Adding method to create process using LowBox token in sandbox code.

content/common/sandbox_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_win.h"
 
 #include <string>
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
@@ skipping 515 matching lines @@
 
 // TODO(jschuh): Need get these restrictions applied to NaCl and Pepper.
 // Just have to figure out what needs to be warmed up first.
 void AddBaseHandleClosePolicy(sandbox::TargetPolicy* policy) {
   // TODO(cpu): Add back the BaseNamedObjects policy.
   base::string16 object_path = PrependWindowsSessionPath(
       L"\\BaseNamedObjects\\windows_shell_global_counters");
   policy->AddKernelObjectToClose(L"Section", object_path.data());
 }
 
+void AddAppContainerPolicy(sandbox::TargetPolicy* policy) {
+  if (base::win::GetVersion() < base::win::VERSION_WIN8)
+    return;
+  DCHECK(g_broker_services);
+  // Reviewers: This doesn't seem to be right place for installing

[forshaw, 2015/02/20 11:38:02]

Based on my original testing I don't believe you need to install the
appcontainer sid on the system for it to work (at least when using
NtCreateLowBoxToken). We should be able to generate a per-process appcontainer
SID using a simple incrementing counter. For example something like this seems
to work:

static unsigned int per_process_rid = 0;
  
std::wstring app_container_sid = base::StringPrintf(
	L"S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-"
	L"924012148-%u", per_process_rid++);
  
policy->SetAppContainer(app_container_sid.c_str());

Also how was the original appcontainer sid generated? We want to ensure it isn't
likely to conflict with anything in use.

[Shrikant Kelkar, 2015/02/21 02:32:40]

Appended GUID, ptal.

+  // an appcontainer please suggest one. Ideally we may want to create
+  // appcontainer per site
+  const wchar_t kAppContainerName[] = L"sbox_chromium";
+  const wchar_t kAppContainerSid[] =
+  L"S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-"
+  L"924012148-2839372144";
+  // Install will only register if appcontainer is not already there.
+  g_broker_services->InstallAppContainer(kAppContainerSid, kAppContainerName);
+
+  policy->SetAppContainer(kAppContainerSid);
+}
+
 bool InitBrokerServices(sandbox::BrokerServices* broker_services) {
   // TODO(abarth): DCHECK(CalledOnValidThread());
   //               See <http://b/1287166>.
   DCHECK(broker_services);
   DCHECK(!g_broker_services);
   sandbox::ResultCode result = broker_services->Init();
   g_broker_services = broker_services;
 
   // In non-official builds warn about dangerous uses of DuplicateHandle.
 #ifndef OFFICIAL_BUILD
@@ skipping 216 matching lines @@
   }
 
   return false;
 }
 
 bool BrokerAddTargetPeer(HANDLE peer_process) {
   return g_broker_services->AddTargetPeer(peer_process) == sandbox::SBOX_ALL_OK;
 }
 
 }  // namespace content