Add sandbox support for Windows process mitigations

sandbox/win/src/process_mitigations.h

Index: sandbox/win/src/process_mitigations.h
===================================================================
--- sandbox/win/src/process_mitigations.h	(revision 0)
+++ sandbox/win/src/process_mitigations.h	(revision 0)
@@ -0,0 +1,38 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_
+#define SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_
+
+#include <windows.h>
+
+#include "base/basictypes.h"
+
+namespace sandbox {
+
+// Returns the flags that must be enforced after startup.
+uint64 GetPostStartupProcessMitigations(uint64 flags);

[rvargas (doing something else), 2012/09/08 02:23:32]

It is not clear, from reading this file, what are the arguments to these
functions.

It looks like you mean that uint64 is a sandbox native type for flags, and
DWORD64 is an OS flags arrangement, but that is not spelled anywhere... May I
suggest a typedef for the sandbox flags so that at least the caller knows what
should pass?... or adding comments about the expected arguments.

[rvargas (doing something else), 2012/09/08 02:23:32]

btw, make sure the order on the header matches the order on the cc.

+
+// Converts sandbox flags to the PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES
+// flags used by UpdateProcThreadAttribute().
+DWORD64 GetProcessMitigationPolicyFlags(uint64 flags);

[rvargas (doing something else), 2012/09/08 02:23:32]

This looks really weird... convert from uint64 to uint64 but using two names for
that. And sadly requires the inclusion of windows.h just for the definition of
DWORD64 (not that it really matters).

[jschuh, 2012/09/10 23:58:48]

I need windows.h for the HANDLE regardless. However, the variables are clearer
now due to the typedef.

+
+// Sets the mitigation policy for the current process, ignoring any settings
+// that are invalid for the current version of Windows.
+bool SetProcessMitigationsForCurrentProcess(uint64 flags);
+
+// Adds mitigations that need to be performed on the suspended target process
+// before execution begins.
+bool SetProcessMitigationsForSuspendedProcess(HANDLE process, uint64 flags);
+
+// Returns true if all the supplied flags can be set after a process starts.
+bool CanSetProcessMitigationsPostStartup(uint64 flags);
+
+// Returns true if all the supplied flags can be set before a process starts.
+bool CanSetProcessMitigationsPreStartup(uint64 flags);
+
+}  // namespace sandbox
+
+#endif  // SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_
+