Added a policy option to restrict the default DACL for tokens.

sandbox/win/src/restricted_token.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/restricted_token.h"
 
 #include <stddef.h>
 
 #include <vector>
 
@@ skipping 140 matching lines @@
     delete[] sids_to_restrict_array;
 
   if (privileges_to_disable_array)
     delete[] privileges_to_disable_array;
 
   if (!result)
     return last_error;
 
   base::win::ScopedHandle new_token(new_token_handle);
 
-  // Modify the default dacl on the token to contain Restricted and the user.
-  if (!AddSidToDefaultDacl(new_token.Get(), WinRestrictedCodeSid, GENERIC_ALL))
-    return ::GetLastError();
+  if (lockdown_default_dacl_) {
+    // Don't add Restricted sid and also remove logon sid access.
+    if (!RevokeLogonSidFromDefaultDacl(new_token.Get()))
+      return ::GetLastError();
+  } else {
+    // Modify the default dacl on the token to contain Restricted.
+    if (!AddSidToDefaultDacl(new_token.Get(), WinRestrictedCodeSid,
+                             GENERIC_ALL))
+      return ::GetLastError();

[Will Harris, 2016/03/27 01:20:05]

nit brackets for multiline if statement

[forshaw, 2016/03/28 16:40:31]

Done.

+  }
 
+  // Add user to default dacl.
   if (!AddUserSidToDefaultDacl(new_token.Get(), GENERIC_ALL))
     return ::GetLastError();
 
   DWORD error = SetTokenIntegrityLevel(new_token.Get(), integrity_level_);
   if (ERROR_SUCCESS != error)
     return error;
 
   HANDLE token_handle;
   if (!::DuplicateHandle(::GetCurrentProcess(), new_token.Get(),
                          ::GetCurrentProcess(), &token_handle,
@@ skipping 240 matching lines @@
   }
 
   return ERROR_SUCCESS;
 }
 
 DWORD RestrictedToken::SetIntegrityLevel(IntegrityLevel integrity_level) {
   integrity_level_ = integrity_level;
   return ERROR_SUCCESS;
 }
 
+void RestrictedToken::SetLockdownDefaultDacl() {
+  lockdown_default_dacl_ = true;
+}
+
 }  // namespace sandbox