[Docs]: Win11(Build22621) has supported AppSilo

[AndromedaMelody]

Links

https://github.com/microsoft/win32-app-isolation/blob/3e53df6e49e0086a43905ae56331636e78cd2af2/docs/packaging/msix-packaging-tool.md?plain=1#L72

Description

There is a error in the document. I tried to use AppSilo in Win11 (Build22621), I find 22621 has supported AppSilo.

1. TrustLevel="appSilo" can work in 22621, I perfer use TrustLevel="appSilo" instead of RuntimeBehavior="appSilo". I think the document should introduce more detailed. For example: tell developers that

   AppSilo can work in 22621 and application can access file with broadFileSystemAccess but compatibility is not good. If You want to make compatibility better, you can declare isolatedWin32-promptForAccess but it needs Win11 (Build 25357).

2. What's different between previewsecurity:TrustLevel="appSilo" and previewsecurity2:RuntimeBehavior="appSilo"?
3. If a application target 25357, Can we write the following manifest? Is it better?

   ……
   <Application Id="…" Executable="…" previewsecurity:TrustLevel="appSilo" previewsecurity2:RuntimeBehavior="appSilo">
   ……

Test

Windows Version: 10.0.22631.1830 SDK Version: 10.0.22621.755 Application: NanaZip Nightly

• Simple Manifest 1:

  <Package …
  xmlns:previewsecurity="http://schemas.microsoft.com/appx/manifest/preview/windows10/security"
  IgnorableNamespaces="… previewsecurity">
  ……
  <Capabilities>
  <rescap:Capability Name="isolatedWin32-volumeRootMinimal" />
  <rescap:Capability Name="isolatedWin32-promptForAccess" />
  </Capabilities>
  <Applications>
  <Application Id="…" Executable="…" previewsecurity:TrustLevel="appSilo" uap10:RuntimeBehavior="packagedClassicApp">
    ……
  </Application>
  </Applications>
  </Package>

  NanaZip get the list of folder/file in volume root successfully. But isolatedWin32-promptForAccess can't work completely, NanaZip can't get access the file in volume root.

• Simple Manifest 2:

  <Package …
  xmlns:previewsecurity="http://schemas.microsoft.com/appx/manifest/preview/windows10/security"
  IgnorableNamespaces="… previewsecurity">
  ……
  <Capabilities>
  <rescap:Capability Name="isolatedWin32-volumeRootMinimal" />
  <rescap:Capability Name="broadFileSystemAccess"/>
  </Capabilities>
  <Applications>
  <Application Id="…" Executable="…" previewsecurity:TrustLevel="appSilo" uap10:RuntimeBehavior="packagedClassicApp">
    ……
  </Application>
  </Applications>
  </Package>

  NanaZip get the list of folder/file in volume root successfully and access the file in volume root successfully.

• Test Open File Dialog (not WinRT File Picker):

  Open File Dialog works property, but it doesn't support DPI Scaling (PerMonitorV2).

[AndromedaMelody]

I think this may be a good way to solve #15 created by @JasonWei512 . We really hope AppSilo better, and older system can use it or have a perfect workaround.

[lilybarkley-msft]

Hey @AndromedaMelody we require 10.0.25229.0 as the minimum build for AppSilos. We're still looking into solutions for older version of windows, but using previewsecurity:TrustLevel="appSilo" can lead to system instability during updates so we strongly recommend not using it.

If the DPI scaling issue exists on 10.0.25229.0 min build packages, can you file another issue for that?

[AndromedaMelody]

Hi @lilybarkley-msft

We're still looking into solutions for older version of windows, using previewsecurity:TrustLevel="appSilo" can lead to system instability during updates so we strongly recommend not using it.

Thanks for your reply. Look forward to the solutions and a detailed document.

If the DPI scaling issue exists on 10.0.25229.0 min build packages, can you file another issue for that?

OK, I have submitted a new issue.

• 39

[dongle-the-gadget]

@AndromedaMelody can you link how you used TrustLevel="appSilo". When I tried it on 23536, it just fails with:

error 0xC00CE169: App manifest validation error: The app manifest must be valid as per schema: Line xx, Column xx, Reason: 'appSilo' violates enumeration constraint of 'appContainer mediumIL'. The attribute '{http://schemas.microsoft.com/appx/manifest/uap/windows10/10}TrustLevel' with value 'appSilo' failed to parse.