Add command line option to enable PPAPI win32k lockdown.

content/browser/ppapi_plugin_process_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/ppapi_plugin_process_host.h"
 
 #include <string>
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/metrics/field_trial.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/browser_child_process_host_impl.h"
 #include "content/browser/plugin_service_impl.h"
 #include "content/browser/renderer_host/render_message_filter.h"
 #include "content/common/child_process_host_impl.h"
 #include "content/common/child_process_messages.h"
+#include "content/common/content_switches_internal.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/pepper_plugin_info.h"
 #include "content/public/common/process_type.h"
 #include "content/public/common/sandbox_type.h"
 #include "content/public/common/sandboxed_process_launcher_delegate.h"
 #include "ipc/ipc_switches.h"
 #include "net/base/network_change_notifier.h"
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ui/base/ui_base_switches.h"
 
 #if defined(OS_WIN)
 #include "content/common/sandbox_win.h"
+#include "sandbox/win/src/process_mitigations.h"
 #include "sandbox/win/src/sandbox_policy.h"
 #endif
 
 namespace content {
 
 // NOTE: changes to this class need to be reviewed by the security team.
 class PpapiPluginSandboxedProcessLauncherDelegate
     : public content::SandboxedProcessLauncherDelegate {
  public:
   PpapiPluginSandboxedProcessLauncherDelegate(bool is_broker,
                                               const PepperPluginInfo& info,
                                               ChildProcessHost* host)
-      :
+      : info_(info),
 #if defined(OS_POSIX)
-        info_(info),
         ipc_fd_(host->TakeClientFileDescriptor()),
 #endif  // OS_POSIX
         is_broker_(is_broker) {}
 
   ~PpapiPluginSandboxedProcessLauncherDelegate() override {}
 
 #if defined(OS_WIN)
   bool ShouldSandbox() override {
     return !is_broker_;
   }
 
   void PreSpawnTarget(sandbox::TargetPolicy* policy, bool* success) override {
     if (is_broker_)
       return;
-    // The Pepper process as locked-down as a renderer execpt that it can
-    // create the server side of chrome pipes.
+    *success = false;
+    // The Pepper process is as locked-down as a renderer except that it can
+    // create the server side of Chrome pipes.
     sandbox::ResultCode result;
     result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_NAMED_PIPES,
                              sandbox::TargetPolicy::NAMEDPIPES_ALLOW_ANY,
                              L"\\\\.\\pipe\\chrome.*");
-    *success = (result == sandbox::SBOX_ALL_OK);
-
+    if (result != sandbox::SBOX_ALL_OK)
+      return;
+#if !defined(NACL_WIN64)
+    for (const auto& mime_type : info_.mime_types) {
+      if (IsWin32kLockdownEnabledForMimeType(mime_type.mime_type)) {
+        if (!AddWin32kLockdownPolicy(policy))
+          return;
+        break;
+      }
+    }
+#endif
     const base::string16& sid =
         GetContentClient()->browser()->GetAppContainerSidForSandboxType(
             GetSandboxType());
     if (!sid.empty())
       AddAppContainerPolicy(policy, sid.c_str());
+
+    *success = true;
   }
 
 #elif defined(OS_POSIX)
   bool ShouldUseZygote() override {
     const base::CommandLine& browser_command_line =
         *base::CommandLine::ForCurrentProcess();
     base::CommandLine::StringType plugin_launcher = browser_command_line
         .GetSwitchValueNative(switches::kPpapiPluginLauncher);
     return !is_broker_ && plugin_launcher.empty();
   }
   base::ScopedFD TakeIpcFd() override { return ipc_fd_.Pass(); }
 #endif  // OS_WIN
 
   SandboxType GetSandboxType() override {
     return SANDBOX_TYPE_PPAPI;
   }
 
  private:
+  const PepperPluginInfo& info_;
 #if defined(OS_POSIX)
-  const PepperPluginInfo& info_;
   base::ScopedFD ipc_fd_;
 #endif  // OS_POSIX
   bool is_broker_;
 
   DISALLOW_COPY_AND_ASSIGN(PpapiPluginSandboxedProcessLauncherDelegate);
 };
 
 class PpapiPluginProcessHost::PluginNetworkObserver
     : public net::NetworkChangeNotifier::IPAddressObserver,
       public net::NetworkChangeNotifier::ConnectionTypeObserver {
@@ skipping 385 matching lines @@
   // sent_requests_ queue should be the one that the plugin just created.
   Client* client = sent_requests_.front();
   sent_requests_.pop();
 
   const ChildProcessData& data = process_->GetData();
   client->OnPpapiChannelOpened(channel_handle, base::GetProcId(data.handle),
                                data.id);
 }
 
 }  // namespace content