Implement sandbox hooks to forward OPM related GDI system calls.

content/common/sandbox_win.cc

Index: content/common/sandbox_win.cc
diff --git a/content/common/sandbox_win.cc b/content/common/sandbox_win.cc
index fe266227ad899e66d818b19bc4c2aa97975a0838..a181d13e99abd0b3a9039d6bacf1a7574f3cd51b 100644
--- a/content/common/sandbox_win.cc
+++ b/content/common/sandbox_win.cc
@@ -590,7 +590,7 @@ void AddAppContainerPolicy(sandbox::TargetPolicy* policy, const wchar_t* sid) {
     policy->SetLowBox(sid);
 }
 
-bool AddWin32kLockdownPolicy(sandbox::TargetPolicy* policy) {
+bool AddWin32kLockdownPolicy(sandbox::TargetPolicy* policy, bool enable_opm) {
 #if !defined(NACL_WIN64)
   if (!IsWin32kRendererLockdownEnabled())
     return true;
@@ -603,10 +603,13 @@ bool AddWin32kLockdownPolicy(sandbox::TargetPolicy* policy) {
 
   sandbox::ResultCode result =
       policy->AddRule(sandbox::TargetPolicy::SUBSYS_WIN32K_LOCKDOWN,
-                      sandbox::TargetPolicy::FAKE_USER_GDI_INIT, nullptr);
+                      enable_opm ? sandbox::TargetPolicy::IMPLEMENT_OPM_APIS
+                                 : sandbox::TargetPolicy::FAKE_USER_GDI_INIT,
+                      nullptr);
   if (result != sandbox::SBOX_ALL_OK)
     return false;
-
+  if (enable_opm)
+    policy->SetEnableOPMRedirection();
   flags |= sandbox::MITIGATION_WIN32K_DISABLE;
   result = policy->SetProcessMitigations(flags);
   if (result != sandbox::SBOX_ALL_OK)
@@ -726,7 +729,7 @@ base::Process StartSandboxedProcess(
 #if !defined(NACL_WIN64)
   if (type_str == switches::kRendererProcess &&
       IsWin32kRendererLockdownEnabled()) {
-    if (!AddWin32kLockdownPolicy(policy))
+    if (!AddWin32kLockdownPolicy(policy, false))
       return base::Process();
   }
 #endif