General Project Outline

[xyzeva]

We currently do not know about many details of how we are doing sandboxing.

This is to note down and discuss what to do

[RayBytes]

👋
As discussed in discord, our policy should be:

• Locking instance to mc/own folder
• Allow internet access to download deps
• Restrict access to hardware (Camera, Audio Input, USB, Printing, Bluetooth) (Unless allowed by user)
• Restricting the runtime

In terms of how this will be implemented, either a launcher approach or external tool approach can be adopted, but having it only adopted for launches will make it so vanilla launcher users are completely unsupported, which are a big portion of the game. As said by systemless:

We'd need to get forge, fabric and whatever other modloaders to implement the sandbox

With this established, Linux and MacOS seem to have fine sandboxing ways, however windows is the key issue. What can we do to address windows?

[jms-c]

I would like to quickly add on to the first point.
Like stated in discord, in my opinion, the sandboxing should redirect writes, not block to improve compatibility.
(so if a mod wants to, it could write to Documents folder without any error, it would just get moved to sandbox_folder/c/users/username/Documents)
However, reads should be definitely restricted to own instance (and redirected files).

[jms-c]

Regarding windows, I think the current idea is appcontainers. However, I don't know much about them so I can't comment much.

[xyzeva]

Regarding windows, I think the current idea is appcontainers. However, I don't know much about them so I can't comment much.

I think @pandaninjas has looked at them before?

[RayBytes]

this seems to be useful in how to create the manifest for UWP apps.

[pandaninjas]

Regarding windows, I think the current idea is appcontainers. However, I don't know much about them so I can't comment much.

I think @pandaninjas has looked at them before?

In my opinion, the best way to go with AppContainers is to directly create policies, i.e. AppContainer for legacy unpackaged apps (https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-for-legacy-applications-#unpackaged-apps). The documentation on this is rather bad, but there are some suitable example code online like https://github.com/MalwareTech/AppContainerSandbox

However, the writes can't really be redirected, AppContainer's solution is just to redirect some environment variables and registry keys so that it will work assuming the developer hasn't hardcoded paths (like C:\Users\user\Documents instead of getting it through registry keys/environment variables)

[RayBytes]

Regarding windows, I think the current idea is appcontainers. However, I don't know much about them so I can't comment much.

I think @pandaninjas has looked at them before?

In my opinion, the best way to go with AppContainers is to directly create policies, i.e. AppContainer for legacy unpackaged apps (https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-for-legacy-applications-#unpackaged-apps). The documentation on this is rather bad, but there are some suitable example code online like https://github.com/MalwareTech/AppContainerSandbox

However, the writes can't really be redirected, AppContainer's solution is just to redirect some environment variables and registry keys so that it will work assuming the developer hasn't hardcoded paths (like C:\Users\user\Documents instead of getting it through registry keys/environment variables)

Does AppContainers also secure sub-processes?
That documentation is horrible, agreed 🤣

[pandaninjas]

Regarding windows, I think the current idea is appcontainers. However, I don't know much about them so I can't comment much.

I think @pandaninjas has looked at them before?

In my opinion, the best way to go with AppContainers is to directly create policies, i.e. AppContainer for legacy unpackaged apps (https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-for-legacy-applications-#unpackaged-apps). The documentation on this is rather bad, but there are some suitable example code online like https://github.com/MalwareTech/AppContainerSandbox
However, the writes can't really be redirected, AppContainer's solution is just to redirect some environment variables and registry keys so that it will work assuming the developer hasn't hardcoded paths (like C:\Users\user\Documents instead of getting it through registry keys/environment variables)

Does AppContainers also secure sub-processes? That documentation is horrible, agreed 🤣

They do secure sub-processes as far as I can tell.

[RayBytes]

Regarding windows, I think the current idea is appcontainers. However, I don't know much about them so I can't comment much.

I think @pandaninjas has looked at them before?

In my opinion, the best way to go with AppContainers is to directly create policies, i.e. AppContainer for legacy unpackaged apps (https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-for-legacy-applications-#unpackaged-apps). The documentation on this is rather bad, but there are some suitable example code online like https://github.com/MalwareTech/AppContainerSandbox
However, the writes can't really be redirected, AppContainer's solution is just to redirect some environment variables and registry keys so that it will work assuming the developer hasn't hardcoded paths (like C:\Users\user\Documents instead of getting it through registry keys/environment variables)

Does AppContainers also secure sub-processes? That documentation is horrible, agreed 🤣

They do secure sub-processes as far as I can tell.

Has anyone made an proof-of-concept app with this idea yet?

[xyzeva]

Regarding windows, I think the current idea is appcontainers. However, I don't know much about them so I can't comment much.

I think @pandaninjas has looked at them before?

In my opinion, the best way to go with AppContainers is to directly create policies, i.e. AppContainer for legacy unpackaged apps (https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-for-legacy-applications-#unpackaged-apps). The documentation on this is rather bad, but there are some suitable example code online like https://github.com/MalwareTech/AppContainerSandbox
However, the writes can't really be redirected, AppContainer's solution is just to redirect some environment variables and registry keys so that it will work assuming the developer hasn't hardcoded paths (like C:\Users\user\Documents instead of getting it through registry keys/environment variables)

Does AppContainers also secure sub-processes? That documentation is horrible, agreed 🤣

They do secure sub-processes as far as I can tell.

Has anyone made an proof-of-concept app with this idea yet?

https://github.com/modmuss50/win-sandbox very WIP and very unstable

[RayBytes]

https://www.unix.com/man-page/osx/3/sandbox_init/
Manpage for backend API behind sandbox-exec, can be very helpful in implementation in launchers.