Don't modify the alternate winstation DACL

sandbox/win/src/window.cc

Index: sandbox/win/src/window.cc
diff --git a/sandbox/win/src/window.cc b/sandbox/win/src/window.cc
index a448b59f54ddef8050979a30c624b731cc76716a..b8d6358064754476bd14c430fd5480750f5283c4 100644
--- a/sandbox/win/src/window.cc
+++ b/sandbox/win/src/window.cc
@@ -48,20 +48,8 @@ ResultCode CreateAltWindowStation(HWINSTA* winsta) {
   *winsta = ::CreateWindowStationW(NULL, 0, WINSTA_ALL_ACCESS, &attributes);
   LocalFree(attributes.lpSecurityDescriptor);
 
-  if (*winsta) {
-    // Replace the DACL on the new Winstation with a reduced privilege version.
-    // We can soft fail on this for now, as it's just an extra mitigation.
-    static const ACCESS_MASK kWinstaDenyMask = DELETE | WRITE_DAC |
-                                               WRITE_OWNER |
-                                               WINSTA_ACCESSCLIPBOARD |
-                                               WINSTA_CREATEDESKTOP |
-                                               WINSTA_ENUMDESKTOPS |
-                                               WINSTA_ENUMERATE |
-                                               WINSTA_EXITWINDOWS;
-    AddKnownSidToObject(*winsta, SE_WINDOW_OBJECT, Sid(WinRestrictedCodeSid),
-                        DENY_ACCESS, kWinstaDenyMask);
+  if (*winsta)
     return SBOX_ALL_OK;
-  }
 
   return SBOX_ERROR_CANNOT_CREATE_WINSTATION;
 }