Support DirectWrite with sandbox on

content/common/sandbox_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_win.h"
 
 #include <string>
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
@@ skipping 291 matching lines @@
     return false;
 
   // Allow the server side of sync sockets, which are pipes that have
   // the "chrome.sync" namespace and a randomly generated suffix.
   result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_NAMED_PIPES,
                            sandbox::TargetPolicy::NAMEDPIPES_ALLOW_ANY,
                            L"\\\\.\\pipe\\chrome.sync.*");
   if (result != sandbox::SBOX_ALL_OK)
     return false;
 
+  // XXX: This is in the wrong place, it should only apply to the renderer.

[scottmg, 2014/03/21 23:04:06]

This needs to be made renderer-only rather than in generic.

[Will Harris, 2014/03/21 23:55:47]

suggested location below around 657

+  base::FilePath directory;
+  if (!PathService::Get(base::DIR_WINDOWS_FONTS, &directory))
+    return false;
+  directory.Append(FILE_PATH_LITERAL("\\*"));
+  result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
+                           sandbox::TargetPolicy::FILES_ALLOW_READONLY,
+                           directory.value().c_str());
+  if (result != sandbox::SBOX_ALL_OK)
+    return false;
+
   // Add the policy for debug message only in debug
 #ifndef NDEBUG
   base::FilePath app_dir;
   if (!PathService::Get(base::DIR_MODULE, &app_dir))
     return false;
 
   wchar_t long_path_buf[MAX_PATH];
   DWORD long_path_return_value = GetLongPathName(app_dir.value().c_str(),
                                                  long_path_buf,
                                                  MAX_PATH);
@@ skipping 314 matching lines @@
 
   if (!disable_default_policy && !AddPolicyForSandboxedProcess(policy))
     return 0;
 
   if (type_str != switches::kRendererProcess) {
     // Hack for Google Desktop crash. Trick GD into not injecting its DLL into
     // this subprocess. See
     // http://code.google.com/p/chromium/issues/detail?id=25580
     cmd_line->AppendSwitchASCII("ignored", " --type=renderer ");
   }
 

[Will Harris, 2014/03/21 23:55:47]

maybe put that policy here

   sandbox::ResultCode result;
   if (!exposed_dir.empty()) {
     result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
                              sandbox::TargetPolicy::FILES_ALLOW_ANY,
                              exposed_dir.value().c_str());
     if (result != sandbox::SBOX_ALL_OK)
       return 0;
 
     base::FilePath exposed_files = exposed_dir.AppendASCII("*");
     result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
@@ skipping 87 matching lines @@
   }
 
   return false;
 }
 
 bool BrokerAddTargetPeer(HANDLE peer_process) {
   return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK;
 }
 
 }  // namespace content