OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/common/sandbox_win.h" | 5 #include "content/common/sandbox_win.h" |
6 | 6 |
7 #include <stddef.h> | 7 #include <stddef.h> |
8 | 8 |
9 #include <string> | 9 #include <string> |
10 | 10 |
(...skipping 682 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
693 | 693 |
694 sandbox::TargetPolicy* policy = g_broker_services->CreatePolicy(); | 694 sandbox::TargetPolicy* policy = g_broker_services->CreatePolicy(); |
695 | 695 |
696 // Pre-startup mitigations. | 696 // Pre-startup mitigations. |
697 sandbox::MitigationFlags mitigations = | 697 sandbox::MitigationFlags mitigations = |
698 sandbox::MITIGATION_HEAP_TERMINATE | | 698 sandbox::MITIGATION_HEAP_TERMINATE | |
699 sandbox::MITIGATION_BOTTOM_UP_ASLR | | 699 sandbox::MITIGATION_BOTTOM_UP_ASLR | |
700 sandbox::MITIGATION_DEP | | 700 sandbox::MITIGATION_DEP | |
701 sandbox::MITIGATION_DEP_NO_ATL_THUNK | | 701 sandbox::MITIGATION_DEP_NO_ATL_THUNK | |
702 sandbox::MITIGATION_SEHOP | | 702 sandbox::MITIGATION_SEHOP | |
703 sandbox::MITIGATION_NONSYSTEM_FONT_DISABLE | | |
704 sandbox::MITIGATION_IMAGE_LOAD_NO_REMOTE | | 703 sandbox::MITIGATION_IMAGE_LOAD_NO_REMOTE | |
705 sandbox::MITIGATION_IMAGE_LOAD_NO_LOW_LABEL; | 704 sandbox::MITIGATION_IMAGE_LOAD_NO_LOW_LABEL; |
705 #if !defined(NACL_WIN64) | |
706 // Only enable for DirectWrite, not GDI. | |
707 if (gfx::win::ShouldUseDirectWrite()) | |
708 mitigations |= sandbox::MITIGATION_NONSYSTEM_FONT_DISABLE; | |
709 #endif | |
Will Harris
2016/02/23 05:46:02
for the NACL_WIN64 case, I think we can always ena
penny
2016/02/23 21:24:56
Done.
| |
706 | 710 |
707 if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK) | 711 if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK) |
708 return base::Process(); | 712 return base::Process(); |
709 | 713 |
710 #if !defined(NACL_WIN64) | 714 #if !defined(NACL_WIN64) |
711 if (type_str == switches::kRendererProcess && | 715 if (type_str == switches::kRendererProcess && |
712 IsWin32kRendererLockdownEnabled()) { | 716 IsWin32kRendererLockdownEnabled()) { |
713 if (!AddWin32kLockdownPolicy(policy)) | 717 if (!AddWin32kLockdownPolicy(policy)) |
714 return base::Process(); | 718 return base::Process(); |
715 } | 719 } |
(...skipping 144 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
860 } | 864 } |
861 | 865 |
862 return false; | 866 return false; |
863 } | 867 } |
864 | 868 |
865 bool BrokerAddTargetPeer(HANDLE peer_process) { | 869 bool BrokerAddTargetPeer(HANDLE peer_process) { |
866 return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK; | 870 return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK; |
867 } | 871 } |
868 | 872 |
869 } // namespace content | 873 } // namespace content |
OLD | NEW |