Don't modify the alternate winstation DACL

sandbox/win/src/window.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/window.h"
 
 #include <aclapi.h>
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 30 matching lines @@
   if (!GetSecurityAttributes(::GetProcessWindowStation(), &attributes)) {
     return SBOX_ERROR_CANNOT_CREATE_WINSTATION;
   }
 
   // Create the window station using NULL for the name to ask the os to
   // generate it.
   // TODO(nsylvain): don't ask for WINSTA_ALL_ACCESS if we don't need to.
   *winsta = ::CreateWindowStationW(NULL, 0, WINSTA_ALL_ACCESS, &attributes);
   LocalFree(attributes.lpSecurityDescriptor);
 
-  if (*winsta) {
-    // Replace the DACL on the new Winstation with a reduced privilege version.
-    // We can soft fail on this for now, as it's just an extra mitigation.
-    static const ACCESS_MASK kWinstaDenyMask = DELETE | WRITE_DAC |
-                                               WRITE_OWNER |
-                                               WINSTA_ACCESSCLIPBOARD |
-                                               WINSTA_CREATEDESKTOP |
-                                               WINSTA_ENUMDESKTOPS |
-                                               WINSTA_ENUMERATE |
-                                               WINSTA_EXITWINDOWS;
-    AddKnownSidToObject(*winsta, SE_WINDOW_OBJECT, Sid(WinRestrictedCodeSid),
-                        DENY_ACCESS, kWinstaDenyMask);
+  if (*winsta)
     return SBOX_ALL_OK;
-  }
 
   return SBOX_ERROR_CANNOT_CREATE_WINSTATION;
 }
 
 ResultCode CreateAltDesktop(HWINSTA winsta, HDESK* desktop) {
   base::string16 desktop_name = L"sbox_alternate_desktop_";
 
   // Append the current PID to the desktop name.
   wchar_t buffer[16];
   _snwprintf_s(buffer, sizeof(buffer) / sizeof(wchar_t), L"0x%X",
@@ skipping 84 matching lines @@
   if (winsta) {
     name = GetWindowObjectName(winsta);
     name += L'\\';
   }
 
   name += GetWindowObjectName(desktop);
   return name;
 }
 
 }  // namespace sandbox