Make Pepper work out-of-process in the windows sandbox

chrome/common/sandbox_policy.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/sandbox_policy.h"
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/debug/debugger.h"
@@ skipping 513 matching lines @@
     policy->SetDelayedIntegrityLevel(sandbox::INTEGRITY_LEVEL_LOW);
   } else {
     policy->SetTokenLevel(sandbox::USER_UNPROTECTED,
                           sandbox::USER_LIMITED);
   }
 
   AddDllEvictionPolicy(policy);
   return true;
 }
 
-void AddPolicyForRenderer(sandbox::TargetPolicy* policy,
-                          bool* on_sandbox_desktop) {
+void AddPolicyForRenderer(sandbox::TargetPolicy* policy) {
   policy->SetJobLevel(sandbox::JOB_LOCKDOWN, 0);
 
   sandbox::TokenLevel initial_token = sandbox::USER_UNPROTECTED;
   if (base::win::GetVersion() > base::win::VERSION_XP) {
     // On 2003/Vista the initial token has to be restricted if the main
     // token is restricted.
     initial_token = sandbox::USER_RESTRICTED_SAME_ACCESS;
   }
 
   policy->SetTokenLevel(initial_token, sandbox::USER_LOCKDOWN);
   policy->SetDelayedIntegrityLevel(sandbox::INTEGRITY_LEVEL_LOW);
 
   bool use_winsta = !CommandLine::ForCurrentProcess()->HasSwitch(
                         switches::kDisableAltWinstation);
 
-  if (sandbox::SBOX_ALL_OK ==  policy->SetAlternateDesktop(use_winsta)) {
-    *on_sandbox_desktop = true;
-  } else {
-    *on_sandbox_desktop = false;
+  if (sandbox::SBOX_ALL_OK !=  policy->SetAlternateDesktop(use_winsta)) {
     DLOG(WARNING) << "Failed to apply desktop security to the renderer";
   }
 
   AddDllEvictionPolicy(policy);
 }
 
+// The Pepper process as locked-down as a renderer execpt that it can
+// create the server side of chrome pipes.
+bool AddPolicyForPepperPlugin(sandbox::TargetPolicy* policy) {
+  sandbox::ResultCode result;
+  result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_NAMED_PIPES,
+                           sandbox::TargetPolicy::NAMEDPIPES_ALLOW_ANY,
+                           L"\\\\.\\pipe\\chrome.*");
+  if (result != sandbox::SBOX_ALL_OK) {
+    NOTREACHED();
+    return false;
+  }
+  AddPolicyForRenderer(policy);
+  return true;
+}
+
 }  // namespace
 
 namespace sandbox {
 
 void InitBrokerServices(sandbox::BrokerServices* broker_services) {
   // TODO(abarth): DCHECK(CalledOnValidThread());
   //               See <http://b/1287166>.
   CHECK(broker_services);
   CHECK(!g_broker_services);
   broker_services->Init();
@@ skipping 92 matching lines @@
 
   if (!in_sandbox) {
     base::LaunchApp(*cmd_line, false, false, &process);
     return process;
   }
 
   sandbox::ResultCode result;
   PROCESS_INFORMATION target = {0};
   sandbox::TargetPolicy* policy = g_broker_services->CreatePolicy();
 
-  bool on_sandbox_desktop = false;
   if (type == ChildProcessInfo::PLUGIN_PROCESS) {
     if (!AddPolicyForPlugin(cmd_line, policy))
       return 0;
   } else if (type == ChildProcessInfo::GPU_PROCESS) {
     if (!AddPolicyForGPU(cmd_line, policy))
       return 0;
+  } else if (type == ChildProcessInfo::PPAPI_PLUGIN_PROCESS) {
+    if (!AddPolicyForPepperPlugin(policy))
+      return 0;
   } else {
-    AddPolicyForRenderer(policy, &on_sandbox_desktop);
+    AddPolicyForRenderer(policy);
 
     if (type_str != switches::kRendererProcess) {
       // Hack for Google Desktop crash. Trick GD into not injecting its DLL into
       // this subprocess. See
       // http://code.google.com/p/chromium/issues/detail?id=25580
       cmd_line->AppendSwitchASCII("ignored", " --type=renderer ");
     }
   }
 
   if (!exposed_dir.empty()) {
@@ skipping 35 matching lines @@
 
   // Help the process a little. It can't start the debugger by itself if
   // the process is in a sandbox.
   if (child_needs_help)
     base::debug::SpawnDebuggerOnProcess(target.dwProcessId);
 
   return process;
 }
 
 }  // namespace sandbox