search

microsoft / win32-app-isolation

Tools and documentation for Win32 app isolation
MIT License
1.27k stars 33 forks source link

[Inquiry]: Registry virtualisation support #53

Closed MCMrARM closed 1 year ago

MCMrARM commented 1 year ago

Description

Hello,

I'd like to ask whether registry virtualisation is supposed to be enabled for packages using the appSilo isolation. It seems that I am getting access denied trying to create a new key under HKEY_CURRENT_USER/Software (I am using an extracted package registered using Add-AppxPackage -Register and I get the access denied error both when trying to use the app I'm trying to package, as well as if I manually try to create the key by launching regedit.exe from inside the container).

This would be expected under AppContainer, but from what I understand this project is supposed to virtualise the registry and let the developers avoid having to change the registry paths used by the apps, or is my understanding wrong? The application works if I use the profiler, but I think that just disables isolation altogether.

(Windows version: 10.0.25905)

MCMrARM commented 1 year ago

The manifest that I have used is similar to this (this one launches cmd.exe, you can create a new directory, copy this attached AppxManifest.xml file, copy cmd.exe from C:\Windows\System32 into the directory, then run Add-AppxPackage -Register .\AppxManifest.xml in the directory in order to install it, no more steps are neccessary; then regedit can be launched from the cmd window). https://gist.github.com/MCMrARM/988b21869a3c748177901c6eaac6248e

gaogaotiantian commented 1 year ago

Hi, we fixed a registry bug recently but I'm not 100% sure it was related to your issue. After fixing that bug, I can not reproduce this issue - I can create keys/values under HKEY_CURRENT_USER/Software, and it was virtualized (meaning the user regedit can't see it).

Can you show a screenshot of the access deny? When did it happen?

MCMrARM commented 1 year ago

Hi, I will get back to you tomorrow with a video clip if the issue still exists on the last insider build, but from what you have described it sounds like the issue should indeed be fixed. Thanks!

MCMrARM commented 1 year ago

Sorry, it took me a while longer, but I can confirm the issue is resolved (no longer happens on build 25915).

I noticed that regedit shows an error that it can't rename the key if you try to create a new folder under SOFTWARE, but it's not an issue with the software I am packaging so I am closing the issue.