Sandbox policy and intercepts for the MITIGATION_WIN32K_DISABLE policy for renderer processes.

sandbox/win/src/process_mitigations_win32k_policy.h

Index: sandbox/win/src/process_mitigations_win32k_policy.h
diff --git a/sandbox/win/src/process_mitigations_win32k_policy.h b/sandbox/win/src/process_mitigations_win32k_policy.h
new file mode 100644
index 0000000000000000000000000000000000000000..8e6e6fa11756c7c9df13bd2571dcdb3d1e087871
--- /dev/null
+++ b/sandbox/win/src/process_mitigations_win32k_policy.h
@@ -0,0 +1,36 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SANDBOX_SRC_PROCESS_MITIGATIONS_WIN32K_POLICY_H_
+#define SANDBOX_SRC_PROCESS_MITIGATIONS_WIN32K_POLICY_H_
+
+#include "base/basictypes.h"
+#include "sandbox/win/src/crosscall_server.h"
+#include "sandbox/win/src/policy_low_level.h"
+#include "sandbox/win/src/sandbox_policy.h"
+#include "sandbox/win/src/security_level.h"

[rvargas (doing something else), 2014/06/10 03:11:18]

It doesn't look like this is needed by this header.

[ananta, 2014/06/10 21:48:06]

Done.

+
+namespace sandbox {
+
+enum EvalResult;
+
+// This class centralizes most of the knowledge related to the process
+// mitigations Win32K lockdown policy.
+class ProcessMitigationsWin32KLockdownPolicy {
+ public:
+  // Creates the required low-level policy rules to evaluate a high-level
+  // policy rule for the Win32K process mitigation policy.
+  // name is the object name, semantics is the desired semantics for the
+  // open or create and policy is the policy generator to which the rules are
+  // going to be added.
+  static bool GenerateRules(const wchar_t* name,
+                            TargetPolicy::Semantics semantics,
+                            LowLevelPolicy* policy);
+};
+
+}  // namespace sandbox
+
+#endif  // SANDBOX_SRC_PROCESS_MITIGATIONS_WIN32K_POLICY_H_
+
+