Add header comments documenting extra constraints for some sandbox mitigations: MITIGATION_RELOCATE…

sandbox/win/src/security_level.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_SRC_SECURITY_LEVEL_H_
 #define SANDBOX_SRC_SECURITY_LEVEL_H_
 
 #include <stdint.h>
 
 namespace sandbox {
@@ skipping 136 matching lines @@
 // Permanently Disables ATL thunk emulation when DEP is enabled. Valid
 // only when MITIGATION_DEP is passed. Corresponds to not passing
 // PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE.
 const MitigationFlags MITIGATION_DEP_NO_ATL_THUNK                 = 0x00000002;
 
 // Enables Structured exception handling override prevention. Must be
 // enabled prior to process start. Corresponds to
 // PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE.
 const MitigationFlags MITIGATION_SEHOP                            = 0x00000004;
 
-// Forces ASLR on all images in the child process. Corresponds to
+// Forces ASLR on all images in the child process. In debug builds, must be
+// enabled after startup. Corresponds to
 // PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON .
 const MitigationFlags MITIGATION_RELOCATE_IMAGE                   = 0x00000008;
 
-// Refuses to load DLLs that cannot support ASLR. Corresponds to
+// Refuses to load DLLs that cannot support ASLR. In debug builds, must be
+// enabled after startup. Corresponds to

[Will Harris, 2016/09/23 19:31:10]

hmm if this is true and these can be set post startup for debug builds then I'd
like ProcessMitigationsTest.CheckWin8 to be updated to add this flag in debug
for SetDelayedProcessMitigations and verify this works.

[Joe Mason, 2016/09/23 22:34:34]

Done.

 // PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON_REQ_RELOCS.
 const MitigationFlags MITIGATION_RELOCATE_IMAGE_REQUIRED          = 0x00000010;
 
 // Terminates the process on Windows heap corruption. Coresponds to
 // PROCESS_CREATION_MITIGATION_POLICY_HEAP_TERMINATE_ALWAYS_ON.
 const MitigationFlags MITIGATION_HEAP_TERMINATE                   = 0x00000020;
 
 // Sets a random lower bound as the minimum user address. Must be
 // enabled prior to process start. On 32-bit processes this is
 // emulated to a much smaller degree. Corresponds to
 // PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON.
 const MitigationFlags MITIGATION_BOTTOM_UP_ASLR                   = 0x00000040;
 
 // Increases the randomness range of bottom-up ASLR to up to 1TB. Must be
 // enabled prior to process start and with MITIGATION_BOTTOM_UP_ASLR.
 // Corresponds to
 // PROCESS_CREATION_MITIGATION_POLICY_HIGH_ENTROPY_ASLR_ALWAYS_ON
 const MitigationFlags MITIGATION_HIGH_ENTROPY_ASLR                = 0x00000080;
 
 // Immediately raises an exception on a bad handle reference. Must be
 // enabled after startup. Corresponds to
 // PROCESS_CREATION_MITIGATION_POLICY_STRICT_HANDLE_CHECKS_ALWAYS_ON.
 const MitigationFlags MITIGATION_STRICT_HANDLE_CHECKS             = 0x00000100;
 
 // Prevents the process from making Win32k calls. Corresponds to
 // PROCESS_CREATION_MITIGATION_POLICY_WIN32K_SYSTEM_CALL_DISABLE_ALWAYS_ON.
+//
+// Applications linked to user32.dll or gdi32.dll make Win32k calls during
+// setup, even if Win32k is not otherwise used. So they also need to add a rule
+// with SUBSYS_WIN32K_LOCKDOWN and semantics FAKE_USER_GDI_INIT to allow the
+// initialization to succeed.
 const MitigationFlags MITIGATION_WIN32K_DISABLE                   = 0x00000200;
 
 // Prevents certain built-in third party extension points from being used.
 // - App_Init DLLs
 // - Winsock Layered Service Providers (LSPs)
 // - Global Windows Hooks (NOT thread-targeted hooks)
 // - Legacy Input Method Editors (IMEs).
 // I.e.: Disable legacy hooking mechanisms.  Corresponds to
 // PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_ON.
 const MitigationFlags MITIGATION_EXTENSION_POINT_DISABLE = 0x00000400;
@@ skipping 18 matching lines @@
 // PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_REMOTE_ALWAYS_ON.
 const MitigationFlags MITIGATION_IMAGE_LOAD_NO_REMOTE = 0x00000001ULL << 52;
 
 // Blocks mapping of images that have the low manditory label. Corresponds to
 // PROCESS_CREATION_MITIGATION_POLICY_IMAGE_LOAD_NO_LOW_LABEL_ALWAYS_ON.
 const MitigationFlags MITIGATION_IMAGE_LOAD_NO_LOW_LABEL = 0x00000001ULL << 56;
 
 }  // namespace sandbox
 
 #endif  // SANDBOX_SRC_SECURITY_LEVEL_H_