Sandbox policy and intercepts for the MITIGATION_WIN32K_DISABLE policy for renderer processes.

content/common/sandbox_win.cc

Index: content/common/sandbox_win.cc
diff --git a/content/common/sandbox_win.cc b/content/common/sandbox_win.cc
index 355305e33c2434c4b0679e92a59859701a0d9143..8eb37fccda4240c7748a8a8f20a5b0bdb42ed4ed 100644
--- a/content/common/sandbox_win.cc
+++ b/content/common/sandbox_win.cc
@@ -333,7 +333,6 @@ bool AddGenericPolicy(sandbox::TargetPolicy* policy) {
 #endif  // NDEBUG
 
   AddGenericDllEvictionPolicy(policy);
-
   return true;
 }
 
@@ -610,8 +609,13 @@ base::ProcessHandle StartSandboxedProcess(
      type_str == switches::kRendererProcess &&
      browser_command_line.HasSwitch(
         switches::kEnableWin32kRendererLockDown)) {
-   mitigations |= sandbox::MITIGATION_WIN32K_DISABLE;
- }
+    if (policy->AddRule(sandbox::TargetPolicy::SUBSYS_WIN32K_LOCKDOWN,
+                        sandbox::TargetPolicy::FAKE_USER32_GDI32_INIT,
+                        L"FakeUserGdiInit") != sandbox::SBOX_ALL_OK) {

[rvargas (doing something else), 2014/06/10 03:11:17]

Does it work passing a NULL string?

[ananta, 2014/06/10 21:48:06]

Done.

+      return 0;
+    }
+    mitigations |= sandbox::MITIGATION_WIN32K_DISABLE;
+  }
 
   if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
     return 0;