Added a policy option to restrict the default DACL for tokens.

sandbox/win/src/acl.cc

Index: sandbox/win/src/acl.cc
diff --git a/sandbox/win/src/acl.cc b/sandbox/win/src/acl.cc
index f140c7e6c4f27715ecbe49adc993c24337cc660f..1670a849ad1ccbe1609007cc3072ec25d84936e9 100644
--- a/sandbox/win/src/acl.cc
+++ b/sandbox/win/src/acl.cc
@@ -56,7 +56,10 @@ bool AddSidToDacl(const Sid& sid, ACL* old_dacl, ACCESS_MODE access_mode,
   return true;
 }
 
-bool AddSidToDefaultDacl(HANDLE token, const Sid& sid, ACCESS_MASK access) {
+bool AddSidToDefaultDacl(HANDLE token,
+                         const Sid& sid,
+                         ACCESS_MODE access_mode,
+                         ACCESS_MASK access) {
   if (token == NULL)
     return false;
 
@@ -65,7 +68,7 @@ bool AddSidToDefaultDacl(HANDLE token, const Sid& sid, ACCESS_MASK access) {
     return false;
 
   ACL* new_dacl = NULL;
-  if (!AddSidToDacl(sid, default_dacl->DefaultDacl, GRANT_ACCESS, access,
+  if (!AddSidToDacl(sid, default_dacl->DefaultDacl, access_mode, access,
                     &new_dacl))
     return false;
 
@@ -78,6 +81,31 @@ bool AddSidToDefaultDacl(HANDLE token, const Sid& sid, ACCESS_MASK access) {
   return (TRUE == ret);
 }
 
+bool AddSidToDefaultDacl(HANDLE token, const Sid& sid, ACCESS_MASK access) {
+  return AddSidToDefaultDacl(token, sid, GRANT_ACCESS, access);
+}
+
+bool AddDenySidToDefaultDacl(HANDLE token, const Sid& sid, ACCESS_MASK access) {
+  return AddSidToDefaultDacl(token, sid, DENY_ACCESS, access);
+}
+
+bool RevokeLogonSidFromDefaultDacl(HANDLE token) {
+  DWORD size = sizeof(TOKEN_GROUPS) + SECURITY_MAX_SID_SIZE;
+  TOKEN_GROUPS* logon_sid = reinterpret_cast<TOKEN_GROUPS*>(malloc(size));
+
+  scoped_ptr<TOKEN_GROUPS, base::FreeDeleter> logon_sid_ptr(logon_sid);
+
+  if (!::GetTokenInformation(token, TokenLogonSid, logon_sid, size, &size))
+    return false;
+  if (logon_sid->GroupCount < 1) {
+    ::SetLastError(ERROR_INVALID_TOKEN);
+    return false;
+  }
+  return AddSidToDefaultDacl(token,
+                             reinterpret_cast<SID*>(logon_sid->Groups[0].Sid),
+                             REVOKE_ACCESS, 0);
+}
+
 bool AddUserSidToDefaultDacl(HANDLE token, ACCESS_MASK access) {
   DWORD size = sizeof(TOKEN_USER) + SECURITY_MAX_SID_SIZE;
   TOKEN_USER* token_user = reinterpret_cast<TOKEN_USER*>(malloc(size));