Adding method to create process using LowBox token in sandbox code.

sandbox/win/src/policy_broker.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <map>
 
 #include "sandbox/win/src/policy_broker.h"
 
 #include "base/logging.h"
 #include "base/win/pe_image.h"
@@ skipping 69 matching lines @@
   for (size_t i = 0; i < sizeof(g_nt)/sizeof(void*); i++)
     DCHECK(reinterpret_cast<char**>(&g_nt)[i]);
 #endif
   return (SBOX_ALL_OK == child->TransferVariable("g_nt", &g_nt, sizeof(g_nt)));
 }
 
 #undef INIT_GLOBAL_NT
 #undef INIT_GLOBAL_RTL
 
 bool SetupBasicInterceptions(InterceptionManager* manager) {
   // Interceptions provided by process_thread_policy, without actual policy.

[rvargas (doing something else), 2015/02/27 20:16:34]

What's the change here? The first three interceptions are still handled by
process_thread_policy, but not the others...

[rvargas (doing something else), 2015/02/28 01:10:05]

Looks like you missed these comments.

[Shrikant Kelkar, 2015/02/28 01:55:41]

Done.

   if (!INTERCEPT_NT(manager, NtOpenThread, OPEN_TREAD_ID, 20) ||
-      !INTERCEPT_NT(manager, NtOpenProcess, OPEN_PROCESS_ID, 20) ||
-      !INTERCEPT_NT(manager, NtOpenProcessToken, OPEN_PROCESS_TOKEN_ID, 16))
+      !INTERCEPT_NT(manager, NtOpenProcess, OPEN_PROCESS_ID, 20))

[rvargas (doing something else), 2015/02/27 20:16:34]

Nit: this requires {} (and below)

     return false;
 
-  // Interceptions with neither policy nor IPC.
+  if(!INTERCEPT_NT(manager, NtOpenProcessToken, OPEN_PROCESS_TOKEN_ID, 16) ||
+     !INTERCEPT_NT(manager, NtOpenThreadToken, OPEN_THREAD_TOKEN_ID, 20))
+    return false;
+
   if (!INTERCEPT_NT(manager, NtSetInformationThread, SET_INFORMATION_THREAD_ID,
-                    20) ||
-      !INTERCEPT_NT(manager, NtOpenThreadToken, OPEN_THREAD_TOKEN_ID, 20))
+                    20))
     return false;
 
   if (base::win::GetVersion() >= base::win::VERSION_XP) {
     // Bug 27218: We don't have dispatch for some x64 syscalls.
     // This one is also provided by process_thread_policy.
     if (!INTERCEPT_NT(manager, NtOpenProcessTokenEx, OPEN_PROCESS_TOKEN_EX_ID,
                       20))
       return false;
 
     return INTERCEPT_NT(manager, NtOpenThreadTokenEx, OPEN_THREAD_TOKEN_EX_ID,
                         24);
   }
 
   return true;
 }
 
 }  // namespace sandbox