Adding method to create process using LowBox token in sandbox code.

sandbox/win/src/app_container_test.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <windows.h>
 
 #define _ATL_NO_EXCEPTIONS
 #include <atlbase.h>
 #include <atlsecurity.h>
 
@@ skipping 123 matching lines @@
 
 TEST(AppContainerTest, RequiresImpersonation) {
   if (base::win::OSInfo::GetInstance()->version() < base::win::VERSION_WIN8)
     return;
 
   TestRunner runner(JOB_UNPROTECTED, USER_RESTRICTED, USER_RESTRICTED);
   EXPECT_EQ(SBOX_ERROR_CANNOT_INIT_APPCONTAINER,
             runner.GetPolicy()->SetAppContainer(kAppContainerSid));
 }
 
+// We are treating LowBox as another approach for launching appcontainer.
+// For convenience including LowBox tests inside this file.

[rvargas (doing something else), 2015/02/28 01:10:06]

nit: remove lines 144-45

[Shrikant Kelkar, 2015/02/28 01:55:41]

Done.

+// We expect TEST_DENIED because when we setup appcontainer through lowbox way

[rvargas (doing something else), 2015/02/28 01:10:06]

nit: Actually, I think we can remove the whole comment.

[Shrikant Kelkar, 2015/02/28 01:55:41]

Done.

+// we are missing out on some initial setup of BNO and things like that, which
+// seem to force NtOpenEvent to look for the object only inside
+// AppContainerBasedNameObject namespace, where it doesn't find the required
+// object.
+TEST(AppContainerTest, DenyOpenEventForLowBox) {
+  if (base::win::OSInfo::GetInstance()->version() < base::win::VERSION_WIN8)
+    return;
+
+  TestRunner runner(JOB_UNPROTECTED, USER_UNPROTECTED, USER_UNPROTECTED);
+
+  base::win::ScopedHandle event(CreateEvent(NULL, FALSE, FALSE, L"test"));
+  ASSERT_TRUE(event.IsValid());
+
+  EXPECT_EQ(SBOX_ALL_OK, runner.GetPolicy()->SetLowBox(kAppContainerSid));
+
+  EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"Event_Open f test"));
+}

[rvargas (doing something else), 2015/02/28 01:10:06]

caveat: missing more tests for a future CL (as in, a test with USER_LOCKDOWN
which is what this CL promises to provide). Maybe a TODO is in order :)

[Shrikant Kelkar, 2015/02/28 01:55:41]

Done.

+
 }  // namespace sandbox