Added a policy option to restrict the default DACL for tokens.

sandbox/win/src/restricted_token.cc

Index: sandbox/win/src/restricted_token.cc
diff --git a/sandbox/win/src/restricted_token.cc b/sandbox/win/src/restricted_token.cc
index 300feaedab1fce5c9df28a1c17d7d094c18754e7..cad65ec5ae58131a2407d6a419ce5213531687b7 100644
--- a/sandbox/win/src/restricted_token.cc
+++ b/sandbox/win/src/restricted_token.cc
@@ -158,10 +158,18 @@ DWORD RestrictedToken::GetRestrictedToken(
 
   base::win::ScopedHandle new_token(new_token_handle);
 
-  // Modify the default dacl on the token to contain Restricted and the user.
-  if (!AddSidToDefaultDacl(new_token.Get(), WinRestrictedCodeSid, GENERIC_ALL))
-    return ::GetLastError();
+  if (lockdown_default_dacl_) {
+    // Don't add Restricted sid and also remove logon sid access.
+    if (!RevokeLogonSidFromDefaultDacl(new_token.Get()))
+      return ::GetLastError();
+  } else {
+    // Modify the default dacl on the token to contain Restricted.
+    if (!AddSidToDefaultDacl(new_token.Get(), WinRestrictedCodeSid,
+                             GENERIC_ALL))
+      return ::GetLastError();

[Will Harris, 2016/03/27 01:20:05]

nit brackets for multiline if statement

[forshaw, 2016/03/28 16:40:31]

Done.

+  }
 
+  // Add user to default dacl.
   if (!AddUserSidToDefaultDacl(new_token.Get(), GENERIC_ALL))
     return ::GetLastError();
 
@@ -422,4 +430,8 @@ DWORD RestrictedToken::SetIntegrityLevel(IntegrityLevel integrity_level) {
   return ERROR_SUCCESS;
 }
 
+void RestrictedToken::SetLockdownDefaultDacl() {
+  lockdown_default_dacl_ = true;
+}
+
 }  // namespace sandbox