Added field trial for enabling AppContainer and a chrome://flags entry.

content/common/sandbox_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_win.h"
 
 #include <string>
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
 #include "base/debug/profiler.h"
 #include "base/files/file_util.h"
 #include "base/hash.h"
 #include "base/logging.h"
 #include "base/memory/shared_memory.h"
+#include "base/metrics/field_trial.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/path_service.h"
 #include "base/process/launch.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/trace_event/trace_event.h"
 #include "base/win/iat_patch_function.h"
 #include "base/win/scoped_handle.h"
 #include "base/win/scoped_process_information.h"
@@ skipping 507 matching lines @@
     base::win::ScopedHandle handle(temp_handle);
 
     // Callers use CHECK macro to make sure we get the right stack.
     CheckDuplicateHandle(handle.Get());
   }
 
   return TRUE;
 }
 #endif
 
+bool IsAppContainerEnabled() {
+  if (base::win::GetVersion() < base::win::VERSION_WIN8)
+    return false;
+  const base::CommandLine& command_line =
+      *base::CommandLine::ForCurrentProcess();
+  const std::string appcontainer_group_name =
+      base::FieldTrialList::FindFullName("EnableAppContainer");
+  if (command_line.HasSwitch(switches::kDisableAppContainer))
+    return false;
+  if (command_line.HasSwitch(switches::kEnableAppContainer))
+    return true;
+  return base::StartsWith(appcontainer_group_name, "Enabled",
+                          base::CompareCase::INSENSITIVE_ASCII);
+}
+
 }  // namespace
 
 void SetJobLevel(const base::CommandLine& cmd_line,
                  sandbox::JobLevel job_level,
                  uint32 ui_exceptions,
                  sandbox::TargetPolicy* policy) {
   if (ShouldSetJobLevel(cmd_line)) {
 #ifdef _WIN64
     policy->SetJobMemoryLimit(4ULL * 1024 * 1024 * 1024);
 #endif
     policy->SetJobLevel(job_level, ui_exceptions);
   } else {
     policy->SetJobLevel(sandbox::JOB_NONE, 0);
   }
 }
 
 // TODO(jschuh): Need get these restrictions applied to NaCl and Pepper.
 // Just have to figure out what needs to be warmed up first.
 void AddBaseHandleClosePolicy(sandbox::TargetPolicy* policy) {
   // TODO(cpu): Add back the BaseNamedObjects policy.
   base::string16 object_path = PrependWindowsSessionPath(
       L"\\BaseNamedObjects\\windows_shell_global_counters");
   policy->AddKernelObjectToClose(L"Section", object_path.data());
 }
 
 void AddAppContainerPolicy(sandbox::TargetPolicy* policy, const wchar_t* sid) {
-  if (base::win::GetVersion() >= base::win::VERSION_WIN8) {
-    const base::CommandLine& command_line =
-        *base::CommandLine::ForCurrentProcess();
-    if (command_line.HasSwitch(switches::kEnableAppContainer)) {
-      policy->SetLowBox(sid);
-    }
-  }
+  if (IsAppContainerEnabled())
+    policy->SetLowBox(sid);
 }
 
 bool AddWin32kLockdownPolicy(sandbox::TargetPolicy* policy) {
 #if !defined(NACL_WIN64)
   if (!IsWin32kRendererLockdownEnabled())
     return true;
 
   // Enable win32k lockdown if not already.
   sandbox::MitigationFlags flags = policy->GetProcessMitigations();
   if ((flags & sandbox::MITIGATION_WIN32K_DISABLE) ==
@@ skipping 280 matching lines @@
   }
 
   return false;
 }
 
 bool BrokerAddTargetPeer(HANDLE peer_process) {
   return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK;
 }
 
 }  // namespace content