Adding method to create process using LowBox token in sandbox code.

sandbox/win/src/app_container_test.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <windows.h>
 
 #define _ATL_NO_EXCEPTIONS
 #include <atlbase.h>
 #include <atlsecurity.h>
 
@@ skipping 50 matching lines @@
     event.Close();
 
   LocalFree(local_sid);
   return event.IsValid() ? event.Take() : NULL;
 }
 
 }  // namespace
 
 namespace sandbox {
 
-TEST(AppContainerTest, AllowOpenEvent) {
+TEST(AppContainerTest, DenyOpenEvent) {
   if (base::win::OSInfo::GetInstance()->version() < base::win::VERSION_WIN8)
     return;
 
   TestRunner runner(JOB_UNPROTECTED, USER_UNPROTECTED, USER_UNPROTECTED);
 
   const wchar_t capability[] = L"S-1-15-3-12345678-87654321";
   base::win::ScopedHandle handle(CreateTaggedEvent(L"test", capability));
   ASSERT_TRUE(handle.IsValid());
 
   EXPECT_EQ(SBOX_ALL_OK,
             runner.broker()->InstallAppContainer(kAppContainerSid,
                                                  kAppContainerName));
-  EXPECT_EQ(SBOX_ALL_OK, runner.GetPolicy()->SetCapability(capability));
   EXPECT_EQ(SBOX_ALL_OK, runner.GetPolicy()->SetAppContainer(kAppContainerSid));
 
-  EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"Event_Open f test"));
+  EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"Event_Open f test"));
 
   runner.SetTestState(BEFORE_REVERT);
-  EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"Event_Open f test"));
+  EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"Event_Open f test"));
   EXPECT_EQ(SBOX_ALL_OK,
             runner.broker()->UninstallAppContainer(kAppContainerSid));
 }
 
-TEST(AppContainerTest, DenyOpenEvent) {
+TEST(AppContainerTest, DenyOpenEventEvenWithCapability) {
   if (base::win::OSInfo::GetInstance()->version() < base::win::VERSION_WIN8)
     return;
 
   TestRunner runner(JOB_UNPROTECTED, USER_UNPROTECTED, USER_UNPROTECTED);
 
   const wchar_t capability[] = L"S-1-15-3-12345678-87654321";
   base::win::ScopedHandle handle(CreateTaggedEvent(L"test", capability));
   ASSERT_TRUE(handle.IsValid());
 
   EXPECT_EQ(SBOX_ALL_OK,
             runner.broker()->InstallAppContainer(kAppContainerSid,
                                                  kAppContainerName));
+  EXPECT_EQ(SBOX_ALL_OK, runner.GetPolicy()->SetCapability(capability));

[rvargas (doing something else), 2015/02/27 20:16:34]

... And tests that deal with LowBox don't require InstallAppContainer or
SetCapability... just SetLowBox

   EXPECT_EQ(SBOX_ALL_OK, runner.GetPolicy()->SetAppContainer(kAppContainerSid));
 
   EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"Event_Open f test"));
 
   runner.SetTestState(BEFORE_REVERT);
   EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"Event_Open f test"));
   EXPECT_EQ(SBOX_ALL_OK,
             runner.broker()->UninstallAppContainer(kAppContainerSid));
 }
 
 TEST(AppContainerTest, NoImpersonation) {
   if (base::win::OSInfo::GetInstance()->version() < base::win::VERSION_WIN8)
     return;
 
   TestRunner runner(JOB_UNPROTECTED, USER_LIMITED, USER_LIMITED);
   EXPECT_EQ(SBOX_ALL_OK, runner.GetPolicy()->SetAppContainer(kAppContainerSid));
 }
 
 TEST(AppContainerTest, WantsImpersonation) {
   if (base::win::OSInfo::GetInstance()->version() < base::win::VERSION_WIN8)
     return;
 
   TestRunner runner(JOB_UNPROTECTED, USER_UNPROTECTED, USER_NON_ADMIN);
-  EXPECT_EQ(SBOX_ERROR_CANNOT_INIT_APPCONTAINER,
+  EXPECT_EQ(SBOX_ALL_OK,
             runner.GetPolicy()->SetAppContainer(kAppContainerSid));
 }
 
 TEST(AppContainerTest, RequiresImpersonation) {
   if (base::win::OSInfo::GetInstance()->version() < base::win::VERSION_WIN8)
     return;
 
   TestRunner runner(JOB_UNPROTECTED, USER_RESTRICTED, USER_RESTRICTED);
-  EXPECT_EQ(SBOX_ERROR_CANNOT_INIT_APPCONTAINER,
+  EXPECT_EQ(SBOX_ALL_OK,
             runner.GetPolicy()->SetAppContainer(kAppContainerSid));
 }
 
 }  // namespace sandbox