Allow the MITIGATION_WIN32K_DISABLE process mitigation to be set in the renderer sandbox.

content/public/common/content_switches.cc

Index: content/public/common/content_switches.cc
diff --git a/content/public/common/content_switches.cc b/content/public/common/content_switches.cc
index a8474064ffe241a0b6fef7455c6fd2609e5bdb0f..0ca47fe3816d0a2736010ef08bcdade1406a9ab3 100644
--- a/content/public/common/content_switches.cc
+++ b/content/public/common/content_switches.cc
@@ -430,6 +430,12 @@ const char kEnableDirectWrite[]             = "enable-direct-write";
 
 // Use high resolution timers for TimeTicks.
 const char kEnableHighResolutionTime[]      = "enable-high-resolution-time";
+
+// Enable the GDI32 and USER32 process mitigation policy for renderer processes
+// which prevents them from invoking user32 and gdi32 system calls which enter
+// the kernel. This is only supported on Windows 8 and beyond.
+const char kEnableGDIUser32RendererLockDown[]
+    = "enable_gdi_user32_renderer_lockdown";

[jschuh, 2014/05/16 20:28:12]

Could we just call these kEnableWin32kRendererLockDown and
enable_win32k_renderer_lockdown? That way they match the mitigation naming
convention.

[ananta, 2014/05/16 21:12:18]

Done.

 #endif
 
 // Paint content on the compositor thread instead of the main thread.