Sandbox: Make CreateRestrictedToken return a ScopedHandle.

sandbox/win/src/restricted_token_utils.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_SRC_RESTRICTED_TOKEN_UTILS_H__
 #define SANDBOX_SRC_RESTRICTED_TOKEN_UTILS_H__
 
 #include <accctrl.h>
 #include <windows.h>
 
+#include "base/win/scoped_handle.h"
 #include "sandbox/win/src/restricted_token.h"
 #include "sandbox/win/src/security_level.h"
 
 // Contains the utility functions to be able to create restricted tokens based
 // on a security profiles.
 
 namespace sandbox {
 
 // The type of the token returned by the CreateNakedToken.
 enum TokenType {
   IMPERSONATION = 0,
   PRIMARY
 };
 
 // Creates a restricted token based on the effective token of the current
 // process. The parameter security_level determines how much the token is
 // restricted. The token_type determines if the token will be used as a primary
 // token or impersonation token. The integrity level of the token is set to
 // |integrity level| on Vista only.
 // token_handle is the output value containing the handle of the

[Will Harris, 2015/07/16 03:23:56]

nit: update comment

[rvargas (doing something else), 2015/07/16 18:30:07]

done. I also reordered the arguments to make the output last.

I have an itch to change the function to return the token and take an argument
for the error, but all these functions uniformly return DWORD :(...

 // newly created restricted token.
 // If the function succeeds, the return value is ERROR_SUCCESS. If the
 // function fails, the return value is the win32 error code corresponding to
 // the error.
-DWORD CreateRestrictedToken(HANDLE *token_handle,
+DWORD CreateRestrictedToken(base::win::ScopedHandle* token,
                             TokenLevel security_level,
                             IntegrityLevel integrity_level,
                             TokenType token_type);
 
 // Starts the process described by the input parameter command_line in a job
 // with a restricted token. Also set the main thread of this newly created
 // process to impersonate a user with more rights so it can initialize
 // correctly.
 //
 // Parameters: primary_level is the security level of the primary token.
@@ skipping 45 matching lines @@
 // Hardens the integrity level policy on the current process. This is only
 // valid on Win 7 and above. Specifically it sets the policy to block read
 // and execute so that a lower privileged process cannot open the token for
 // impersonate or duplicate permissions. This should limit potential security
 // holes.
 DWORD HardenProcessIntegrityLevelPolicy();
 
 }  // namespace sandbox
 
 #endif  // SANDBOX_SRC_RESTRICTED_TOKEN_UTILS_H__