Added a policy option to restrict the default DACL for tokens.

sandbox/win/src/restricted_token.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/restricted_token.h"
 
 #include <stddef.h>
 
 #include <vector>
 
@@ skipping 27 matching lines @@
   *error = ERROR_SUCCESS;
   return buffer;
 }
 
 }  // namespace
 
 namespace sandbox {
 
 RestrictedToken::RestrictedToken()
     : integrity_level_(INTEGRITY_LEVEL_LAST),
-      init_(false) {
-}
+      init_(false),
+      lockdown_default_dacl_(false) {}
 
 RestrictedToken::~RestrictedToken() {
 }
 
 DWORD RestrictedToken::Init(const HANDLE effective_token) {
   if (init_)
     return ERROR_ALREADY_INITIALIZED;
 
   HANDLE temp_token;
   if (effective_token) {
@@ skipping 91 matching lines @@
     delete[] sids_to_restrict_array;
 
   if (privileges_to_disable_array)
     delete[] privileges_to_disable_array;
 
   if (!result)
     return last_error;
 
   base::win::ScopedHandle new_token(new_token_handle);
 
-  // Modify the default dacl on the token to contain Restricted and the user.
-  if (!AddSidToDefaultDacl(new_token.Get(), WinRestrictedCodeSid, GENERIC_ALL))
-    return ::GetLastError();
+  if (lockdown_default_dacl_) {
+    // Don't add Restricted sid and also remove logon sid access.
+    if (!RevokeLogonSidFromDefaultDacl(new_token.Get()))
+      return ::GetLastError();
+  } else {
+    // Modify the default dacl on the token to contain Restricted.
+    if (!AddSidToDefaultDacl(new_token.Get(), WinRestrictedCodeSid,
+                             GRANT_ACCESS, GENERIC_ALL)) {
+      return ::GetLastError();
+    }
+  }
 
+  // Add user to default dacl.
   if (!AddUserSidToDefaultDacl(new_token.Get(), GENERIC_ALL))
     return ::GetLastError();
 
   DWORD error = SetTokenIntegrityLevel(new_token.Get(), integrity_level_);
   if (ERROR_SUCCESS != error)
     return error;
 
   HANDLE token_handle;
   if (!::DuplicateHandle(::GetCurrentProcess(), new_token.Get(),
                          ::GetCurrentProcess(), &token_handle,
@@ skipping 240 matching lines @@
   }
 
   return ERROR_SUCCESS;
 }
 
 DWORD RestrictedToken::SetIntegrityLevel(IntegrityLevel integrity_level) {
   integrity_level_ = integrity_level;
   return ERROR_SUCCESS;
 }
 
+void RestrictedToken::SetLockdownDefaultDacl() {
+  lockdown_default_dacl_ = true;
+}
+
 }  // namespace sandbox