Enable more Windows mitigations

content/common/sandbox_policy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_policy.h"
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/debug/debugger.h"
@@ skipping 709 matching lines @@
 #endif
 
   if (!in_sandbox) {
     policy->Release();
     base::ProcessHandle process = 0;
     base::LaunchProcess(*cmd_line, base::LaunchOptions(), &process);
     g_broker_services->AddTargetPeer(process);
     return process;
   }
 
-  // TODO(jschuh): Add all Win8 mitigations. crbug.com/147752
-  if (type != content::PROCESS_TYPE_NACL_LOADER) {
-    if (policy->SetProcessMitigations(MITIGATION_DEP |
-                                      MITIGATION_DEP_NO_ATL_THUNK |
-                                      MITIGATION_SEHOP |
-                                      MITIGATION_BOTTOM_UP_ASLR)
-        != sandbox::SBOX_ALL_OK) {
-      return 0;
-    }
-  } else {
-    // TODO(jschuh): Make NaCl work with DEP and SEHOP. crbug.com/147752
-    if (policy->SetDelayedProcessMitigations(MITIGATION_DEP |
-                                             MITIGATION_DEP_NO_ATL_THUNK)
-        != sandbox::SBOX_ALL_OK) {
-      return 0;
-    }
-    if (policy->SetProcessMitigations(MITIGATION_BOTTOM_UP_ASLR)
-        != sandbox::SBOX_ALL_OK) {
-      return 0;
-    }
-  }
+  // TODO(jschuh): Make NaCl work with DEP and SEHOP. crbug.com/147752
+  sandbox::MitigationFlags mitigations = MITIGATION_RELOCATE_IMAGE |
+                                         MITIGATION_RELOCATE_IMAGE_REQUIRED |
+                                         MITIGATION_HEAP_TERMINATE |
+#if !defined(NACL_WIN64)
+                                         MITIGATION_DEP |
+                                         MITIGATION_DEP_NO_ATL_THUNK |
+                                         MITIGATION_SEHOP |
+#endif
+                                         MITIGATION_BOTTOM_UP_ASLR |
+                                         MITIGATION_HIGH_ENTROPY_ASLR;
+  if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)

[cpu_(ooo_6.6-7.5), 2012/09/21 19:30:27]

can we move 739 and 740 so that the #ifdef block is not in the middle?

Same for 750.

[jschuh, 2012/09/21 19:43:11]

Done.

+    return 0;
+
+  mitigations = MITIGATION_STRICT_HANDLE_CHECKS |
+                MITIGATION_EXTENSION_DLL_DISABLE |
+#if defined(NACL_WIN64)
+                MITIGATION_DEP |
+                MITIGATION_DEP_NO_ATL_THUNK |
+#endif
+                MITIGATION_DLL_SEARCH_ORDER;
+
+  if (policy->SetDelayedProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
+    return 0;
 
   if (type == content::PROCESS_TYPE_PLUGIN) {
     AddGenericDllEvictionPolicy(policy);
     AddPluginDllEvictionPolicy(policy);
   } else if (type == content::PROCESS_TYPE_GPU) {
     if (!AddPolicyForGPU(cmd_line, policy))
       return 0;
   } else {
     if (!AddPolicyForRenderer(policy))
       return 0;
@@ skipping 127 matching lines @@
   return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK;
 }
 
 base::ProcessHandle StartProcessWithAccess(
     CommandLine* cmd_line,
     const FilePath& exposed_dir) {
   return sandbox::StartProcessWithAccess(cmd_line, exposed_dir);
 }
 
 }  // namespace content