NaCl: Supply Windows handle-passing function

chrome/browser/nacl_host/nacl_process_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/nacl_host/nacl_process_host.h"
 
 #include <string>
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 32 matching lines @@
 #if defined(OS_POSIX)
 #include <fcntl.h>
 
 #include "ipc/ipc_channel_posix.h"
 #elif defined(OS_WIN)
 #include <windows.h>
 
 #include "base/threading/thread.h"
 #include "base/process_util.h"
 #include "chrome/browser/nacl_host/nacl_broker_service_win.h"
+#include "content/common/sandbox_policy.h"
 #include "native_client/src/trusted/service_runtime/win/debug_exception_handler.h"
 #endif
 
 using content::BrowserThread;
 using content::ChildProcessData;
 using content::ChildProcessHost;
 
 namespace {
 
 #if defined(OS_WIN)
@@ skipping 848 matching lines @@
     nacl::FileDescriptor imc_handle;
     imc_handle.fd = internal_->sockets_for_renderer[i];
     imc_handle.auto_close = true;
     handles_for_renderer.push_back(imc_handle);
 #endif
   }
 
   const ChildProcessData& data = process_->GetData();
 #if defined(OS_WIN)
   // Copy the process handle into the renderer process.
+  // TODO(mseaborn): Remove this.  The renderer process uses this
+  // handle with NaCl's handle_pass module, but we are replacing
+  // handle_pass with Chrome's BrokerDuplicateHandle() function.
   if (!DuplicateHandle(base::GetCurrentProcessHandle(),
                        data.handle,
                        chrome_render_message_filter_->peer_handle(),
                        &nacl_process_handle,
                        PROCESS_DUP_HANDLE,
                        FALSE,
                        0)) {
     DLOG(ERROR) << "DuplicateHandle() failed";
     return false;
   }
+  // If we are on 64-bit Windows, the NaCl process's sandbox is
+  // managed by a different process from the renderer's sandbox.  We
+  // need to inform the renderer's sandbox about the NaCl process so
+  // that the renderer can send handles to the NaCl process using
+  // BrokerDuplicateHandle().
+  if (RunningOnWOW64()) {
+    if (!sandbox::BrokerAddTargetPeer(data.handle)) {
+      DLOG(ERROR) << "Failed to add NaCl process PID";
+      return false;
+    }
+  }
 #else
   // We use pid as process handle on Posix
   nacl_process_handle = data.handle;
 #endif
 
   // Get the pid of the NaCl process
   base::ProcessId nacl_process_id = base::GetProcId(data.handle);
 
   ChromeViewHostMsg_LaunchNaCl::WriteReplyParams(
       reply_msg_, handles_for_renderer, nacl_process_handle, nacl_process_id);
@@ skipping 84 matching lines @@
 }
 
 void NaClProcessHost::OnQueryKnownToValidate(const std::string& signature,
                                              bool* result) {
   *result = NaClBrowser::GetInstance()->QueryKnownToValidate(signature);
 }
 
 void NaClProcessHost::OnSetKnownToValidate(const std::string& signature) {
   NaClBrowser::GetInstance()->SetKnownToValidate(signature);
 }