Sandbox policy and intercepts for the MITIGATION_WIN32K_DISABLE policy for renderer processes.

content/common/sandbox_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_win.h"
 
 #include <string>
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
@@ skipping 316 matching lines @@
   debug_message = debug_message.AppendASCII("debug_message.exe");
   result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_PROCESS,
                            sandbox::TargetPolicy::PROCESS_MIN_EXEC,
                            debug_message.value().c_str());
   if (result != sandbox::SBOX_ALL_OK)
     return false;
 #endif  // NDEBUG
 
   AddGenericDllEvictionPolicy(policy);
 
+  if (base::win::GetVersion() >= base::win::VERSION_WIN8) {
+    result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_WIN32K_LOCKDOWN,

[jschuh, 2014/06/06 03:23:36]

Just remove this section. You're already setting the flag you need later on. So,
you shouldn't need to change this file at all.

[ananta, 2014/06/06 23:57:34]

Leaving this as is as this is needed for the policy stuff to work correctly.

+                             sandbox::TargetPolicy::LOCKDOWN_WIN32K,
+                             L"Lockdown_Win32K");
+    if (result != sandbox::SBOX_ALL_OK)
+      return false;
+  }
   return true;
 }
 
 bool AddPolicyForSandboxedProcess(sandbox::TargetPolicy* policy) {
   sandbox::ResultCode result;
   // Renderers need to share events with plugins.
   result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_HANDLES,
                            sandbox::TargetPolicy::HANDLES_DUP_ANY,
                            L"Event");
   if (result != sandbox::SBOX_ALL_OK)
@@ skipping 256 matching lines @@
   sandbox::MitigationFlags mitigations = sandbox::MITIGATION_HEAP_TERMINATE |
                                          sandbox::MITIGATION_BOTTOM_UP_ASLR |
                                          sandbox::MITIGATION_DEP |
                                          sandbox::MITIGATION_DEP_NO_ATL_THUNK |
                                          sandbox::MITIGATION_SEHOP;
 
  if (base::win::GetVersion() >= base::win::VERSION_WIN8 &&
      type_str == switches::kRendererProcess &&
      browser_command_line.HasSwitch(
         switches::kEnableWin32kRendererLockDown)) {
    mitigations |= sandbox::MITIGATION_WIN32K_DISABLE;

[jschuh, 2014/06/06 03:23:36]

You're already doing exactly what you need to enable this mitigation here.

[ananta, 2014/06/06 23:57:34]

Explained above. Leaving the policy stuff as is.

  }
 
   if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
     return 0;
 
   mitigations = sandbox::MITIGATION_STRICT_HANDLE_CHECKS |
                 sandbox::MITIGATION_DLL_SEARCH_ORDER;
 
   if (policy->SetDelayedProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
     return 0;
@@ skipping 117 matching lines @@
   }
 
   return false;
 }
 
 bool BrokerAddTargetPeer(HANDLE peer_process) {
   return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK;
 }
 
 }  // namespace content