Rework target process creation to minimize creation routes

sandbox/win/src/broker_services.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/broker_services.h"
 
 #include <AclAPI.h>
 
 #include "base/logging.h"
 #include "base/macros.h"
@@ skipping 95 matching lines @@
     delete peer;
   } else {
     NOTREACHED();
   }
 }
 
 }  // namespace
 
 namespace sandbox {
 
-// TODO(rvargas): Replace this structure with a std::pair of ScopedHandles.
-struct BrokerServicesBase::TokenPair {
-  TokenPair(base::win::ScopedHandle initial_token,
-         base::win::ScopedHandle lockdown_token)
-      : initial(initial_token.Pass()),
-        lockdown(lockdown_token.Pass()) {
-  }
-
-  base::win::ScopedHandle initial;
-  base::win::ScopedHandle lockdown;
-};
-
 BrokerServicesBase::BrokerServicesBase() : thread_pool_(NULL) {
 }
 
 // The broker uses a dedicated worker thread that services the job completion
 // port to perform policy notifications and associated cleanup tasks.
 ResultCode BrokerServicesBase::Init() {
   if (job_port_.IsValid() || (NULL != thread_pool_))
     return SBOX_ERROR_UNEXPECTED_CALL;
 
   ::InitializeCriticalSection(&lock_);
@@ skipping 181 matching lines @@
   // This downcast is safe as long as we control CreatePolicy()
   PolicyBase* policy_base = static_cast<PolicyBase*>(policy);
 
   if (policy_base->GetAppContainer() && policy_base->GetLowBoxSid())
     return SBOX_ERROR_BAD_PARAMS;
 
   // Construct the tokens and the job object that we are going to associate
   // with the soon to be created target process.
   base::win::ScopedHandle initial_token;
   base::win::ScopedHandle lockdown_token;
+  base::win::ScopedHandle lowbox_token;
   ResultCode result = SBOX_ALL_OK;
 
-  result = policy_base->MakeTokens(&initial_token, &lockdown_token);
+  result =
+      policy_base->MakeTokens(&initial_token, &lockdown_token, &lowbox_token);
   if (SBOX_ALL_OK != result)
     return result;
 
   base::win::ScopedHandle job;
   result = policy_base->MakeJobObject(&job);
   if (SBOX_ALL_OK != result)
     return result;
 
   // Initialize the startup information from the policy.
   base::win::StartupInformation startup_info;
@@ skipping 96 matching lines @@
   std::vector<DWORD> inherited_handle_information(inherited_handle_list.size());
   for (size_t i = 0; i < inherited_handle_list.size(); ++i) {
     const HANDLE& inherited_handle = inherited_handle_list[i];
     ::GetHandleInformation(inherited_handle, &inherited_handle_information[i]);
     ::SetHandleInformation(inherited_handle, HANDLE_FLAG_PROTECT_FROM_CLOSE, 0);
   }
 
   // Create the TargetProces object and spawn the target suspended. Note that
   // Brokerservices does not own the target object. It is owned by the Policy.
   base::win::ScopedProcessInformation process_info;
-  TargetProcess* target = new TargetProcess(initial_token.Pass(),
-                                            lockdown_token.Pass(),
-                                            job.Get(),
-                                            thread_pool_);
+  TargetProcess* target =
+      new TargetProcess(initial_token.Pass(), lockdown_token.Pass(),
+                        lowbox_token.Pass(), job.Get(), thread_pool_);
 
   DWORD win_result = target->Create(exe_path, command_line, inherit_handles,
-                                    policy_base->GetLowBoxSid() ? true : false,
                                     startup_info, &process_info);
 
   // Restore the previous handle protection values.
   for (size_t i = 0; i < inherited_handle_list.size(); ++i) {
     ::SetHandleInformation(inherited_handle_list[i],
                            HANDLE_FLAG_PROTECT_FROM_CLOSE,
                            inherited_handle_information[i]);
   }
 
   policy_base->ClearSharedHandles();
@@ skipping 111 matching lines @@
     return SBOX_ERROR_UNSUPPORTED;
 
   base::string16 name = LookupAppContainer(sid);
   if (name.empty())
     return SBOX_ERROR_INVALID_APP_CONTAINER;
 
   return DeleteAppContainer(sid);
 }
 
 }  // namespace sandbox