Add UIPI support for sandbox alternate desktop

sandbox/win/src/sandbox_policy_base.cc

Index: sandbox/win/src/sandbox_policy_base.cc
diff --git a/sandbox/win/src/sandbox_policy_base.cc b/sandbox/win/src/sandbox_policy_base.cc
index 711fafc006acd0c2462b05b65e215983aa40556b..9655ea111c65022e78394405890e2dd356a3378c 100644
--- a/sandbox/win/src/sandbox_policy_base.cc
+++ b/sandbox/win/src/sandbox_policy_base.cc
@@ -4,6 +4,8 @@
 
 #include "sandbox/win/src/sandbox_policy_base.h"
 
+#include <sddl.h>
+
 #include "base/basictypes.h"
 #include "base/callback.h"
 #include "base/logging.h"
@@ -75,6 +77,8 @@ SANDBOX_INTERCEPT MitigationFlags g_shared_delayed_mitigations;
 // Initializes static members.
 HWINSTA PolicyBase::alternate_winstation_handle_ = NULL;
 HDESK PolicyBase::alternate_desktop_handle_ = NULL;
+IntegrityLevel PolicyBase::alternate_desktop_integrity_level_ =
+    INTEGRITY_LEVEL_LAST;
 
 PolicyBase::PolicyBase()
     : ref_count(1),
@@ -521,6 +525,26 @@ ResultCode PolicyBase::MakeTokens(HANDLE* initial, HANDLE* lockdown) {
     return SBOX_ERROR_GENERIC;
   }
 
+  // If we're launching on the alternate desktop we need to make sure our
+  // process has an integrity label that can access it. So, we lower the label
+  // on the desktop if needed.
+  if (alternate_desktop_handle_ &&
+      integrity_level_ < INTEGRITY_LEVEL_LAST &&
+      (alternate_desktop_integrity_level_ == INTEGRITY_LEVEL_LAST ||
+       alternate_desktop_integrity_level_ < integrity_level_) &&
+      base::win::OSInfo::GetInstance()->version() >= base::win::VERSION_VISTA) {
+    static_assert(INTEGRITY_LEVEL_SYSTEM < INTEGRITY_LEVEL_UNTRUSTED,
+                  "Integrity level ordering reversed.");
+    result = SetObjectIntegrityLabel(alternate_desktop_handle_,
+                                     SE_WINDOW_OBJECT,
+                                     L"",
+                                     GetIntegrityLevelString(integrity_level_));
+    if (ERROR_SUCCESS != result) {
+      return SBOX_ERROR_GENERIC;
+    }

[rvargas (doing something else), 2014/06/13 23:18:47]

tiny nit: this should not have {} but I see them also at line 525 :(

+    alternate_desktop_integrity_level_ = integrity_level_;
+  }
+
   if (appcontainer_list_.get() && appcontainer_list_->HasAppContainer()) {
     // Windows refuses to work with an impersonation token. See SetAppContainer
     // implementation for more details.