Chrome & AppContainer Tweak

[Mr.X]

Untrusted = low box token
Appcontainer = low-box token modified based on "capabilities" set by the developer of the Metro App.

This is isolated info that is good to know but barely answers my original question, why Process Hacker shows chrome.exe processes an integrity level of Untrusted instead of AppContainer. While both @dmex and @ionescu007 concur and quote:

AppContainers are unrelated to Integrity labels so why should Process Hacker show 'AppContainer' instead of the integrity label value (e.g. Untrusted) ?

Chrome also doesn't use the AppContainer infrastructure and chrome processes don't have any AppContainer SIDs in their process token.

Dmex is right, that's actually a 'bug' in Process Explorer.

However here's an actual bug, for a Chrome process, PE shows the NULL SID
correctly/restricted, while PH does not.

Best regards,
Alex Ionescu

Obviously they and here you guys assume I have knowledge clearly I have not. So it's kinda hard to put together all infos

 

[SHvFl]

This is isolated info that is good to know but barely answers my original question, why Process Hacker shows chrome.exe processes an integrity level of Untrusted instead of AppContainer. While both @dmex and @ionescu007 concur and quote:


Obviously they and here you guys assume I have knowledge clearly I have not. So it's kinda hard to put together all infos

Process hacker chose to show the correct integrity level. Process explorer decided to go with the name given to the special container microsoft gave so it's easier to identify which is which. I assume people prefer different things but i for sure prefer to know when it's in appcontainer and when it's just untrusted.

 

[Mr.X]

Process hacker chose to show the correct integrity level. Process explorer decided to go with the name given to the special container microsoft gave so it's easier to identify which is which. I assume people prefer different things but i for sure prefer to know when it's in appcontainer and when it's just untrusted.

Now, this is a clearer way to say things. And it responds to my original question. Thanks @SHvFl

 

[Azure]

They should simply add a new setting for users that want to see if process is using appcontainer. Disabled by default.

 

[shmu26]

Process hacker chose to show the correct integrity level. Process explorer decided to go with the name given to the special container microsoft gave so it's easier to identify which is which. I assume people prefer different things but i for sure prefer to know when it's in appcontainer and when it's just untrusted.

What is more secure: untrusted, or appcontainer?
I understood from @Umbra's post that appcontainer does two things: it grants a low trust status, but it also allows certain permissions specifically needed by that app. So it is in a sandbox but with a policy that allows some actions.
Please correct if I misunderstood the concept.

 

[509322]

@Mr.X

Process Hacker nightly build shows Chrome running in Appcontainer.

Oooo, my mistake. It doesn't.

Process Explorer, Process Hacker, System Explorer... you only need all three if you are doing extensive in-depth analysis.

You have the text for Process Explorer so just use it. Process Hacker only has the advantage of having TCPView equivalent integrated into it, but TCPView has the advantage of identifying protocol by name (e.g. NetBIOS).

 

[509322]

What is more secure: untrusted, or appcontainer?
I understood from @Umbra's post that appcontainer does two things: it grants a low trust status, but it also allows certain permissions specifically needed by that app. So it is in a sandbox but with a policy that allows some actions.
Please correct if I misunderstood the concept.

Appcontainer

There's articles here at MT that cover it in-depth

 

[SHvFl]

What is more secure: untrusted, or appcontainer?
I understood from @Umbra's post that appcontainer does two things: it grants a low trust status, but it also allows certain permissions specifically needed by that app. So it is in a sandbox but with a policy that allows some actions.
Please correct if I misunderstood the concept.

Read this. The whole article is interesting but this part is probably the one you care about based on your question.
Sandbox

 

[Deleted member 178]

Read this. The whole article is interesting but this part is probably the one you care about based on your question.
Sandbox

@shmu26 there you have your answer completing mine

@Mr.X The appcontainer feature isn't the realm of mere mortals, so i don't blame you for asking, i add the same reaction than you when it was implemented on Win8 and was also surprised about it being not referenced by PH

 

[shmu26]

Read this. The whole article is interesting but this part is probably the one you care about based on your question.
Sandbox

Thanks. Good reading.
Yep, like @Umbra commented, this appcontainer business is a bit involved. There seem to be two restricting mechanisms:
1 Low integrity level (this concept is not new )
2 Low Box token.
I guess I gotta read about what box token is. If anyone has a reading suggestion...