Sandbox policy and intercepts for the MITIGATION_WIN32K_DISABLE policy for renderer processes.

sandbox/win/src/process_mitigations_win32k_policy.h

+// Copyright (c) 2014 The Chromium Authors. All rights reserved.

[jschuh, 2014/06/06 03:23:36]

Delete this file.

[ananta, 2014/06/06 23:57:35]

Thought about this some more. Not sure if adding the virtual function as we
discussed is any cleaner. Leaving this as is.
While this is some more boilerplate code, it maintains the structure of the
existing code which is already extremely complex.

+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SANDBOX_SRC_PROCESS_MITIGATIONS_WIN32K_POLICY_H__

[rvargas (doing something else), 2014/06/06 21:22:24]

only one underscore at the end.

[ananta, 2014/06/06 23:57:35]

Done.

+#define SANDBOX_SRC_PROCESS_MITIGATIONS_WIN32K_POLICY_H__
+
+#include "base/basictypes.h"
+#include "sandbox/win/src/crosscall_server.h"
+#include "sandbox/win/src/policy_low_level.h"
+#include "sandbox/win/src/sandbox_policy.h"
+
+namespace sandbox {
+
+enum EvalResult;
+
+// This class centralizes most of the knowledge related to the process
+// mitigations Win32K lockdown policy.
+class ProcessMitigationsWin32KLockdownPolicy {
+ public:
+  // Creates the required low-level policy rules to evaluate a high-level
+  // policy rule for the Win32K process mitigation policy.
+  // name is the object name, semantics is the desired semantics for the
+  // open or create and policy is the policy generator to which the rules are
+  // going to be added.
+  static bool GenerateRules(const wchar_t* name,
+                            TargetPolicy::Semantics semantics,
+                            LowLevelPolicy* policy);
+};
+
+}  // namespace sandbox
+
+#endif  // SANDBOX_SRC_PROCESS_MITIGATIONS_WIN32K_POLICY_H__
+
+