Removing unnecessary process ACL'ing for the remoting_desktop process

remoting/host/desktop_session_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/host/desktop_session_win.h"
 
 #include <sddl.h>
 
 #include <limits>
 #include <memory>
@@ skipping 43 matching lines @@
 
 // The security descriptor of the daemon IPC endpoint. It gives full access
 // to SYSTEM and denies access by anyone else.
 const wchar_t kDaemonIpcSecurityDescriptor[] =
     SDDL_OWNER L":" SDDL_LOCAL_SYSTEM
     SDDL_GROUP L":" SDDL_LOCAL_SYSTEM
     SDDL_DACL L":("
         SDDL_ACCESS_ALLOWED L";;" SDDL_GENERIC_ALL L";;;" SDDL_LOCAL_SYSTEM
     L")";
 
-// This security descriptor is used to give the network process, running in the
-// local service context, the PROCESS_QUERY_LIMITED_INFORMATION access right.
-// It also gives SYSTEM full control of the process and PROCESS_VM_READ,
-// PROCESS_QUERY_INFORMATION, PROCESS_TERMINATE, and READ_CONTROL rights to the
-// built-in administrators group.
-const wchar_t kDesktopProcessSecurityDescriptor[] =
-    SDDL_OWNER L":" SDDL_LOCAL_SYSTEM
-    SDDL_GROUP L":" SDDL_LOCAL_SYSTEM
-    SDDL_DACL L":"
-        SDDL_ACCESS_ALLOWED L";;" SDDL_GENERIC_ALL L";;;" SDDL_LOCAL_SYSTEM
-    L")("
-        SDDL_ACCESS_ALLOWED L";;0x21411;;;" SDDL_BUILTIN_ADMINISTRATORS
-    L")("
-        SDDL_ACCESS_ALLOWED L";;0x1000;;;" SDDL_LOCAL_SERVICE
-    L")";
-
 // The command line parameters that should be copied from the service's command
 // line to the desktop process.
 const char* kCopiedSwitchNames[] = { switches::kV, switches::kVModule };
 
 // The default screen dimensions for an RDP session.
 const int kDefaultRdpScreenWidth = 1280;
 const int kDefaultRdpScreenHeight = 768;
 
 // RDC 6.1 (W2K8) supports dimensions of up to 4096x2048.
 const int kMaxRdpScreenWidth = 4096;
@@ skipping 552 matching lines @@
       new base::CommandLine(desktop_binary));
   target->AppendSwitchASCII(kProcessTypeSwitchName, kProcessTypeDesktop);
   // Copy the command line switches enabling verbose logging.
   target->CopySwitchesFrom(*base::CommandLine::ForCurrentProcess(),
                            kCopiedSwitchNames, arraysize(kCopiedSwitchNames));
 
   // Create a delegate capable of launching a process in a different session.
   std::unique_ptr<WtsSessionProcessDelegate> delegate(
       new WtsSessionProcessDelegate(
           io_task_runner_, std::move(target), launch_elevated,
-          base::WideToUTF8(kDaemonIpcSecurityDescriptor),
-          base::WideToUTF8(kDesktopProcessSecurityDescriptor)));
+          base::WideToUTF8(kDaemonIpcSecurityDescriptor)));
   if (!delegate->Initialize(session_id)) {
     TerminateSession();
     return;
   }
 
   // Create a launcher for the desktop process, using the per-session delegate.
   launcher_.reset(new WorkerProcessLauncher(std::move(delegate), this));
   session_id_ = session_id;
 }
 
@@ skipping 44 matching lines @@
                                 exploded.hour,
                                 exploded.minute,
                                 exploded.second,
                                 exploded.millisecond,
                                 passed.c_str());
 
   last_timestamp_ = now;
 }
 
 }  // namespace remoting