Sandbox policy and intercepts for the MITIGATION_WIN32K_DISABLE policy for renderer processes.

sandbox/win/src/process_mitigations_win32k_policy.cc

Index: sandbox/win/src/process_mitigations_win32k_policy.cc
diff --git a/sandbox/win/src/process_mitigations_win32k_policy.cc b/sandbox/win/src/process_mitigations_win32k_policy.cc
new file mode 100644
index 0000000000000000000000000000000000000000..af18c5413c2815499f21e413403d6f9fd082daec
--- /dev/null
+++ b/sandbox/win/src/process_mitigations_win32k_policy.cc
@@ -0,0 +1,24 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "sandbox/win/src/process_mitigations_win32k_policy.h"
+
+namespace sandbox {
+
+bool ProcessMitigationsWin32KLockdownPolicy::GenerateRules(
+    const wchar_t* name,
+    TargetPolicy::Semantics semantics,
+    LowLevelPolicy* policy) {
+  PolicyRule rule(FAKE_SUCCESS);
+  if (!policy->AddRule(IPC_GDI_GDIDLLINITIALIZE_TAG, &rule))
+    return false;
+  if (!policy->AddRule(IPC_GDI_GETSTOCKOBJECT_TAG, &rule))
+    return false;
+  if (!policy->AddRule(IPC_USER_REGISTERCLASSW_TAG, &rule))
+    return false;
+  return true;
+}
+
+}  // namespace sandbox
+