[Win10 sandbox mitigations] Four new Win10 mitigations added.

content/common/sandbox_win.cc

Index: content/common/sandbox_win.cc
diff --git a/content/common/sandbox_win.cc b/content/common/sandbox_win.cc
index 523073863b7c667862146a9fe0d102bcafc3585d..ed4c565644afa6f37a660002c65e64ab50c8c390 100644
--- a/content/common/sandbox_win.cc
+++ b/content/common/sandbox_win.cc
@@ -698,11 +698,17 @@ base::Process StartSandboxedProcess(
 
   sandbox::TargetPolicy* policy = g_broker_services->CreatePolicy();
 
-  sandbox::MitigationFlags mitigations = sandbox::MITIGATION_HEAP_TERMINATE |
-                                         sandbox::MITIGATION_BOTTOM_UP_ASLR |
-                                         sandbox::MITIGATION_DEP |
-                                         sandbox::MITIGATION_DEP_NO_ATL_THUNK |
-                                         sandbox::MITIGATION_SEHOP;
+  // Pre-startup mitigations.
+  sandbox::MitigationFlags mitigations =
+      sandbox::MITIGATION_HEAP_TERMINATE |
+      sandbox::MITIGATION_BOTTOM_UP_ASLR |
+      sandbox::MITIGATION_DEP |
+      sandbox::MITIGATION_DEP_NO_ATL_THUNK |
+      sandbox::MITIGATION_SEHOP |
+      sandbox::MITIGATION_NONSYSTEM_FONT_DISABLE |

[jschuh, 2016/01/25 23:53:51]

This will break the GDI path, which some people are enabling via a flag. In a
non-egligible number of cases this as a workaround for bugs in our font fallback
logic. Those are bugs we need to fix, so I don't think we need to block this
mitigation. However, it is a problem we need to be aware of.

[penny, 2016/01/26 22:37:09]

Acknowledged.  I was not aware of this at all, thank you.  Is there an ETA on
the fixes - or can you throw me any links?  Would it help to make this a
post-startup mitigation (i.e. is the GDI path only used at startup before we
drop into low privileges, or could it happen at any time)?

+      sandbox::MITIGATION_IMAGE_LOAD_NO_REMOTE |
+      sandbox::MITIGATION_IMAGE_LOAD_NO_LOW_LABEL |
+      sandbox::MITIGATION_CHILD_PROCESS_CREATION_RESTRICTED;
 
   if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
     return base::Process();
@@ -715,6 +721,7 @@ base::Process StartSandboxedProcess(
   }
 #endif
 
+  // Post-startup mitigations.
   mitigations = sandbox::MITIGATION_STRICT_HANDLE_CHECKS |
                 sandbox::MITIGATION_DLL_SEARCH_ORDER;