Isolated apps and system resources

[shmu26]

This question grew out of an unresolved discussion in the thread on the MT forum.
We were comparing the isolation of ReHIPS to the sandboxing of Sandboxie, in an attempt to understand how ReHIPS works.
https://malwaretips.com/threads/rehips-an-hips-sandbox-without-kernel-hooks-quick-test-included.27453/page-38#post-661404

So, basically, SBIE at default settings does not limit the access of sandboxed apps to system resources. It just redirects the writes to a virtualized and contained environment.

How does the behavior of ReHIPS compare, in this respect? How does it limit the access of isolated apps to system resources, besides the total blocking of access to real user space?

[fixer]

I don't think disclosing internals of other software like SBIE is correct from moral point of view. So I can't post about SBIE here, what weaknesses it has, vulnerabilities, etc. But I'll write about ReHIPS.

I started posting a series of blogposts about default file system access any isolated program has. The first part is here So where do isolated programs have access to (part 1)? So I think these series should cover the question of file system access, stay tuned Other resources access may probably be covered next.