Added a policy option to restrict the default DACL for tokens.

sandbox/win/src/sandbox_policy_base.cc

Index: sandbox/win/src/sandbox_policy_base.cc
diff --git a/sandbox/win/src/sandbox_policy_base.cc b/sandbox/win/src/sandbox_policy_base.cc
index 35440e5b5a2c22050f184dd6cf46b3ac9392d868..a3af98d3bbbd01a85801c70f21e1c2de9df1e491 100644
--- a/sandbox/win/src/sandbox_policy_base.cc
+++ b/sandbox/win/src/sandbox_policy_base.cc
@@ -136,7 +136,8 @@ PolicyBase::PolicyBase()
       is_csrss_connected_(true),
       policy_maker_(NULL),
       policy_(NULL),
-      lowbox_sid_(NULL) {
+      lowbox_sid_(NULL),
+      lockdown_default_dacl_(false) {
   ::InitializeCriticalSection(&lock_);
   dispatcher_.reset(new TopLevelDispatcher(this));
 }
@@ -434,6 +435,10 @@ void PolicyBase::AddHandleToShare(HANDLE handle) {
   handles_to_share_.push_back(handle);
 }
 
+void PolicyBase::SetLockdownDefaultDacl() {
+  lockdown_default_dacl_ = true;
+}
+
 const base::HandlesToInheritVector& PolicyBase::GetHandlesBeingShared() {
   return handles_to_share_;
 }
@@ -464,8 +469,9 @@ ResultCode PolicyBase::MakeTokens(base::win::ScopedHandle* initial,
 
   // Create the 'naked' token. This will be the permanent token associated
   // with the process and therefore with any thread that is not impersonating.
-  DWORD result = CreateRestrictedToken(lockdown_level_,  integrity_level_,
-                                       PRIMARY, lockdown);
+  DWORD result =
+      CreateRestrictedToken(lockdown_level_, integrity_level_, PRIMARY,
+                            lockdown_default_dacl_, lockdown);
   if (ERROR_SUCCESS != result)
     return SBOX_ERROR_GENERIC;
 
@@ -532,8 +538,9 @@ ResultCode PolicyBase::MakeTokens(base::win::ScopedHandle* initial,
   // Create the 'better' token. We use this token as the one that the main
   // thread uses when booting up the process. It should contain most of
   // what we need (before reaching main( ))
-  result = CreateRestrictedToken(initial_level_, integrity_level_,
-                                 IMPERSONATION, initial);
+  result =
+      CreateRestrictedToken(initial_level_, integrity_level_, IMPERSONATION,
+                            lockdown_default_dacl_, initial);
   if (ERROR_SUCCESS != result)
     return SBOX_ERROR_GENERIC;