Add a sandbox API for broker handle duplication

sandbox/src/sandbox_policy_base.cc

-// Copyright (c) 2006-2011 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/src/sandbox_policy_base.h"
 
 #include "base/basictypes.h"
 #include "base/callback.h"
 #include "base/logging.h"
 #include "sandbox/src/filesystem_dispatcher.h"
 #include "sandbox/src/filesystem_policy.h"
+#include "sandbox/src/handle_dispatcher.h"
+#include "sandbox/src/handle_policy.h"
 #include "sandbox/src/job.h"
 #include "sandbox/src/interception.h"
 #include "sandbox/src/named_pipe_dispatcher.h"
 #include "sandbox/src/named_pipe_policy.h"
 #include "sandbox/src/policy_broker.h"
 #include "sandbox/src/policy_engine_processor.h"
 #include "sandbox/src/policy_low_level.h"
 #include "sandbox/src/process_thread_dispatcher.h"
 #include "sandbox/src/process_thread_policy.h"
 #include "sandbox/src/registry_dispatcher.h"
@@ skipping 67 matching lines @@
   ipc_targets_[IPC_NTOPENPROCESSTOKEN_TAG] = dispatcher;
   ipc_targets_[IPC_NTOPENPROCESSTOKENEX_TAG] = dispatcher;
 
   dispatcher = new SyncDispatcher(this);
   ipc_targets_[IPC_CREATEEVENT_TAG] = dispatcher;
   ipc_targets_[IPC_OPENEVENT_TAG] = dispatcher;
 
   dispatcher = new RegistryDispatcher(this);
   ipc_targets_[IPC_NTCREATEKEY_TAG] = dispatcher;
   ipc_targets_[IPC_NTOPENKEY_TAG] = dispatcher;
+
+  dispatcher = new HandleDispatcher(this);
+  ipc_targets_[IPC_DUPLICATEHANDLEPROXY_TAG] = dispatcher;
 }
 
 PolicyBase::~PolicyBase() {
   TargetSet::iterator it;
   for (it = targets_.begin(); it != targets_.end(); ++it) {
     TargetProcess* target = (*it);
     delete target;
   }
   delete ipc_targets_[IPC_NTCREATEFILE_TAG];
   delete ipc_targets_[IPC_CREATENAMEDPIPEW_TAG];
   delete ipc_targets_[IPC_NTOPENTHREAD_TAG];
   delete ipc_targets_[IPC_CREATEEVENT_TAG];
   delete ipc_targets_[IPC_NTCREATEKEY_TAG];
+  delete ipc_targets_[IPC_DUPLICATEHANDLEPROXY_TAG];
   delete policy_maker_;
   delete policy_;
   ::DeleteCriticalSection(&lock_);
 }
 
 DWORD PolicyBase::MakeJobObject(HANDLE* job) {
   // Create the windows job object.
   Job job_obj;
   DWORD result = job_obj.Init(job_level_, NULL, ui_exceptions_);
   if (ERROR_SUCCESS != result) {
@@ skipping 191 matching lines @@
       }
       break;
     }
     case SUBSYS_REGISTRY: {
       if (!RegistryPolicy::GenerateRules(pattern, semantics, policy_maker_)) {
         NOTREACHED();
         return SBOX_ERROR_BAD_PARAMS;
       }
       break;
     }
+    case SUBSYS_HANDLES: {
+      if (!HandlePolicy::GenerateRules(pattern, semantics, policy_maker_)) {
+        NOTREACHED();
+        return SBOX_ERROR_BAD_PARAMS;
+      }
+      break;
+    }
     default: {
       return SBOX_ERROR_UNSUPPORTED;
     }
   }
 
   return SBOX_ALL_OK;
 }
 
 EvalResult PolicyBase::EvalPolicy(int service,
                                   CountedParameterSetBase* params) {
@@ skipping 119 matching lines @@
 
   // Finally, setup imports on the target so the interceptions can work.
   return SetupNtdllImports(target);
 }
 
 bool PolicyBase::SetupHandleCloser(TargetProcess* target) {
   return handle_closer_.InitializeTargetHandles(target);
 }
 
 }  // namespace sandbox