Added a new process mitigation to harden process token IL policy.

sandbox/win/src/restricted_token_utils.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_SRC_RESTRICTED_TOKEN_UTILS_H__
 #define SANDBOX_SRC_RESTRICTED_TOKEN_UTILS_H__
 
 #include <accctrl.h>
 #include <windows.h>
 
@@ skipping 64 matching lines @@
 
 // Returns the integrity level SDDL string associated with a given
 // IntegrityLevel value.
 const wchar_t* GetIntegrityLevelString(IntegrityLevel integrity_level);
 
 // Sets the integrity level on the current process on Vista. It returns without
 // failing on XP. If the integrity level that you specify is greater than the
 // current integrity level, the function will fail.
 DWORD SetProcessIntegrityLevel(IntegrityLevel integrity_level);
 
+// Hardens the integrity level policy on a token. This is only valid on Win 7
+// and above. Specifically it sets the policy to block read and execute so
+// that a lower privileged process cannot open the token for impersonate or
+// duplicate permissions. This should limit potential security holes.
+DWORD HardenTokenIntegrityLevelPolicy(HANDLE token);
+
+// Hardens the integrity level policy on the current process. This is only
+// valid on Win 7 and above. Specifically it sets the policy to block read
+// and execute so that a lower privileged process cannot open the token for
+// impersonate or duplicate permissions. This should limit potential security
+// holes.
+DWORD HardenProcessIntegrityLevelPolicy();
+
 }  // namespace sandbox
 
 #endif  // SANDBOX_SRC_RESTRICTED_TOKEN_UTILS_H__