Added a policy option to restrict the default DACL for tokens.

sandbox/win/src/restricted_token_utils.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <aclapi.h>
 #include <sddl.h>
 #include <vector>
 
 #include "sandbox/win/src/restricted_token_utils.h"
 
 #include "base/logging.h"
 #include "base/win/scoped_handle.h"
 #include "base/win/windows_version.h"
 #include "sandbox/win/src/job.h"
 #include "sandbox/win/src/restricted_token.h"
 #include "sandbox/win/src/security_level.h"
 #include "sandbox/win/src/sid.h"
 
 namespace sandbox {
 
 DWORD CreateRestrictedToken(TokenLevel security_level,
                             IntegrityLevel integrity_level,
                             TokenType token_type,
+                            bool lockdown_default_dacl,
                             base::win::ScopedHandle* token) {
   RestrictedToken restricted_token;
   restricted_token.Init(NULL);  // Initialized with the current process token
+  if (lockdown_default_dacl)
+    restricted_token.SetLockdownDefaultDacl();
 
   std::vector<base::string16> privilege_exceptions;
   std::vector<Sid> sid_exceptions;
 
   bool deny_sids = true;
   bool remove_privileges = true;
 
   switch (security_level) {
     case USER_UNPROTECTED: {
       deny_sids = false;
@@ skipping 256 matching lines @@
   if (!::OpenProcessToken(GetCurrentProcess(), READ_CONTROL | WRITE_OWNER,
                           &token_handle))
     return ::GetLastError();
 
   base::win::ScopedHandle token(token_handle);
 
   return HardenTokenIntegrityLevelPolicy(token.Get());
 }
 
 }  // namespace sandbox