Adding method to create process using LowBox token in sandbox code.

sandbox/win/src/app_container_test.cc

Index: sandbox/win/src/app_container_test.cc
diff --git a/sandbox/win/src/app_container_test.cc b/sandbox/win/src/app_container_test.cc
index 1bfab2c3145b3c91a69634049d9c652c480770c8..afb6fde265a0fe71d8f4b12235a2882668ed4afa 100644
--- a/sandbox/win/src/app_container_test.cc
+++ b/sandbox/win/src/app_container_test.cc
@@ -141,4 +141,25 @@ TEST(AppContainerTest, RequiresImpersonation) {
             runner.GetPolicy()->SetAppContainer(kAppContainerSid));
 }
 
+// We are treating LowBox as another approach for launching appcontainer.
+// For convenience including LowBox tests inside this file.

[rvargas (doing something else), 2015/02/28 01:10:06]

nit: remove lines 144-45

[Shrikant Kelkar, 2015/02/28 01:55:41]

Done.

+// We expect TEST_DENIED because when we setup appcontainer through lowbox way

[rvargas (doing something else), 2015/02/28 01:10:06]

nit: Actually, I think we can remove the whole comment.

[Shrikant Kelkar, 2015/02/28 01:55:41]

Done.

+// we are missing out on some initial setup of BNO and things like that, which
+// seem to force NtOpenEvent to look for the object only inside
+// AppContainerBasedNameObject namespace, where it doesn't find the required
+// object.
+TEST(AppContainerTest, DenyOpenEventForLowBox) {
+  if (base::win::OSInfo::GetInstance()->version() < base::win::VERSION_WIN8)
+    return;
+
+  TestRunner runner(JOB_UNPROTECTED, USER_UNPROTECTED, USER_UNPROTECTED);
+
+  base::win::ScopedHandle event(CreateEvent(NULL, FALSE, FALSE, L"test"));
+  ASSERT_TRUE(event.IsValid());
+
+  EXPECT_EQ(SBOX_ALL_OK, runner.GetPolicy()->SetLowBox(kAppContainerSid));
+
+  EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"Event_Open f test"));
+}

[rvargas (doing something else), 2015/02/28 01:10:06]

caveat: missing more tests for a future CL (as in, a test with USER_LOCKDOWN
which is what this CL promises to provide). Maybe a TODO is in order :)

[Shrikant Kelkar, 2015/02/28 01:55:41]

Done.

+
 }  // namespace sandbox