Only close \Device\DeviceApi for renderer processes.

content/common/sandbox_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_win.h"
 
 #include <string>
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
@@ skipping 325 matching lines @@
                            sandbox::TargetPolicy::PROCESS_MIN_EXEC,
                            debug_message.value().c_str());
   if (result != sandbox::SBOX_ALL_OK)
     return false;
 #endif  // NDEBUG
 
   AddGenericDllEvictionPolicy(policy);
   return true;
 }
 
-bool AddPolicyForSandboxedProcess(sandbox::TargetPolicy* policy) {
+bool AddPolicyForSandboxedProcess(sandbox::TargetPolicy* policy,
+                                  std::string& type_str) {
   sandbox::ResultCode result;
   // Renderers need to share events with plugins.
   result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_HANDLES,
                            sandbox::TargetPolicy::HANDLES_DUP_ANY,
                            L"Event");
   if (result != sandbox::SBOX_ALL_OK)
     return false;
 
   // Win8+ adds a device DeviceApi that we don't need.
-  if (base::win::GetVersion() > base::win::VERSION_WIN7)
+  // Only close this handle on renderer processes.  See crbug.com/452613.
+  if (base::win::GetVersion() > base::win::VERSION_WIN7 &&
+      type_str == switches::kRendererProcess) {
     result = policy->AddKernelObjectToClose(L"File", L"\\Device\\DeviceApi");
+  }
   if (result != sandbox::SBOX_ALL_OK)
     return false;
 
   // Close the proxy settings on XP.
   if (base::win::GetVersion() <= base::win::VERSION_SERVER_2003)
     result = policy->AddKernelObjectToClose(L"Key",
                  L"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\" \
                      L"CurrentVersion\\Internet Settings");
   if (result != sandbox::SBOX_ALL_OK)
     return false;
@@ skipping 274 matching lines @@
   if (policy->SetDelayedProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
     return base::Process();
 
   SetJobLevel(*cmd_line, sandbox::JOB_LOCKDOWN, 0, policy);
 
   bool disable_default_policy = false;
   base::FilePath exposed_dir;
   if (delegate)
     delegate->PreSandbox(&disable_default_policy, &exposed_dir);
 
-  if (!disable_default_policy && !AddPolicyForSandboxedProcess(policy))
+  if (!disable_default_policy &&
+      !AddPolicyForSandboxedProcess(policy, type_str))
     return base::Process();
 
   if (type_str == switches::kRendererProcess) {
 #if !defined(NACL_WIN64)
     if (gfx::win::ShouldUseDirectWrite()) {
       AddDirectory(base::DIR_WINDOWS_FONTS,
                   NULL,
                   true,
                   sandbox::TargetPolicy::FILES_ALLOW_READONLY,
                   policy);
@@ skipping 101 matching lines @@
   }
 
   return false;
 }
 
 bool BrokerAddTargetPeer(HANDLE peer_process) {
   return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK;
 }
 
 }  // namespace content