Rework target process creation to minimize creation routes

sandbox/win/src/sandbox_policy_base.h

Index: sandbox/win/src/sandbox_policy_base.h
diff --git a/sandbox/win/src/sandbox_policy_base.h b/sandbox/win/src/sandbox_policy_base.h
index 19686ee860968b538e49599263f168ed0368dadf..a461bd711090094f228f353526a177cd34546939 100644
--- a/sandbox/win/src/sandbox_policy_base.h
+++ b/sandbox/win/src/sandbox_policy_base.h
@@ -82,9 +82,11 @@ class PolicyBase : public Dispatcher, public TargetPolicy {
   ResultCode MakeJobObject(base::win::ScopedHandle* job);
 
   // Creates the two tokens with the levels specified in a previous call to
-  // SetTokenLevel().
+  // SetTokenLevel(). Also creates a lowbox token if specified based on the
+  // lowbox SID.
   ResultCode MakeTokens(base::win::ScopedHandle* initial,
-                        base::win::ScopedHandle* lockdown);
+                        base::win::ScopedHandle* lockdown,
+                        base::win::ScopedHandle* lowbox);
 
   const AppContainerAttributes* GetAppContainer() const;