Added a policy option to restrict the default DACL for tokens.

sandbox/win/src/acl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/acl.h"
 
 #include <aclapi.h>
 #include <sddl.h>
 
 #include "base/logging.h"
@@ skipping 38 matching lines @@
   new_access.Trustee.TrusteeForm = TRUSTEE_IS_SID;
   new_access.Trustee.ptstrName = reinterpret_cast<LPWSTR>(
                                     const_cast<SID*>(sid.GetPSID()));
 
   if (ERROR_SUCCESS != ::SetEntriesInAcl(1, &new_access, old_dacl, new_dacl))
     return false;
 
   return true;
 }
 
-bool AddSidToDefaultDacl(HANDLE token, const Sid& sid, ACCESS_MASK access) {
+bool AddSidToDefaultDacl(HANDLE token,
+                         const Sid& sid,
+                         ACCESS_MODE access_mode,
+                         ACCESS_MASK access) {
   if (token == NULL)
     return false;
 
   scoped_ptr<TOKEN_DEFAULT_DACL, base::FreeDeleter> default_dacl;
   if (!GetDefaultDacl(token, &default_dacl))
     return false;
 
   ACL* new_dacl = NULL;
-  if (!AddSidToDacl(sid, default_dacl->DefaultDacl, GRANT_ACCESS, access,
+  if (!AddSidToDacl(sid, default_dacl->DefaultDacl, access_mode, access,
                     &new_dacl))
     return false;
 
   TOKEN_DEFAULT_DACL new_token_dacl = {0};
   new_token_dacl.DefaultDacl = new_dacl;
 
   BOOL ret = ::SetTokenInformation(token, TokenDefaultDacl, &new_token_dacl,
                                    sizeof(new_token_dacl));
   ::LocalFree(new_dacl);
   return (TRUE == ret);
 }
 
+bool RevokeLogonSidFromDefaultDacl(HANDLE token) {
+  DWORD size = sizeof(TOKEN_GROUPS) + SECURITY_MAX_SID_SIZE;
+  TOKEN_GROUPS* logon_sid = reinterpret_cast<TOKEN_GROUPS*>(malloc(size));
+
+  scoped_ptr<TOKEN_GROUPS, base::FreeDeleter> logon_sid_ptr(logon_sid);
+
+  if (!::GetTokenInformation(token, TokenLogonSid, logon_sid, size, &size))
+    return false;
+  if (logon_sid->GroupCount < 1) {
+    ::SetLastError(ERROR_INVALID_TOKEN);
+    return false;
+  }
+  return AddSidToDefaultDacl(token,
+                             reinterpret_cast<SID*>(logon_sid->Groups[0].Sid),
+                             REVOKE_ACCESS, 0);
+}
+
 bool AddUserSidToDefaultDacl(HANDLE token, ACCESS_MASK access) {
   DWORD size = sizeof(TOKEN_USER) + SECURITY_MAX_SID_SIZE;
   TOKEN_USER* token_user = reinterpret_cast<TOKEN_USER*>(malloc(size));
 
   scoped_ptr<TOKEN_USER, base::FreeDeleter> token_user_ptr(token_user);
 
   if (!::GetTokenInformation(token, TokenUser, token_user, size, &size))
     return false;
 
   return AddSidToDefaultDacl(token,
                              reinterpret_cast<SID*>(token_user->User.Sid),
-                             access);
+                             GRANT_ACCESS, access);
 }
 
 bool AddKnownSidToObject(HANDLE object, SE_OBJECT_TYPE object_type,
                          const Sid& sid, ACCESS_MODE access_mode,
                          ACCESS_MASK access) {
   PSECURITY_DESCRIPTOR descriptor = NULL;
   PACL old_dacl = NULL;
   PACL new_dacl = NULL;
 
   if (ERROR_SUCCESS != ::GetSecurityInfo(object, object_type,
@@ skipping 13 matching lines @@
   ::LocalFree(new_dacl);
   ::LocalFree(descriptor);
 
   if (ERROR_SUCCESS != result)
     return false;
 
   return true;
 }
 
 }  // namespace sandbox