GentleSecurity.com : Online Documentation

Applications

The 'Applications' folder contains known application definitions together with specific rules, which comprise the application database. For easy browsing applications are organized into logical groups, according to the application category.

The default application database has the following groups:

System - Windows system and GeSWall components
Web Browsers
E-Mail and News clients
Chat Messangers
IRC clients
P2P sharing applications
Office applications, e.g. Microsoft Office components
Multimedia, e.g. media players

You may create a new group by 'Action\Add Group:' item of main menu, which shows a dialog.

By 'Action\Properties' you may change the name of an existing group. An empty group can be deleted by 'Action\Delete'.

'Action\Add Application..' of the main menu creates a new application definition in the chosen group.

The name specified in the 'File Name' field must be the name of an existing executable file. You may choose a name using the standard Open Dialog or type the name using standard Resource Name Syntax. Once an existing file name has been chosen, the dialog automatically fills in the rest of the parameters and you may press OK to proceed with the creation of application specific rules.

GeSWall can identify an application by Version Information or Name.

Version Information is a selection of certain parts of the file content provided by the application vendor. GeSWall checks version information only for trusted executable files because it cannot rely on untrusted content. This method allows an application to be identified regardless of its language localization, fix update, version or file path. This is the preferable way to identify trusted applications which have valid version information.

Name is the name of an application executable file following Resource Name Syntax. This method is useful for untrusted applications or applications without valid version information.

By default, the dialog sets the 'Security Level' of an application to 'Trusted', which you may decide to change. Available options are:

Never isolate - means that the application is trusted and must not be isolated, no pop-up dialogs suggesting application isolation will be shown, see "Getting Started with GeSWall". Prior GeSWall 2.7 the level is known as "Always trusted".
Isolate on access - application is trusted but once it tries to establish a network connection or access untrusted resources, a pop-up dialog to isolate the application appears, see Getting Started with GeSWall. Prior GeSWall 2.7 the level is known as "Trusted".
Auto-isolation, no pop-ups - the same as "Isolate on access" but isolation enforced automatically without pop-up dialogs. Additionally no dialogs appears on access to confidential resources. The effect of this application security level is similar to "Auto-isolation, no pop-up dialogs" GeSWall security level defined at the root console folder (see "Security Levels" section).
Always start isolated - application is isolated on start, no pop-up dialogs are displayed. Prior GeSWall 2.7 the level is known as "Trusted, auto isolation".
Untrusted (Jail) - means Jailed Application, - an application that has no permissions by default and may access only explicitly granted resources.

The 'Action\Properties' menu item lets you modify Security Level after an application definition is created.

With an existing application definition, you may create specific access rules. An access rule specifies resource identification and permissions for that resource. A new rule is added by the 'Action\Add Rule..' menu item of an application context menu.

A resource is identified by its type and name according to Resource Name Syntax. The 'Access Permission' combo-box contains the following options:

Allow	Application may modify and read resource
Redirect	Application my read resource but once it tries to modify it, GeSWall creates a local copy of the file or registry key, which is modified instead. That allows the application to work smoothly and at the same time prevents modification of trusted resources. The local copy is not permanent. It is erased on application termination.
Read Only	Whenever an isolated application tries to modify a trusted resource, which is not described by a specific rule, GeSWall applies 'Redirect' permission. You may change that behavior by setting Read Only permission.
Deny	Deny any access to the resource.

Rules are applied on the application start, so an application re-start is required in order to enforce updated or new rules.

Note, that specific application rules have the highest priority. This means that an application will have the access specified in the rule regardless of any generic Access Policy rules.