Adding method to create process using LowBox token in sandbox code.

sandbox/win/src/app_container.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/app_container.h"
 
 #include <Sddl.h>
 #include <vector>
 
 #include "base/logging.h"
@@ skipping 56 matching lines @@
     attributes_.push_back(sid_and_attributes);
   }
 
   if (capabilities.size()) {
     capabilities_.CapabilityCount = static_cast<DWORD>(capabilities.size());
     capabilities_.Capabilities = &attributes_[0];
   }
   return SBOX_ALL_OK;
 }
 
-ResultCode AppContainerAttributes::ShareForStartup(
-      base::win::StartupInformation* startup_information) const {
-  // The only thing we support so far is an AppContainer.
-  if (!capabilities_.AppContainerSid)
-    return SBOX_ERROR_INVALID_APP_CONTAINER;
-
-  if (!startup_information->UpdateProcThreadAttribute(
-           PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES,
-           const_cast<SECURITY_CAPABILITIES*>(&capabilities_),
-           sizeof(capabilities_)))  {
-    DPLOG(ERROR) << "Failed UpdateProcThreadAttribute";
-    return SBOX_ERROR_CANNOT_INIT_APPCONTAINER;
-  }
-  return SBOX_ALL_OK;
-}
-
 bool AppContainerAttributes::HasAppContainer() const {
   return (capabilities_.AppContainerSid != NULL);
 }
 
+const SECURITY_CAPABILITIES& AppContainerAttributes::GetCapabilities() const {
+  return capabilities_;
+}
+
 ResultCode CreateAppContainer(const base::string16& sid,
                               const base::string16& name) {
   PSID local_sid;
   if (!ConvertStringSidToSid(sid.c_str(), &local_sid))
     return SBOX_ERROR_INVALID_APP_CONTAINER;
 
   typedef HRESULT (WINAPI* AppContainerRegisterSidPtr)(PSID sid,
                                                        LPCWSTR moniker,
                                                        LPCWSTR display_name);
   static AppContainerRegisterSidPtr AppContainerRegisterSid = NULL;
@@ skipping 67 matching lines @@
   if (FAILED(rv))
     return base::string16();
 
   base::string16 name(buffer);
   if (!AppContainerFreeMemory(buffer))
     NOTREACHED();
   return name;
 }
 
 }  // namespace sandbox