Sandbox policy and intercepts for the MITIGATION_WIN32K_DISABLE policy for renderer processes.

sandbox/win/src/process_mitigations_win32k_dispatcher.cc

Index: sandbox/win/src/process_mitigations_win32k_dispatcher.cc
diff --git a/sandbox/win/src/process_mitigations_win32k_dispatcher.cc b/sandbox/win/src/process_mitigations_win32k_dispatcher.cc
new file mode 100644
index 0000000000000000000000000000000000000000..951e37765d99bbe0291874115128a1251032b7c9
--- /dev/null
+++ b/sandbox/win/src/process_mitigations_win32k_dispatcher.cc
@@ -0,0 +1,57 @@
+// Copyright (c) 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/win/src/process_mitigations_win32k_dispatcher.h"
+#include "sandbox/win/src/interception.h"
+#include "sandbox/win/src/interceptors.h"
+#include "sandbox/win/src/ipc_tags.h"
+#include "sandbox/win/src/process_mitigations_win32k_interception.h"
+
+namespace sandbox {
+
+ProcessMitigationsWin32KDispatcher::ProcessMitigationsWin32KDispatcher(
+    PolicyBase* policy_base)
+    : policy_base_(policy_base) {
+}
+
+bool ProcessMitigationsWin32KDispatcher::SetupService(
+    InterceptionManager* manager, int service) {
+  if (!(policy_base_->GetProcessMitigations() &
+        sandbox::MITIGATION_WIN32K_DISABLE)) {
+    return true;

[rvargas (doing something else), 2014/06/06 21:22:24]

Shouldn't this be false?

[ananta, 2014/06/06 23:57:35]

No. If we return false the PolicyBase::SetupAllInterceptions function aborts and
causes the policies to not be applied fully
causing the process launch to fail.

[rvargas (doing something else), 2014/06/09 20:05:57]

But that's what we want, no? If by the time this policy is being applied
MITIGATION_WIN32K_DISABLE is not set, it means that there is a bug in the
policies so we want that failure to be as visible as possible.

+  }
+
+  switch (service) {
+    case IPC_GDI_GDIDLLINITIALIZE_TAG: {
+      if (!INTERCEPT_EAT(manager, L"gdi32.dll", GdiDllInitialize,
+                         GDIINITIALIZE_ID, 12)) {
+        return false;
+      }
+      return true;
+    }
+
+    case IPC_GDI_GETSTOCKOBJECT_TAG: {
+      if (!INTERCEPT_EAT(manager, L"gdi32.dll", GetStockObject,
+                         GETSTOCKOBJECT_ID, 8)) {
+        return false;
+      }
+      return true;
+    }
+
+    case IPC_USER_REGISTERCLASSW_TAG: {
+      if (!INTERCEPT_EAT(manager, L"user32.dll", RegisterClassW,
+                         REGISTERCLASSW_ID, 8)) {
+        return false;
+      }
+      return true;
+    }
+
+    default:
+      break;
+  }
+  return false;
+}
+
+}  // namespace sandbox
+