Make Pepper work out-of-process in the windows sandbox

content/ppapi_plugin/ppapi_thread.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/ppapi_plugin/ppapi_thread.h"
 
 #include <limits>
 
 #include "base/process_util.h"
 #include "base/rand_util.h"
 #include "content/common/child_process.h"
 #include "content/ppapi_plugin/broker_process_dispatcher.h"
 #include "content/ppapi_plugin/plugin_process_dispatcher.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_sync_channel.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/c/ppp.h"
 #include "ppapi/proxy/ppapi_messages.h"
 
+#if defined(OS_WIN)
+#include "sandbox/src/sandbox.h"
+#endif
+
+#if defined(OS_WIN)
+extern sandbox::TargetServices* g_target_services;
+#else
+extern void* g_target_services = 0;

[brettw, 2011/05/06 04:30:52]

Don't initialize extern.

+#endif
+
 typedef int32_t (*InitializeBrokerFunc)
     (PP_ConnectInstance_Func* connect_instance_func);
 
 PpapiThread::PpapiThread(bool is_broker)
     : is_broker_(is_broker),
       get_plugin_interface_(NULL),
       connect_instance_func_(NULL),
       local_pp_module_(
           base::RandInt(0, std::numeric_limits<PP_Module>::max())) {
 }
@@ skipping 35 matching lines @@
 base::WaitableEvent* PpapiThread::GetShutdownEvent() {
   return ChildProcess::current()->GetShutDownEvent();
 }
 
 std::set<PP_Instance>* PpapiThread::GetGloballySeenInstanceIDSet() {
   return &globally_seen_instance_ids_;
 }
 
 void PpapiThread::OnMsgLoadPlugin(const FilePath& path) {
   base::ScopedNativeLibrary library(base::LoadNativeLibrary(path, NULL));
-  if (!library.is_valid())
+
+#if defined(OS_WIN)
+  // Once we lower the token the sandbox is locked down and no new modules
+  // can be loaded. TODO(cpu): consider changing to the loading style of
+  // regular plugins.
+  if (g_target_services)
+    g_target_services->LowerToken();
+#endif
+
+  if (!library.is_valid()) {
+    LOG(ERROR) << "Failed to load pepper module";
     return;
+  }
 
   if (is_broker_) {
     // Get the InitializeBroker function (required).
     InitializeBrokerFunc init_broker =
         reinterpret_cast<InitializeBrokerFunc>(
             library.GetFunctionPointer("PPP_InitializeBroker"));
     if (!init_broker) {
       LOG(WARNING) << "No PPP_InitializeBroker in plugin library";
       return;
     }
@@ skipping 86 matching lines @@
 #if defined(OS_POSIX)
   // On POSIX, pass the renderer-side FD.
   handle->socket = base::FileDescriptor(::dup(dispatcher->GetRendererFD()),
                                         true);
 #endif
 
   // From here, the dispatcher will manage its own lifetime according to the
   // lifetime of the attached channel.
   return true;
 }