Add sandbox support for Windows process mitigations

sandbox/win/src/sandbox_policy.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_H_
 #define SANDBOX_WIN_SRC_SANDBOX_POLICY_H_
 
 #include <string>
 
 #include "base/basictypes.h"
@@ skipping 146 matching lines @@
   // launching the sandboxed process will fail. See BrokerServices for details
   // about installing an AppContainer.
   // Note that currently Windows restricts the use of impersonation within
   // AppContainers, so this function is incompatible with the use of an initial
   // token.
   virtual ResultCode SetAppContainer(const wchar_t* sid) = 0;
 
   // Sets a capability to be enabled for the sandboxed process' AppContainer.
   virtual ResultCode SetCapability(const wchar_t* sid) = 0;
 
+  // Sets the mitigation flags used when starting the process. These flags are
+  // defined in the PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY attribute for the
+  // UpdateProcThreadAttribute function. Flags that are invalid for the
+  // target OS will be silently ignored.
+  virtual ResultCode SetProcessMitigations(uint64 flags) = 0;
+

[cpu_(ooo_6.6-7.5), 2012/09/06 19:46:15]

The flags are our flags but the comment  can take the user to the msdn ones by
googling PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY. 

But more generally, the mitigation flags need to be here or in a file that is
more 'interfacy' than process_mitigations.h. So what I propose is either:

1) move the flags here
2) create a mitigations header like security_level.h

[jschuh, 2012/09/07 01:14:22]

Done.

+  // Returns the currently set mitigation policy.
+  virtual uint64 GetProcessMitigations() = 0;
+
+  // Sets the process mitigation flags. These flags will not take effect
+  // before you call LowerToken.  These flags are are defined in the
+  // PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY attribute for the
+  // UpdateProcThreadAttribute function. Flags that are invalid for the
+  // target OS will be silently ignored. Flags that are invalid after process
+  // startup will return SBOX_ERROR_BAD_PARAMS.
+  virtual ResultCode SetDelayedProcessMitigations(uint64 flags) = 0;
+
+  // Returns the currently set delayed mitigation policy.
+  virtual uint64 GetDelayedProcessMitigations() = 0;
+
   // Sets the interceptions to operate in strict mode. By default, interceptions
   // are performed in "relaxed" mode, where if something inside NTDLL.DLL is
   // already patched we attempt to intercept it anyway. Setting interceptions
   // to strict mode means that when we detect that the function is patched we'll
   // refuse to perform the interception.
   virtual void SetStrictInterceptions() = 0;
 
   // Adds a policy rule effective for processes spawned using this policy.
   // subsystem: One of the above enumerated windows subsystems.
   // semantics: One of the above enumerated FileSemantics.
@@ skipping 17 matching lines @@
   // A NULL value for handle_name indicates all handles of the specified type.
   // An empty string for handle_name indicates the handle is unnamed.
   virtual ResultCode AddKernelObjectToClose(const wchar_t* handle_type,
                                             const wchar_t* handle_name) = 0;
 };
 
 }  // namespace sandbox
 
 
 #endif  // SANDBOX_WIN_SRC_SANDBOX_POLICY_H_