Sandbox policy and intercepts for the MITIGATION_WIN32K_DISABLE policy for renderer processes.

content/common/sandbox_win.cc

Index: content/common/sandbox_win.cc
diff --git a/content/common/sandbox_win.cc b/content/common/sandbox_win.cc
index 355305e33c2434c4b0679e92a59859701a0d9143..7e4caf9dde9fe883e8dc40da84bdc88fdaefd0be 100644
--- a/content/common/sandbox_win.cc
+++ b/content/common/sandbox_win.cc
@@ -334,6 +334,13 @@ bool AddGenericPolicy(sandbox::TargetPolicy* policy) {
 
   AddGenericDllEvictionPolicy(policy);
 
+  if (base::win::GetVersion() >= base::win::VERSION_WIN8) {
+    result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_WIN32K_LOCKDOWN,

[jschuh, 2014/06/06 03:23:36]

Just remove this section. You're already setting the flag you need later on. So,
you shouldn't need to change this file at all.

[ananta, 2014/06/06 23:57:34]

Leaving this as is as this is needed for the policy stuff to work correctly.

+                             sandbox::TargetPolicy::LOCKDOWN_WIN32K,
+                             L"Lockdown_Win32K");
+    if (result != sandbox::SBOX_ALL_OK)
+      return false;
+  }
   return true;
 }