 access to its profiles.ini and installs.ini for better Data Protection compatibility
.

If so, I'll download all of the browsers that I totally don't have installed already and check which ones need changes like these and which ones don't.

Perhaps I should make another one for users that want to use the "Auto delete" feature? My understanding is that "NormalFilePath" makes it writable inside of the sandbox rather than outside of it in the "real" file which will obviously cause issues.

[Template_Waterfox_Profile_Data_Protection_Auto_Delete_Compatibility]
Tmpl.Title=#4344,Waterfox
Tmpl.Class=WebBrowser
OpenFilePath=waterfox.exe,%AppData%\Waterfox\profiles.ini
OpenFilePath=waterfox.exe,%AppData%\Waterfox\installs.ini

4344;txt;01
Enable %2 compatibility workarounds for the Data Protection sandbox types with Auto Delete enabled
.

Seems like a nice compromise to me.

Any suggestions?

[APMichael]

Just my opinion: I think most users will not understand the function of this template, as it requires the additional use of the already existing browser templates. If only this template is activated, Waterfox still creates a new profile in the sandbox, as access to the profile folder is still not possible. With this template, however, the majority will probably think that the browser works as if it were in a yellow sandbox. The template should therefore be as follows:

NormalFilePath=%AppData%\Waterfox\*

Edit 1: #2372 (comment)

By the way, no "OpenFilePath" is required for the “Auto Delete” function of Sandboxie. Sandboxie has always used "NormalFilePath".

Edit 2: Sorry, the sentence is a bit short. I meant that only "NormalFilePath" has ever been used in a yellow standard sandbox and that there have never been any problems with browsers because of this. If you want to reinstall the browser or add a new profile, you should always do this outside the sandbox. Therefore, "OpenFilePath" is not really necessary for the two .ini files.

[Dyras]

Yeah I guess my thought processing was that this would be complimentary to the other profiles, but that isn't perfectly clear in any way. Makes sense that we should use the entire path then! I can do that.

I was under the impression that NormalFilePath won't allow you to edit the original file 🤔 but maybe I'm thinking of something else then.

So something like this sound be the optimal way to do it, I assume?

[Template_Waterfox_Profile_Data_Protection_Compatibility]
Tmpl.Title=#4343,Waterfox
Tmpl.Class=WebBrowser
NormalFilePath=%AppData%\Waterfox\*

4343;txt;01
Enable %2 compatibility workarounds for the Data Protection sandbox types
.

[APMichael]

It is true that "NormalFilePath" does not allow you to change the original file, but this is not necessary for the two .ini files. These are only changed if you want to create a new profile or (re)install the browser, and this should always be done outside a sandbox.

Yes, I think that should be fine:

[Template_Waterfox_Profile_Data_Protection_Compatibility]
Tmpl.Title=#4343,Waterfox
Tmpl.Class=WebBrowser
NormalFilePath=waterfox.exe,%AppData%\Waterfox\*

Or if, for example, the data for "safe browsing" should also be able to be read:

[Template_Waterfox_Profile_Data_Protection_Compatibility]
Tmpl.Title=#4343,Waterfox
Tmpl.Class=WebBrowser
NormalFilePath=waterfox.exe,%AppData%\Waterfox\*
NormalFilePath=waterfox.exe,%Local AppData%\Waterfox\*

[Rngexile]

[Template_Waterfox_Profile_Data_Protection_Compatibility]
Tmpl.Title=#4343,Waterfox
Tmpl.Class=WebBrowser
NormalFilePath=waterfox.exe,%AppData%\Waterfox*
NormalFilePath=waterfox.exe,%Local AppData%\Waterfox*

With such a large "read access" you currently open ALL waterfox's profileS to be read by any sandbox using your template and so it partially counters the purpose of the data protected stuff.
At minimal, should you not name the template [Template_Waterfox_ALL_ProfileS_Data_Protection_Compatibility]" as a warning ?
And maybe add a comment to explain the thing ?

If the user, while using the template, doesn't add explicit ClosedFilePath rules to the waterfox's profileS he doesn't want to use in his sandbox then he leaves the possibility to exfiltrate that content in the context of waterfox (he relies on the security of waterfox which we don't rely on too much because we use sandboxie-plus).
Same with the stuff inside %Local AppData%\Waterfox*.

[bastik-1001]

With such a large "read access" you currently open ALL waterfox's profileS to be read by any sandbox using your template and so it partially counters the purpose of the data protected stuff.
At minimal, should you not name the template [Template_Waterfox_ALL_ProfileS_Data_Protection_Compatibility]" as a warning ?
And maybe add a comment to explain the thing ?

IMO, the name should be chosen to reflect what the template does, so the more precise the name is the better. A comment that explains that this gives read access to all the profiles of the current user is indeed helpful.

Does anyone have data on how many users use different browser profiles? I imagine that users, that use multiple profiles and Sandboxie have a better technical understanding to be aware what the template does by giving read access to that folder, but still it should be made obvious that the template might not be the best fit. (Comparing it to default firewall rules in some products where for example FTP is allowed for some apps and the user being better off to make his own rules.)

[APMichael]

I think @Dyras surely has nothing against changing the name of the template and adding a comment with an appropriate note or warning.

As far as I know, there is no other option for a template that makes using the browser as easy as in a yellow standard sandbox, as only wildcards can be used for the random names of the profile folders. Data protection is still much better than in the standard sandbox, as all access is blocked except for the browser profiles. If anyone has a better idea, they are welcome to share it here.

Or you can use @Dyras first approach again, only with NormalFilePath=waterfox.exe,%AppData%\Waterfox\profiles.ini and a comment pointing out that this template must be activated if you want to use one of the browser templates in a sandbox with data protection. In my opinion, however, this carries a greater risk, as many will then additionally activate the "Profile_DirectAccess" template in order to be able to use their extensions. However, they will then also have write access, not just read access!

Perhaps @DavidXanatos can comment here again on which variant he would like to have in his Sanboxie-Plus.

[Rngexile]

Does anyone have data on how many users use different browser profiles? I imagine that users, that use multiple profiles and Sandboxie have a better technical understanding to be aware what the template does by giving read access to that folder, but still it should be made obvious that the template might not be the best fit. (Comparing it to default firewall rules in some products where for example FTP is allowed for some apps and the user being better off to make his own rules.)

I don't have data but it's probably very low % of user base (i'm in it ^^). Profiles are a thing in every mozilla applications (firefox based browers, thunderbird based mail clients), and probably some other apps.
It's not a big deal when all the firefox data protected sandboxes use normalfilepath to read the profiles IF the profiles are generic stuff without any useful stuff (encrypted login/pwd, ...). If some of these sandboxes use some openfilepath to keep profile stuff after autodelete then it's another story.

Or you can use @Dyras first approach again, only with NormalFilePath=waterfox.exe,%AppData%\Waterfox\profiles.ini and a comment pointing out that this template must be activated if you want to use one of the browser templates in a sandbox with data protection. In my opinion, however, this carries a greater risk, as many will then additionally activate the "Profile_DirectAccess" template in order to be able to use their extensions. However, they will then also have write access, not just read access!

Indeed a normalfilepath template is still a better compromise than the profile_directaccess that is just crazy imho.
Then the user should not create any more "important" holes with some openfilepath to keep stuff between sessions.

Sorry, bad idea : what about an interactive template creation for some known applications like firefox base browsers ?
When the template [Template_Waterfox_Profile_Data_Protection_Compatibility] is checked in sandboxe-plus UI then the UI shows a popup (or something inside the UI ?) to ask what browser profile to use in the template (with an explorer windows to %AppData%\Waterfox\Profiles\ to select it), then it asks what sort of access should be used for the profile (normalfilepath, openfilepath, ...). And finally the UI can create a personalised template. Ofc, it then defeats a bit the purpose of templates as it's more like a advanced creation of a sandbox for firefox based browsers. :s