Adding method to create process using LowBox token in sandbox code.

sandbox/win/src/app_container.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_WIN_SRC_APP_CONTAINER_H_
 #define SANDBOX_WIN_SRC_APP_CONTAINER_H_
 
 #include <windows.h>
 
 #include <vector>
@@ skipping 19 matching lines @@
 
   // Sets the AppContainer and capabilities to be used with the new process.
   ResultCode SetAppContainer(const base::string16& app_container_sid,
                              const std::vector<base::string16>& capabilities);
 
   // Updates the proc_thred attribute list of the provided startup_information
   // with the app container related data.
   // WARNING: startup_information just points back to our internal memory, so
   // the lifetime of this object has to be greater than the lifetime of the
   // provided startup_information.
   ResultCode ShareForStartup(

[rvargas (doing something else), 2015/02/21 01:01:22]

Looks like we can remove this code too.

[Shrikant Kelkar, 2015/02/21 02:32:40]

Done.

       base::win::StartupInformation* startup_information) const;
 
   bool HasAppContainer() const;
 
+  // Returns security capabilities structure, which is populated when you call
+  // SetAppContainer.
+  const SECURITY_CAPABILITIES& GetCapabilities() const;
+
  private:
   SECURITY_CAPABILITIES capabilities_;
   std::vector<SID_AND_ATTRIBUTES> attributes_;
 
   DISALLOW_COPY_AND_ASSIGN(AppContainerAttributes);
 };
 
 // Creates a new AppContainer on the system. |sid| is the identifier of the new
 // AppContainer, and |name| will be used as both the display name and moniker.
 // This function fails if the OS doesn't support AppContainers, or if there is
 // an AppContainer registered with the same id.
 ResultCode CreateAppContainer(const base::string16& sid,
                               const base::string16& name);
 
 // Deletes an AppContainer previously created with a successfull call to
 // CreateAppContainer.
 ResultCode DeleteAppContainer(const base::string16& sid);
 
 // Retrieves the name associated with the provided AppContainer sid. Returns an
 // empty string if the AppContainer is not registered with the system.
 base::string16 LookupAppContainer(const base::string16& sid);
 
 }  // namespace sandbox
 
 #endif  // SANDBOX_WIN_SRC_APP_CONTAINER_H_