Sandbox: Make CreateRestrictedToken return a ScopedHandle.

sandbox/win/src/restricted_token_utils.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <aclapi.h>
 #include <sddl.h>
 #include <vector>
 
 #include "sandbox/win/src/restricted_token_utils.h"
 
 #include "base/logging.h"
 #include "base/win/scoped_handle.h"
 #include "base/win/scoped_process_information.h"
 #include "base/win/windows_version.h"
 #include "sandbox/win/src/job.h"
 #include "sandbox/win/src/restricted_token.h"
 #include "sandbox/win/src/security_level.h"
 #include "sandbox/win/src/sid.h"
 
 namespace sandbox {
 
-DWORD CreateRestrictedToken(HANDLE *token_handle,
-                            TokenLevel security_level,
+DWORD CreateRestrictedToken(TokenLevel security_level,
                             IntegrityLevel integrity_level,
-                            TokenType token_type) {
-  if (!token_handle)
-    return ERROR_BAD_ARGUMENTS;
-
+                            TokenType token_type,
+                            base::win::ScopedHandle* token) {
   RestrictedToken restricted_token;
   restricted_token.Init(NULL);  // Initialized with the current process token
 
   std::vector<base::string16> privilege_exceptions;
   std::vector<Sid> sid_exceptions;
 
   bool deny_sids = true;
   bool remove_privileges = true;
 
   switch (security_level) {
@@ skipping 77 matching lines @@
   if (remove_privileges) {
     err_code = restricted_token.DeleteAllPrivileges(&privilege_exceptions);
     if (ERROR_SUCCESS != err_code)
       return err_code;
   }
 
   restricted_token.SetIntegrityLevel(integrity_level);
 
   switch (token_type) {
     case PRIMARY: {
-      err_code = restricted_token.GetRestrictedTokenHandle(token_handle);
+      err_code = restricted_token.GetRestrictedToken(token);
       break;
     }
     case IMPERSONATION: {
-      err_code = restricted_token.GetRestrictedTokenHandleForImpersonation(
-          token_handle);
+      err_code = restricted_token.GetRestrictedTokenForImpersonation(token);
       break;
     }
     default: {
       err_code = ERROR_BAD_ARGUMENTS;
       break;
     }
   }
 
   return err_code;
 }
@@ skipping 10 matching lines @@
 
   if (JOB_UNPROTECTED != job_level) {
     // Share the Desktop handle to be able to use MessageBox() in the sandboxed
     // application.
     err_code = job.UserHandleGrantAccess(GetDesktopWindow());
     if (ERROR_SUCCESS != err_code)
       return err_code;
   }
 
   // Create the primary (restricted) token for the process
-  HANDLE primary_token_handle = NULL;
-  err_code = CreateRestrictedToken(&primary_token_handle,
-                                   primary_level,
-                                   INTEGRITY_LEVEL_LAST,
-                                   PRIMARY);
-  if (ERROR_SUCCESS != err_code) {
+  base::win::ScopedHandle primary_token;
+  err_code = CreateRestrictedToken(primary_level, INTEGRITY_LEVEL_LAST,
+                                   PRIMARY, &primary_token);
+  if (ERROR_SUCCESS != err_code)
     return err_code;
-  }
-  base::win::ScopedHandle primary_token(primary_token_handle);
+
 
   // Create the impersonation token (restricted) to be able to start the
   // process.
-  HANDLE impersonation_token_handle;
-  err_code = CreateRestrictedToken(&impersonation_token_handle,
-                                   impersonation_level,
-                                   INTEGRITY_LEVEL_LAST,
-                                   IMPERSONATION);
-  if (ERROR_SUCCESS != err_code) {
+  base::win::ScopedHandle impersonation_token;
+  err_code = CreateRestrictedToken(impersonation_level, INTEGRITY_LEVEL_LAST,
+                                   IMPERSONATION, &impersonation_token);
+  if (ERROR_SUCCESS != err_code)
     return err_code;
-  }
-  base::win::ScopedHandle impersonation_token(impersonation_token_handle);
 
   // Start the process
   STARTUPINFO startup_info = {0};
   PROCESS_INFORMATION temp_process_info = {};
   DWORD flags = CREATE_SUSPENDED;
 
   if (base::win::GetVersion() < base::win::VERSION_WIN8) {
     // Windows 8 implements nested jobs, but for older systems we need to
     // break out of any job we're in to enforce our restrictions.
     flags |= CREATE_BREAKAWAY_FROM_JOB;
@@ skipping 206 matching lines @@
   if (!::OpenProcessToken(GetCurrentProcess(), READ_CONTROL | WRITE_OWNER,
                           &token_handle))
     return ::GetLastError();
 
   base::win::ScopedHandle token(token_handle);
 
   return HardenTokenIntegrityLevelPolicy(token.Get());
 }
 
 }  // namespace sandbox