[Win10 sandbox mitigations] Four new Win10 mitigations added.

sandbox/win/src/process_mitigations.h

Index: sandbox/win/src/process_mitigations.h
diff --git a/sandbox/win/src/process_mitigations.h b/sandbox/win/src/process_mitigations.h
index 8bee0245a6f0d294f56ee0e10ea4498567cdcfe5..f0c1b2af6ce3f93a4539470575a4c5444679f118 100644
--- a/sandbox/win/src/process_mitigations.h
+++ b/sandbox/win/src/process_mitigations.h
@@ -25,7 +25,9 @@ MitigationFlags FilterPostStartupProcessMitigations(MitigationFlags flags);
 // between a 32-bit and a 64-bit type based on the exact build and version of
 // Windows, so the returned size must be passed to UpdateProcThreadAttribute().
 void ConvertProcessMitigationsToPolicy(MitigationFlags flags,

[jschuh, 2016/01/25 23:53:51]

As I mentioned above, I wouldn't thread child process blocking through this
function, and instead would infer it from the job object.

[penny, 2016/01/26 22:37:10]

Acknowledged.  See my comments about this.

-                                       DWORD64* policy_flags, size_t* size);
+                                       DWORD64* policy_flags,
+                                       size_t* size,
+                                       bool* no_child_processes);

[Will Harris, 2016/01/25 19:32:35]

add comment for what this argument does

[penny, 2016/01/26 22:37:10]

Done.

 
 // Adds mitigations that need to be performed on the suspended target process
 // before execution begins.