Adding method to create process using LowBox token in sandbox code.

sandbox/win/src/broker_services.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/broker_services.h"
 
 #include <AclAPI.h>
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 390 matching lines @@
 
   // Initialize the startup information from the policy.
   base::win::StartupInformation startup_info;
   base::string16 desktop = policy_base->GetAlternateDesktop();
   if (!desktop.empty()) {
     startup_info.startup_info()->lpDesktop =
         const_cast<wchar_t*>(desktop.c_str());
   }
 
   bool inherit_handles = false;
   if (base::win::GetVersion() >= base::win::VERSION_VISTA) {

[rvargas (doing something else), 2015/02/21 01:01:22]

This is preventing the use of any appcontainer related stuff before vista, but I
don't think this CL preserves that behavior (attempts to call CreateLowBox,
which will crash).

[Shrikant Kelkar, 2015/02/21 02:32:40]

removed

[rvargas (doing something else), 2015/02/24 01:01:49]

?

To rephrase, I don't think the behavior regarding OS versions is correct, but I
may be missing something.

     int attribute_count = 0;
     const AppContainerAttributes* app_container =

[rvargas (doing something else), 2015/02/21 01:01:22]

Remove this

[Shrikant Kelkar, 2015/02/21 02:32:40]

Done.

         policy_base->GetAppContainer();
     if (app_container)
       ++attribute_count;
 
     DWORD64 mitigations;
     size_t mitigations_size;
     ConvertProcessMitigationsToPolicy(policy->GetProcessMitigations(),
                                       &mitigations, &mitigations_size);
     if (mitigations)
       ++attribute_count;
 
     HANDLE stdout_handle = policy_base->GetStdoutHandle();
     HANDLE stderr_handle = policy_base->GetStderrHandle();
     HANDLE inherit_handle_list[2];
     int inherit_handle_count = 0;
     if (stdout_handle != INVALID_HANDLE_VALUE)
       inherit_handle_list[inherit_handle_count++] = stdout_handle;
     // Handles in the list must be unique.
     if (stderr_handle != stdout_handle && stderr_handle != INVALID_HANDLE_VALUE)
       inherit_handle_list[inherit_handle_count++] = stderr_handle;
     if (inherit_handle_count)
       ++attribute_count;
 
     if (!startup_info.InitializeProcThreadAttributeList(attribute_count))
       return SBOX_ERROR_PROC_THREAD_ATTRIBUTES;
 
-    if (app_container) {
-      result = app_container->ShareForStartup(&startup_info);
-      if (SBOX_ALL_OK != result)
-        return result;
-    }
-
     if (mitigations) {
       if (!startup_info.UpdateProcThreadAttribute(
                PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, &mitigations,
                mitigations_size)) {
         return SBOX_ERROR_PROC_THREAD_ATTRIBUTES;
       }
     }
 
     if (inherit_handle_count) {
       if (!startup_info.UpdateProcThreadAttribute(
@@ skipping 130 matching lines @@
     return SBOX_ERROR_UNSUPPORTED;
 
   base::string16 name = LookupAppContainer(sid);
   if (name.empty())
     return SBOX_ERROR_INVALID_APP_CONTAINER;
 
   return DeleteAppContainer(sid);
 }
 
 }  // namespace sandbox