Added a policy option to restrict the default DACL for tokens.

sandbox/win/src/restricted_token.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_SRC_RESTRICTED_TOKEN_H_
 #define SANDBOX_SRC_RESTRICTED_TOKEN_H_
 
 #include <windows.h>
 #include <vector>
 
@@ skipping 150 matching lines @@
   //
   // If the function succeeds, the return value is ERROR_SUCCESS. If the
   // function fails, the return value is the win32 error code corresponding to
   // the error.
   DWORD AddRestrictingSidAllSids();
 
   // Sets the token integrity level. This is only valid on Vista. The integrity
   // level cannot be higher than your current integrity level.
   DWORD SetIntegrityLevel(IntegrityLevel integrity_level);
 
+  // Set a flag which indicates the created token should have a locked down
+  // default DACL when created.
+  void SetLockdownDefaultDacl();
+
  private:
   // The list of restricting sids in the restricted token.
   std::vector<Sid> sids_to_restrict_;
   // The list of privileges to remove in the restricted token.
   std::vector<LUID> privileges_to_disable_;
   // The list of sids to mark as Deny Only in the restricted token.
   std::vector<Sid> sids_for_deny_only_;
   // The token to restrict. Can only be set in a constructor.
   base::win::ScopedHandle effective_token_;
   // The token integrity level. Only valid on Vista.
   IntegrityLevel integrity_level_;
   // Tells if the object is initialized or not (if Init() has been called)
   bool init_;
+  // Lockdown the default DACL when creating new tokens.
+  bool lockdown_default_dacl_;
 
   DISALLOW_COPY_AND_ASSIGN(RestrictedToken);
 };
 
 }  // namespace sandbox
 
 #endif  // SANDBOX_SRC_RESTRICTED_TOKEN_H_