[Win10 sandbox mitigations] MITIGATION_NONSYSTEM_FONT_DISABLE adjustment.

content/common/sandbox_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_win.h"
 
 #include <stddef.h>
 
 #include <string>
 
@@ skipping 685 matching lines @@
   // Pre-startup mitigations.
   sandbox::MitigationFlags mitigations =
       sandbox::MITIGATION_HEAP_TERMINATE |
       sandbox::MITIGATION_BOTTOM_UP_ASLR |
       sandbox::MITIGATION_DEP |
       sandbox::MITIGATION_DEP_NO_ATL_THUNK |
       sandbox::MITIGATION_SEHOP |
       sandbox::MITIGATION_NONSYSTEM_FONT_DISABLE |
       sandbox::MITIGATION_IMAGE_LOAD_NO_REMOTE |
       sandbox::MITIGATION_IMAGE_LOAD_NO_LOW_LABEL;
 

[jschuh, 2016/02/22 22:30:25]

Strike MITIGATION_NONSYSTEM_FONT_DISABLE in the default flags above and add it
in conditionally like this:

  if (gfx::win::ShouldUseDirectWrite())
    mitigations |= sandbox::MITIGATION_NONSYSTEM_FONT_DISABLE;

[penny, 2016/02/23 05:30:37]

Done.  I'm fairly sure it needs to be wrapped in "#if !defined(NACL_WIN64)". 
Let me know if not.

[Will Harris, 2016/02/23 05:46:02]

yes it does - since direct_write.cc isn't compiled with nacl64. You'd get linker
errors otherwise.

   if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
     return base::Process();
 
 #if !defined(NACL_WIN64)
   if (type_str == switches::kRendererProcess &&
       IsWin32kRendererLockdownEnabled()) {
     if (!AddWin32kLockdownPolicy(policy))
       return base::Process();
   }
 #endif
@@ skipping 15 matching lines @@
 #if !defined(NACL_WIN64)
   if (type_str == switches::kRendererProcess ||
       type_str == switches::kPpapiPluginProcess) {
     if (gfx::win::ShouldUseDirectWrite()) {
       AddDirectory(base::DIR_WINDOWS_FONTS,
                   NULL,
                   true,
                   sandbox::TargetPolicy::FILES_ALLOW_READONLY,
                   policy);
 
+      // Turn off the MITIGATION_NONSYSTEM_FONT_DISABLE mitigation
+      // when Direct Write is enabled.

[jschuh, 2016/02/22 22:30:24]

I think this is backward. Don't you want to enable the mitigation only when DW
is enabled?

[penny, 2016/02/23 05:30:37]

Done.

+      sandbox::MitigationFlags temp =
+          ~sandbox::MITIGATION_NONSYSTEM_FONT_DISABLE;
+      mitigations = policy->GetProcessMitigations();
+      mitigations &= temp;
+      if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
+        return base::Process();
+
       if (!ShouldUseDirectWriteFontProxyFieldTrial()) {
         // If DirectWrite is enabled for font rendering then open the font
         // cache section which is created by the browser and pass the handle to
         // the renderer process. This is needed because renderer processes on
         // Windows 8+ may be running in an AppContainer sandbox and hence their
         // kernel object namespace may be partitioned.
         std::string name(content::kFontCacheSharedSectionName);
         name.append(base::UintToString(base::GetCurrentProcId()));
 
         base::SharedMemory direct_write_font_cache_section;
@@ skipping 108 matching lines @@
   }
 
   return false;
 }
 
 bool BrokerAddTargetPeer(HANDLE peer_process) {
   return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK;
 }
 
 }  // namespace content