Added a policy option to restrict the default DACL for tokens.

sandbox/win/src/restricted_token_utils.cc

Index: sandbox/win/src/restricted_token_utils.cc
diff --git a/sandbox/win/src/restricted_token_utils.cc b/sandbox/win/src/restricted_token_utils.cc
index 9a06223324401d879c1822958e70587b66b2b836..9f1ebd810cc7fb5c944e5f69a58bcbb447ce9519 100644
--- a/sandbox/win/src/restricted_token_utils.cc
+++ b/sandbox/win/src/restricted_token_utils.cc
@@ -21,9 +21,12 @@ namespace sandbox {
 DWORD CreateRestrictedToken(TokenLevel security_level,
                             IntegrityLevel integrity_level,
                             TokenType token_type,
+                            bool lockdown_default_dacl,
                             base::win::ScopedHandle* token) {
   RestrictedToken restricted_token;
   restricted_token.Init(NULL);  // Initialized with the current process token
+  if (lockdown_default_dacl)
+    restricted_token.SetLockdownDefaultDacl();
 
   std::vector<base::string16> privilege_exceptions;
   std::vector<Sid> sid_exceptions;