Close DeviceApi in Win8+ lockdown

content/common/sandbox_win.cc

Index: content/common/sandbox_win.cc
diff --git a/content/common/sandbox_win.cc b/content/common/sandbox_win.cc
index 7c3048aadbb477209d5a63b44b2f845bc33378ae..eff93d221f905bc992a42415276df82146899f10 100644
--- a/content/common/sandbox_win.cc
+++ b/content/common/sandbox_win.cc
@@ -343,6 +343,10 @@ bool AddPolicyForSandboxedProcess(sandbox::TargetPolicy* policy) {
   if (result != sandbox::SBOX_ALL_OK)
     return false;
 
+  // Win8+ adds a device DeviceApi that we don't need.
+  if (base::win::GetVersion() > base::win::VERSION_WIN7)
+    policy->AddKernelObjectToClose(L"File", L"\\Device\\DeviceApi");
+
   sandbox::TokenLevel initial_token = sandbox::USER_UNPROTECTED;
   if (base::win::GetVersion() > base::win::VERSION_XP) {
     // On 2003/Vista the initial token has to be restricted if the main