Don't grant unnecessary handle privileges in OpenProcessHandle.

base/process_util_win.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/process_util.h"
 
 #include <windows.h>
 #include <winternl.h>
 #include <psapi.h>
 
@@ skipping 16 matching lines @@
 
 ProcessId GetCurrentProcId() {
   return ::GetCurrentProcessId();
 }
 
 ProcessHandle GetCurrentProcessHandle() {
   return ::GetCurrentProcess();
 }
 
 bool OpenProcessHandle(ProcessId pid, ProcessHandle* handle) {
-  // TODO(phajdan.jr): Take even more permissions out of this list.
-  ProcessHandle result = OpenProcess(PROCESS_DUP_HANDLE |
-                                         PROCESS_TERMINATE |
-                                         PROCESS_QUERY_INFORMATION |
-                                         SYNCHRONIZE,
+  // We try to limit privileges granted to the handle. If you need this
+  // for test code, consider using OpenPrivilegedProcessHandle instead of
+  // adding more privileges here.
+  ProcessHandle result = OpenProcess(PROCESS_DUP_HANDLE | PROCESS_TERMINATE,
                                      FALSE, pid);
 
   if (result == INVALID_HANDLE_VALUE)
     return false;
 
   *handle = result;
   return true;
 }
 
 bool OpenPrivilegedProcessHandle(ProcessId pid, ProcessHandle* handle) {
@@ skipping 710 matching lines @@
 void EnableTerminationOnHeapCorruption() {
   // Ignore the result code. Supported on XP SP3 and Vista.
   HeapSetInformation(NULL, HeapEnableTerminationOnCorruption, NULL, 0);
 }
 
 void RaiseProcessToHighPriority() {
   SetPriorityClass(GetCurrentProcess(), HIGH_PRIORITY_CLASS);
 }
 
 }  // namespace base