Index: content/common/sandbox_win.cc |
diff --git a/content/common/sandbox_win.cc b/content/common/sandbox_win.cc |
index 523073863b7c667862146a9fe0d102bcafc3585d..ed4c565644afa6f37a660002c65e64ab50c8c390 100644 |
--- a/content/common/sandbox_win.cc |
+++ b/content/common/sandbox_win.cc |
@@ -698,11 +698,17 @@ base::Process StartSandboxedProcess( |
sandbox::TargetPolicy* policy = g_broker_services->CreatePolicy(); |
- sandbox::MitigationFlags mitigations = sandbox::MITIGATION_HEAP_TERMINATE | |
- sandbox::MITIGATION_BOTTOM_UP_ASLR | |
- sandbox::MITIGATION_DEP | |
- sandbox::MITIGATION_DEP_NO_ATL_THUNK | |
- sandbox::MITIGATION_SEHOP; |
+ // Pre-startup mitigations. |
+ sandbox::MitigationFlags mitigations = |
+ sandbox::MITIGATION_HEAP_TERMINATE | |
+ sandbox::MITIGATION_BOTTOM_UP_ASLR | |
+ sandbox::MITIGATION_DEP | |
+ sandbox::MITIGATION_DEP_NO_ATL_THUNK | |
+ sandbox::MITIGATION_SEHOP | |
+ sandbox::MITIGATION_NONSYSTEM_FONT_DISABLE | |
jschuh
2016/01/25 23:53:51
This will break the GDI path, which some people ar
penny
2016/01/26 22:37:09
Acknowledged. I was not aware of this at all, tha
|
+ sandbox::MITIGATION_IMAGE_LOAD_NO_REMOTE | |
+ sandbox::MITIGATION_IMAGE_LOAD_NO_LOW_LABEL | |
+ sandbox::MITIGATION_CHILD_PROCESS_CREATION_RESTRICTED; |
if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK) |
return base::Process(); |
@@ -715,6 +721,7 @@ base::Process StartSandboxedProcess( |
} |
#endif |
+ // Post-startup mitigations. |
mitigations = sandbox::MITIGATION_STRICT_HANDLE_CHECKS | |
sandbox::MITIGATION_DLL_SEARCH_ORDER; |