Adding method to create process using LowBox token in sandbox code.

sandbox/win/src/sandbox_policy_base.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/sandbox_policy_base.h"
 
 #include <sddl.h>
 
 #include "base/basictypes.h"
 #include "base/callback.h"
@@ skipping 292 matching lines @@
 ResultCode PolicyBase::SetDelayedIntegrityLevel(
     IntegrityLevel integrity_level) {
   delayed_integrity_level_ = integrity_level;
   return SBOX_ALL_OK;
 }
 
 ResultCode PolicyBase::SetAppContainer(const wchar_t* sid) {
   if (base::win::OSInfo::GetInstance()->version() < base::win::VERSION_WIN8)
     return SBOX_ALL_OK;
 
-  // Windows refuses to work with an impersonation token for a process inside
-  // an AppContainer. If the caller wants to use a more privileged initial
-  // token, or if the lockdown level will prevent the process from starting,
-  // we have to fail the operation.
-  if (lockdown_level_ < USER_LIMITED || lockdown_level_ != initial_level_)
-    return SBOX_ERROR_CANNOT_INIT_APPCONTAINER;
-
   DCHECK(!appcontainer_list_.get());
   appcontainer_list_.reset(new AppContainerAttributes);
   ResultCode rv = appcontainer_list_->SetAppContainer(sid, capabilities_);
   if (rv != SBOX_ALL_OK)
     return rv;
 
   return SBOX_ALL_OK;
 }
 
 ResultCode PolicyBase::SetCapability(const wchar_t* sid) {
@@ skipping 140 matching lines @@
                                      SE_WINDOW_OBJECT,
                                      L"",
                                      GetIntegrityLevelString(integrity_level_));
     if (ERROR_SUCCESS != result)
       return SBOX_ERROR_GENERIC;
 
     alternate_desktop_integrity_level_label_ = integrity_level_;
   }
 
   if (appcontainer_list_.get() && appcontainer_list_->HasAppContainer()) {
-    // Windows refuses to work with an impersonation token. See SetAppContainer
-    // implementation for more details.
-    if (lockdown_level_ < USER_LIMITED || lockdown_level_ != initial_level_)
-      return SBOX_ERROR_CANNOT_INIT_APPCONTAINER;
+    NtCreateLowBoxToken CreateLowBox = NULL;
+    ResolveNTFunctionPtr("NtCreateLowBoxToken", &CreateLowBox);
 
-    *initial = INVALID_HANDLE_VALUE;
-    return SBOX_ALL_OK;
+    HANDLE token_lowbox = NULL;
+    const SECURITY_CAPABILITIES& capabilities =
+        appcontainer_list_->GetCapabilities();
+
+    OBJECT_ATTRIBUTES obj_attr;
+    InitializeObjectAttributes(&obj_attr, NULL, 0, NULL, NULL);
+
+    NTSTATUS status = CreateLowBox(&token_lowbox,
+                                   *lockdown,
+                                   TOKEN_ALL_ACCESS,

[rvargas (doing something else), 2015/02/21 01:01:22]

Just curious, any idea what this does?

[Shrikant Kelkar, 2015/02/21 02:32:41]

Not sure, but guess is that it will open and return new lowbox token with that
access.

[rvargas (doing something else), 2015/02/24 01:01:49]

Do we need ALL_ACCESS?

+                                   &obj_attr,
+                                   capabilities.AppContainerSid,
+                                   capabilities.CapabilityCount,
+                                   capabilities.Capabilities,
+                                   0,
+                                   NULL);
+    if (!NT_SUCCESS(status) && token_lowbox == NULL) {

[rvargas (doing something else), 2015/02/21 01:01:22]

|| !token_lowbox?. An && implies that if the function fails the contract is that
there is no garbage in an out argument (which may be true, but is not the nt
contract).

In fact, I'd remove token_lowbox from the if, and DCHECK that is not null (if
anything) on success.

[Shrikant Kelkar, 2015/02/21 02:32:41]

Done.

+      return SBOX_ERROR_GENERIC;
+    }
+    ::CloseHandle(*lockdown);
+    *lockdown = token_lowbox;
   }
 
   // Create the 'better' token. We use this token as the one that the main
   // thread uses when booting up the process. It should contain most of
   // what we need (before reaching main( ))
   result = CreateRestrictedToken(initial, initial_level_,
                                  integrity_level_, IMPERSONATION);
   if (ERROR_SUCCESS != result) {
     ::CloseHandle(*lockdown);
     return SBOX_ERROR_GENERIC;
@@ skipping 243 matching lines @@
       break;
     }
 
     default: { return SBOX_ERROR_UNSUPPORTED; }
   }
 
   return SBOX_ALL_OK;
 }
 
 }  // namespace sandbox