Implement sandbox hooks to forward OPM related GDI system calls.

content/browser/ppapi_plugin_process_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/ppapi_plugin_process_host.h"
 
 #include <stddef.h>
 
 #include <string>
 #include <utility>
@@ skipping 79 matching lines @@
       return false;
 
     content::ContentBrowserClient* browser_client =
         GetContentClient()->browser();
 
 #if !defined(NACL_WIN64)
     if (IsWin32kRendererLockdownEnabled()) {
       for (const auto& mime_type : info_.mime_types) {
         if (browser_client->IsWin32kLockdownEnabledForMimeType(
                 mime_type.mime_type)) {
-          if (!AddWin32kLockdownPolicy(policy))
+          if (!AddWin32kLockdownPolicy(policy, true))

[Will Harris, 2016/04/26 17:18:26]

might want to pull this into a separate CL, i.e. have this 'false' for now, then
it's easily revertable, and also you can commit this one now as you have all
approvals.

             return false;
           break;
         }
       }
     }
 #endif
     const base::string16& sid =
         browser_client->GetAppContainerSidForSandboxType(GetSandboxType());
     if (!sid.empty())
       AddAppContainerPolicy(policy, sid.c_str());
@@ skipping 435 matching lines @@
   // sent_requests_ queue should be the one that the plugin just created.
   Client* client = sent_requests_.front();
   sent_requests_.pop();
 
   const ChildProcessData& data = process_->GetData();
   client->OnPpapiChannelOpened(channel_handle, base::GetProcId(data.handle),
                                data.id);
 }
 
 }  // namespace content