Added a new process mitigation to harden process token IL policy.

sandbox/win/src/process_mitigations.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/process_mitigations.h"
 
 #include <algorithm>
 
 #include "base/win/windows_version.h"
 #include "sandbox/win/src/nt_internals.h"
+#include "sandbox/win/src/restricted_token_utils.h"
 #include "sandbox/win/src/win_utils.h"
 
 namespace {
 
 // Functions for enabling policies.
 typedef BOOL (WINAPI *SetProcessDEPPolicyFunction)(DWORD dwFlags);
 
 typedef BOOL (WINAPI *SetProcessMitigationPolicyFunction)(
     PROCESS_MITIGATION_POLICY mitigation_policy,
     PVOID buffer,
@@ skipping 31 matching lines @@
   // Set the heap to terminate on corruption
   if (version >= base::win::VERSION_VISTA &&
       (flags & MITIGATION_HEAP_TERMINATE)) {
     if (!::HeapSetInformation(NULL, HeapEnableTerminationOnCorruption,
                               NULL, 0) &&
         ERROR_ACCESS_DENIED != ::GetLastError()) {
       return false;
     }
   }
 
+  if (version >= base::win::VERSION_WIN7 &&
+      (flags & MITIGATION_HARDEN_TOKEN_IL_POLICY)) {
+      DWORD error = HardenProcessIntegrityLevelPolicy();
+      if ((error != ERROR_SUCCESS) && (error != ERROR_ACCESS_DENIED))
+        return false;
+  }
+
 #if !defined(_WIN64)  // DEP is always enabled on 64-bit.
   if (flags & MITIGATION_DEP) {
     DWORD dep_flags = PROCESS_DEP_ENABLE;
     // DEP support is quirky on XP, so don't force a failure in that case.
     const bool return_on_fail = version >= base::win::VERSION_VISTA;
 
     if (flags & MITIGATION_DEP_NO_ATL_THUNK)
       dep_flags |= PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION;
 
     SetProcessDEPPolicyFunction set_process_dep_policy =
@@ skipping 230 matching lines @@
 bool CanSetProcessMitigationsPostStartup(MitigationFlags flags) {
   // All of these mitigations can be enabled after startup.
   return !(flags & ~(MITIGATION_HEAP_TERMINATE |
                      MITIGATION_DEP |
                      MITIGATION_DEP_NO_ATL_THUNK |
                      MITIGATION_RELOCATE_IMAGE |
                      MITIGATION_RELOCATE_IMAGE_REQUIRED |
                      MITIGATION_BOTTOM_UP_ASLR |
                      MITIGATION_STRICT_HANDLE_CHECKS |
                      MITIGATION_EXTENSION_DLL_DISABLE |
-                     MITIGATION_DLL_SEARCH_ORDER));
+                     MITIGATION_DLL_SEARCH_ORDER |
+                     MITIGATION_HARDEN_TOKEN_IL_POLICY));
 }
 
 bool CanSetProcessMitigationsPreStartup(MitigationFlags flags) {
   // These mitigations cannot be enabled prior to startup.
   return !(flags & (MITIGATION_STRICT_HANDLE_CHECKS |
                     MITIGATION_DLL_SEARCH_ORDER));
 }
 
 }  // namespace sandbox