Adding method to create process using LowBox token in sandbox code.

sandbox/win/src/sandbox_policy_base.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_WIN_SRC_SANDBOX_POLICY_BASE_H_
 #define SANDBOX_WIN_SRC_SANDBOX_POLICY_BASE_H_
 
 #include <windows.h>
 
 #include <list>
@@ skipping 38 matching lines @@
   virtual ResultCode SetAlternateDesktop(bool alternate_winstation) override;
   virtual base::string16 GetAlternateDesktop() const override;
   virtual ResultCode CreateAlternateDesktop(bool alternate_winstation) override;
   virtual void DestroyAlternateDesktop() override;
   virtual ResultCode SetIntegrityLevel(IntegrityLevel integrity_level) override;
   virtual IntegrityLevel GetIntegrityLevel() const override;
   virtual ResultCode SetDelayedIntegrityLevel(
       IntegrityLevel integrity_level) override;
   virtual ResultCode SetAppContainer(const wchar_t* sid) override;
   virtual ResultCode SetCapability(const wchar_t* sid) override;
+  virtual ResultCode SetLowBox(const wchar_t* sid) override;
   virtual ResultCode SetProcessMitigations(MitigationFlags flags) override;
   virtual MitigationFlags GetProcessMitigations() override;
   virtual ResultCode SetDelayedProcessMitigations(
       MitigationFlags flags) override;
   virtual MitigationFlags GetDelayedProcessMitigations() const override;
   virtual void SetStrictInterceptions() override;
   virtual ResultCode SetStdoutHandle(HANDLE handle) override;
   virtual ResultCode SetStderrHandle(HANDLE handle) override;
   virtual ResultCode AddRule(SubSystem subsystem, Semantics semantics,
                              const wchar_t* pattern) override;
@@ skipping 10 matching lines @@
   // Creates a Job object with the level specified in a previous call to
   // SetJobLevel().
   ResultCode MakeJobObject(HANDLE* job);
 
   // Creates the two tokens with the levels specified in a previous call to
   // SetTokenLevel().
   ResultCode MakeTokens(HANDLE* initial, HANDLE* lockdown);
 
   const AppContainerAttributes* GetAppContainer() const;
 
+  const PSID GetLowBoxSid() const;
+
   // Adds a target process to the internal list of targets. Internally a
   // call to TargetProcess::Init() is issued.
   bool AddTarget(TargetProcess* target);
 
   // Called when there are no more active processes in a Job.
   // Removes a Job object associated with this policy and the target associated
   // with the job.
   bool OnJobEmpty(HANDLE job);
 
   EvalResult EvalPolicy(int service, CountedParameterSetBase* params);
@@ skipping 52 matching lines @@
   // Memory structure that stores the low level policy.
   PolicyGlobal* policy_;
   // The list of dlls to unload in the target process.
   std::vector<base::string16> blacklisted_dlls_;
   // This is a map of handle-types to names that we need to close in the
   // target process. A null set means we need to close all handles of the
   // given type.
   HandleCloser handle_closer_;
   std::vector<base::string16> capabilities_;
   scoped_ptr<AppContainerAttributes> appcontainer_list_;
+  PSID lowbox_sid_;

[cpu_(ooo_6.6-7.5), 2015/02/28 02:13:53]

instead pointer to sid?  we don't use PHANDLE for example.

[Shrikant Kelkar, 2015/02/28 02:33:47]

Sorry, didn't understand. We need PSID for CreateLowBoxToken.

 
   static HDESK alternate_desktop_handle_;
   static HWINSTA alternate_winstation_handle_;
   static IntegrityLevel alternate_desktop_integrity_level_label_;
 
   DISALLOW_COPY_AND_ASSIGN(PolicyBase);
 };
 
 }  // namespace sandbox
 
 #endif  // SANDBOX_WIN_SRC_SANDBOX_POLICY_BASE_H_