Sandbox policy and intercepts for the MITIGATION_WIN32K_DISABLE policy for renderer processes.

sandbox/win/src/sandbox_policy.h

Index: sandbox/win/src/sandbox_policy.h
diff --git a/sandbox/win/src/sandbox_policy.h b/sandbox/win/src/sandbox_policy.h
index a9f124516218ae00cebb1f42cf58bd7250798234..f67f26514bf847133b871d8eeb10e3786168ea0c 100644
--- a/sandbox/win/src/sandbox_policy.h
+++ b/sandbox/win/src/sandbox_policy.h
@@ -26,7 +26,8 @@ class TargetPolicy {
     SUBSYS_PROCESS,           // Creation of child processes.
     SUBSYS_REGISTRY,          // Creation and opening of registry keys.
     SUBSYS_SYNC,              // Creation of named sync objects.
-    SUBSYS_HANDLES            // Duplication of handles to other processes.
+    SUBSYS_HANDLES,           // Duplication of handles to other processes.
+    SUBSYS_WIN32K_LOCKDOWN    // Win32K Lockdown related policy.
   };
 
   // Allowable semantics when a rule is matched.
@@ -52,7 +53,8 @@ class TargetPolicy {
     EVENTS_ALLOW_ANY,      // Allows the creation of an event with full access.
     EVENTS_ALLOW_READONLY, // Allows opening an even with synchronize access.
     REG_ALLOW_READONLY,    // Allows readonly access to a registry key.
-    REG_ALLOW_ANY          // Allows read and write access to a registry key.
+    REG_ALLOW_ANY,         // Allows read and write access to a registry key.
+    LOCKDOWN_WIN32K         // Locks down the Win32K subsystem for the process.     

[rvargas (doing something else), 2014/06/09 20:05:57]

nit: This seems a little weird. The subsystem is SUBSYS_WIN32K_LOCKDOWN because
it relates to things we may have to do when locking down win32k. But this
section is about what a rule would do when enabled: like allow read only access
to a file.

If what the rule does is "lockdown_win32k" then this is 100% redundant with the
mitigation flag.

So I think that we either have a name that reflects that we are enabling random
interception based helpers (and leave what to intercept and what to do for each
interception as implementation-defined), or use more than one "semantic" for
specific stuff that a consumer may decide to do. Note that all values here are
enablers of something that is disabled by some other mean. So in a sense, the
mitigation flag is the one that "locks down" stuff, and what we need here is
something that allow user32 to be loaded (for example).

[ananta, 2014/06/10 00:32:10]

Renamed this to FAKE_USER32_GDI32_INIT

   };
 
   // Increments the reference count of this object. The reference count must