Sandbox policy and intercepts for the MITIGATION_WIN32K_DISABLE policy for renderer processes.

sandbox/win/src/process_mitigations_win32k_policy.cc

Index: sandbox/win/src/process_mitigations_win32k_policy.cc
diff --git a/sandbox/win/src/process_mitigations_win32k_policy.cc b/sandbox/win/src/process_mitigations_win32k_policy.cc
new file mode 100644
index 0000000000000000000000000000000000000000..3d793417031606e6f37bcd1046f03c21e01bb6f0
--- /dev/null
+++ b/sandbox/win/src/process_mitigations_win32k_policy.cc
@@ -0,0 +1,25 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/win/src/process_mitigations_win32k_policy.h"
+
+namespace sandbox {
+
+bool ProcessMitigationsWin32KLockdownPolicy::GenerateRules(
+  const wchar_t* name,

[rvargas (doing something else), 2014/06/10 03:11:18]

nit: indent 4 spaces

[ananta, 2014/06/10 21:48:06]

Done.

+  TargetPolicy::Semantics semantics,
+  LowLevelPolicy* policy) {
+

[rvargas (doing something else), 2014/06/10 03:11:18]

nit: remove this line

[ananta, 2014/06/10 21:48:06]

Done.

+  PolicyRule rule(FAKE_SUCCESS);
+  if (!policy->AddRule(IPC_GDI_GDIDLLINITIALIZE_TAG, &rule))
+    return false;
+  if (!policy->AddRule(IPC_GDI_GETSTOCKOBJECT_TAG, &rule))
+    return false;
+  if (!policy->AddRule(IPC_USER_REGISTERCLASSW_TAG, &rule))
+    return false;
+  return true;
+}
+
+}  // namespace sandbox
+