Implement sandbox hooks to forward OPM related GDI system calls.

content/browser/ppapi_plugin_process_host.cc

Index: content/browser/ppapi_plugin_process_host.cc
diff --git a/content/browser/ppapi_plugin_process_host.cc b/content/browser/ppapi_plugin_process_host.cc
index 56ae0eea7f4a8c901e0a6f080d06aa1fe49e62e6..3f1d56441ac15a1e729c758dcb13fefe12e1f904 100644
--- a/content/browser/ppapi_plugin_process_host.cc
+++ b/content/browser/ppapi_plugin_process_host.cc
@@ -97,7 +97,7 @@ class PpapiPluginSandboxedProcessLauncherDelegate
       for (const auto& mime_type : info_.mime_types) {
         if (browser_client->IsWin32kLockdownEnabledForMimeType(
                 mime_type.mime_type)) {
-          if (!AddWin32kLockdownPolicy(policy))
+          if (!AddWin32kLockdownPolicy(policy, true))

[Will Harris, 2016/04/26 17:18:26]

might want to pull this into a separate CL, i.e. have this 'false' for now, then
it's easily revertable, and also you can commit this one now as you have all
approvals.

             return false;
           break;
         }