Adding method to create process using LowBox token in sandbox code.

base/win/object_watcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/win/object_watcher.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
+#include "base/win/windows_version.h"
 
 namespace base {
 namespace win {
 
 //-----------------------------------------------------------------------------
 
 ObjectWatcher::ObjectWatcher()
     : object_(NULL),
       wait_object_(NULL),
       origin_loop_(NULL),
       weak_factory_(this) {
 }
 
 ObjectWatcher::~ObjectWatcher() {
   StopWatching();
 }
 
 bool ObjectWatcher::StartWatching(HANDLE object, Delegate* delegate) {
   CHECK(delegate);
   if (wait_object_) {
     NOTREACHED() << "Already watching an object";
     return false;
   }
 
   // Since our job is to just notice when an object is signaled and report the
   // result back to this thread, we can just run on a Windows wait thread.
   DWORD wait_flags = WT_EXECUTEINWAITTHREAD | WT_EXECUTEONLYONCE;
 
+  if (base::win::GetVersion() > base::win::VERSION_XP) {
+    wait_flags |= WT_TRANSFER_IMPERSONATION;

[forshaw, 2015/02/20 11:38:02]

What's the reason being this change? Currently it's leaving a handle to the
original impersonation token lying around which is pretty dangerous. Also I'm
not sure it would actually work because the threadpool wouldn't be able to
reassign the impersonation token afterwards. 

If I remove the line I can't see any obvious problem occurring.

[Shrikant Kelkar, 2015/02/21 02:32:40]

Removed.. During initial checks, I think chrome_elf or someone similar threw
error here because I thought that time it ended up using process impersonation
token and after this flag error went away, but will remove it if it is not
causing issues and if one of our dlls fail here will fix that instead.

+  }
+
   // DoneWaiting can be synchronously called from RegisterWaitForSingleObject,
   // so set up all state now.
   callback_ = base::Bind(&ObjectWatcher::Signal, weak_factory_.GetWeakPtr(),
                          delegate);
   object_ = object;
   origin_loop_ = MessageLoop::current();
 
   if (!RegisterWaitForSingleObject(&wait_object_, object, DoneWaiting,
                                    this, INFINITE, wait_flags)) {
     DPLOG(FATAL) << "RegisterWaitForSingleObject failed";
@@ skipping 55 matching lines @@
 }
 
 void ObjectWatcher::WillDestroyCurrentMessageLoop() {
   // Need to shutdown the watch so that we don't try to access the MessageLoop
   // after this point.
   StopWatching();
 }
 
 }  // namespace win
 }  // namespace base