Fix for running Chrome under a service token.

Fix for running Chrome under a service token.
This patch fixes an issue with the handling of the default DACL when running
Chrome under a service token, such as Local System. These tokens don't always
have an assigned logon session SID, which would cause the DACL lockdown process
to fail.

BUG=615396
CQ_INCLUDE_TRYBOTS=tryserver.chromium.win:win10_chromium_x64_rel_ng
TEST=1. Download PSTools from https://technet.microsoft.com/en-us/sysinternals/pstools.aspx
2. Run cmd.exe as an administrator
3. Run the command 'psexec -s -i c:\path\to\chrome.exe'
4. Verify that the browser is useable

Committed: https://crrev.com/6ac615dfd11e86b1ce7766e1de263ce3d2e3b727
Cr-Commit-Position: refs/heads/master@{#399529}

[forshaw, 2016-06-13 13:47:21]

Description was changed from

==========
Fix for running Chrome under a service token.
This patch fixes an issue with the handling of the default DACL when running
Chrome under a service token, such as Local System. These tokens don't always
have an assigned logon session SID, which would cause the DACL lockdown process
to fail.

BUG=615396
==========

to

==========
Fix for running Chrome under a service token.
This patch fixes an issue with the handling of the default DACL when running
Chrome under a service token, such as Local System. These tokens don't always
have an assigned logon session SID, which would cause the DACL lockdown process
to fail.

BUG=615396
CQ_INCLUDE_TRYBOTS=tryserver.chromium.win:win10_chromium_x64_rel_ng
==========

[forshaw, 2016-06-13 15:07:04]

forshaw@chromium.org changed reviewers:
+ wfh@chromium.org

[forshaw, 2016-06-13 15:07:05]

PTAL

[Will Harris, 2016-06-13 15:12:15]

On 2016/06/13 15:07:05, forshaw wrote:
> PTAL

Test = manual, run chrome under session 0 or something like that ?

Lgtm

[forshaw, 2016-06-13 15:36:03]

On 2016/06/13 15:12:15, Will Harris wrote:
> On 2016/06/13 15:07:05, forshaw wrote:
> > PTAL
> 
> Test = manual, run chrome under session 0 or something like that ?
> 
> Lgtm

Actually a realized that you could test it using the anonymous token which also
doesn't have a logon sid, so added a unit test. Though probably something
somewhere should manually verify that it still works in session 0 as local
system (ugh...). PTAL at the test.

[Will Harris, 2016-06-13 16:22:36]

lgtm still and feel free to ignore my nits.

If you put TEST= <steps> then test engineering (TE) will test if for you. It
looks like there are some steps in the bug you can reference them directly.

https://codereview.chromium.org/2061703002/diff/20001/sandbox/win/src/restric...
File sandbox/win/src/restricted_token_unittest.cc (right):

https://codereview.chromium.org/2061703002/diff/20001/sandbox/win/src/restric...
sandbox/win/src/restricted_token_unittest.cc:653:
ASSERT_EQ(static_cast<DWORD>(ERROR_SUCCESS),
nit, apparently the latest coding standard for casting like this is to use c++11
brace initialization

DWORD{ERROR_SUCCESS}

https://google.github.io/styleguide/cppguide.html#Casting

[forshaw, 2016-06-13 18:10:01]

Description was changed from

==========
Fix for running Chrome under a service token.
This patch fixes an issue with the handling of the default DACL when running
Chrome under a service token, such as Local System. These tokens don't always
have an assigned logon session SID, which would cause the DACL lockdown process
to fail.

BUG=615396
CQ_INCLUDE_TRYBOTS=tryserver.chromium.win:win10_chromium_x64_rel_ng
==========

to

==========
Fix for running Chrome under a service token.
This patch fixes an issue with the handling of the default DACL when running
Chrome under a service token, such as Local System. These tokens don't always
have an assigned logon session SID, which would cause the DACL lockdown process
to fail.

BUG=615396
CQ_INCLUDE_TRYBOTS=tryserver.chromium.win:win10_chromium_x64_rel_ng
TEST=Please follow the verification steps on the referenced bug report.
==========

[forshaw, 2016-06-13 18:53:29]

Description was changed from

==========
Fix for running Chrome under a service token.
This patch fixes an issue with the handling of the default DACL when running
Chrome under a service token, such as Local System. These tokens don't always
have an assigned logon session SID, which would cause the DACL lockdown process
to fail.

BUG=615396
CQ_INCLUDE_TRYBOTS=tryserver.chromium.win:win10_chromium_x64_rel_ng
TEST=Please follow the verification steps on the referenced bug report.
==========

to

==========
Fix for running Chrome under a service token.
This patch fixes an issue with the handling of the default DACL when running
Chrome under a service token, such as Local System. These tokens don't always
have an assigned logon session SID, which would cause the DACL lockdown process
to fail.

BUG=615396
CQ_INCLUDE_TRYBOTS=tryserver.chromium.win:win10_chromium_x64_rel_ng
TEST=1. Download PSTools from
https://technet.microsoft.com/en-us/sysinternals/pstools.aspx
2. Run cmd.exe as an administrator
3. Run the command 'psexec -s -i c:\path\to\chrome.exe'
4. Verify that the browser is useable
==========

[forshaw, 2016-06-13 18:53:58]

The CQ bit was checked by forshaw@chromium.org

[forshaw, 2016-06-13 18:53:59]

The patchset sent to the CQ was uploaded after l-g-t-m from wfh@chromium.org
Link to the patchset: https://codereview.chromium.org/2061703002/#ps40001
(title: "Minor nits")

[commit-bot: I haz the power, 2016-06-13 18:54:39]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2061703002/40001

[commit-bot: I haz the power, 2016-06-13 20:39:31]

Description was changed from

==========
Fix for running Chrome under a service token.
This patch fixes an issue with the handling of the default DACL when running
Chrome under a service token, such as Local System. These tokens don't always
have an assigned logon session SID, which would cause the DACL lockdown process
to fail.

BUG=615396
CQ_INCLUDE_TRYBOTS=tryserver.chromium.win:win10_chromium_x64_rel_ng
TEST=1. Download PSTools from
https://technet.microsoft.com/en-us/sysinternals/pstools.aspx
2. Run cmd.exe as an administrator
3. Run the command 'psexec -s -i c:\path\to\chrome.exe'
4. Verify that the browser is useable
==========

to

==========
Fix for running Chrome under a service token.
This patch fixes an issue with the handling of the default DACL when running
Chrome under a service token, such as Local System. These tokens don't always
have an assigned logon session SID, which would cause the DACL lockdown process
to fail.

BUG=615396
CQ_INCLUDE_TRYBOTS=tryserver.chromium.win:win10_chromium_x64_rel_ng
TEST=1. Download PSTools from
https://technet.microsoft.com/en-us/sysinternals/pstools.aspx
2. Run cmd.exe as an administrator
3. Run the command 'psexec -s -i c:\path\to\chrome.exe'
4. Verify that the browser is useable
==========

[commit-bot: I haz the power, 2016-06-13 20:39:32]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-06-13 20:39:35]

CQ bit was unchecked

[commit-bot: I haz the power, 2016-06-13 20:41:37]

Description was changed from

==========
Fix for running Chrome under a service token.
This patch fixes an issue with the handling of the default DACL when running
Chrome under a service token, such as Local System. These tokens don't always
have an assigned logon session SID, which would cause the DACL lockdown process
to fail.

BUG=615396
CQ_INCLUDE_TRYBOTS=tryserver.chromium.win:win10_chromium_x64_rel_ng
TEST=1. Download PSTools from
https://technet.microsoft.com/en-us/sysinternals/pstools.aspx
2. Run cmd.exe as an administrator
3. Run the command 'psexec -s -i c:\path\to\chrome.exe'
4. Verify that the browser is useable
==========

to

==========
Fix for running Chrome under a service token.
This patch fixes an issue with the handling of the default DACL when running
Chrome under a service token, such as Local System. These tokens don't always
have an assigned logon session SID, which would cause the DACL lockdown process
to fail.

BUG=615396
CQ_INCLUDE_TRYBOTS=tryserver.chromium.win:win10_chromium_x64_rel_ng
TEST=1. Download PSTools from
https://technet.microsoft.com/en-us/sysinternals/pstools.aspx
2. Run cmd.exe as an administrator
3. Run the command 'psexec -s -i c:\path\to\chrome.exe'
4. Verify that the browser is useable

Committed: https://crrev.com/6ac615dfd11e86b1ce7766e1de263ce3d2e3b727
Cr-Commit-Position: refs/heads/master@{#399529}
==========

[commit-bot: I haz the power, 2016-06-13 20:41:39]

Patchset 3 (id:??) landed as
https://crrev.com/6ac615dfd11e86b1ce7766e1de263ce3d2e3b727
Cr-Commit-Position: refs/heads/master@{#399529}