Enable win32k lockdown for ppapi processes.

content/browser/ppapi_plugin_process_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/ppapi_plugin_process_host.h"
 
 #include <stddef.h>
 
 #include <string>
 #include <utility>
@@ skipping 43 matching lines @@
 
 #if defined(OS_POSIX) && !defined(OS_ANDROID) && !defined(OS_MACOSX)
 ZygoteHandle g_ppapi_zygote;
 #endif  // defined(OS_POSIX) && !defined(OS_ANDROID) && !defined(OS_MACOSX)
 
 // NOTE: changes to this class need to be reviewed by the security team.
 class PpapiPluginSandboxedProcessLauncherDelegate
     : public content::SandboxedProcessLauncherDelegate {
  public:
   PpapiPluginSandboxedProcessLauncherDelegate(bool is_broker,
-                                              const PepperPluginInfo& info,
                                               ChildProcessHost* host)
 #if defined(OS_WIN)
-      : info_(info), is_broker_(is_broker) {
+      : is_broker_(is_broker) {
 #elif defined(OS_MACOSX) || defined(OS_ANDROID)
       : ipc_fd_(host->TakeClientFileDescriptor()) {
 #elif defined(OS_POSIX)
       : ipc_fd_(host->TakeClientFileDescriptor()), is_broker_(is_broker) {
 #else
   {
 #endif
   }
 
   ~PpapiPluginSandboxedProcessLauncherDelegate() override {}
@@ skipping 13 matching lines @@
     result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_NAMED_PIPES,
                              sandbox::TargetPolicy::NAMEDPIPES_ALLOW_ANY,
                              L"\\\\.\\pipe\\chrome.*");
     if (result != sandbox::SBOX_ALL_OK)
       return false;
 
     content::ContentBrowserClient* browser_client =
         GetContentClient()->browser();
 
 #if !defined(NACL_WIN64)
-    if (IsWin32kRendererLockdownEnabled()) {
-      for (const auto& mime_type : info_.mime_types) {
-        if (browser_client->IsWin32kLockdownEnabledForMimeType(
-                mime_type.mime_type)) {
-          result = AddWin32kLockdownPolicy(policy, true);
-          if (result != sandbox::SBOX_ALL_OK)
-            return false;
-          break;
-        }
-      }
+    if (IsWin32kLockdownEnabled()) {
+      result = AddWin32kLockdownPolicy(policy, true);
+      if (result != sandbox::SBOX_ALL_OK)
+        return false;
     }
 #endif
     const base::string16& sid =
         browser_client->GetAppContainerSidForSandboxType(GetSandboxType());
     if (!sid.empty())
       AddAppContainerPolicy(policy, sid.c_str());
 
     return true;
   }
 
@@ skipping 11 matching lines @@
 #endif  // !defined(OS_MACOSX) && !defined(OS_ANDROID)
 
   base::ScopedFD TakeIpcFd() override { return std::move(ipc_fd_); }
 #endif  // OS_WIN
 
   SandboxType GetSandboxType() override {
     return SANDBOX_TYPE_PPAPI;
   }
 
  private:
-#if defined(OS_WIN)
-  const PepperPluginInfo& info_;
-#endif // OS_WIN
 #if defined(OS_POSIX)
   base::ScopedFD ipc_fd_;
 #endif  // OS_POSIX
 #if (defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_ANDROID)) || \
     defined(OS_WIN)
   bool is_broker_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(PpapiPluginSandboxedProcessLauncherDelegate);
 };
@@ skipping 294 matching lines @@
 #endif
 
   if (!plugin_launcher.empty())
     cmd_line->PrependWrapper(plugin_launcher);
 
   // On posix, never use the zygote for the broker. Also, only use the zygote if
   // we are not using a plugin launcher - having a plugin launcher means we need
   // to use another process instead of just forking the zygote.
   process_->Launch(
       new PpapiPluginSandboxedProcessLauncherDelegate(is_broker_,
-                                                      info,
                                                       process_->GetHost()),
       cmd_line,
       true);
   return true;
 }
 
 void PpapiPluginProcessHost::RequestPluginChannel(Client* client) {
   base::ProcessHandle process_handle;
   int renderer_child_id;
   client->GetPpapiChannelInfo(&process_handle, &renderer_child_id);
@@ skipping 89 matching lines @@
   // sent_requests_ queue should be the one that the plugin just created.
   Client* client = sent_requests_.front();
   sent_requests_.pop();
 
   const ChildProcessData& data = process_->GetData();
   client->OnPpapiChannelOpened(channel_handle, base::GetProcId(data.handle),
                                data.id);
 }
 
 }  // namespace content