Adding method to create process using LowBox token in sandbox code.

base/win/object_watcher.cc

Index: base/win/object_watcher.cc
diff --git a/base/win/object_watcher.cc b/base/win/object_watcher.cc
index fe209f5e3385ba58b496c56f8f9418c4391e8b57..efa133a2828978b572564aefdae56d09036a2704 100644
--- a/base/win/object_watcher.cc
+++ b/base/win/object_watcher.cc
@@ -6,6 +6,7 @@
 
 #include "base/bind.h"
 #include "base/logging.h"
+#include "base/win/windows_version.h"
 
 namespace base {
 namespace win {
@@ -34,6 +35,10 @@ bool ObjectWatcher::StartWatching(HANDLE object, Delegate* delegate) {
   // result back to this thread, we can just run on a Windows wait thread.
   DWORD wait_flags = WT_EXECUTEINWAITTHREAD | WT_EXECUTEONLYONCE;
 
+  if (base::win::GetVersion() > base::win::VERSION_XP) {
+    wait_flags |= WT_TRANSFER_IMPERSONATION;

[forshaw, 2015/02/20 11:38:02]

What's the reason being this change? Currently it's leaving a handle to the
original impersonation token lying around which is pretty dangerous. Also I'm
not sure it would actually work because the threadpool wouldn't be able to
reassign the impersonation token afterwards. 

If I remove the line I can't see any obvious problem occurring.

[Shrikant Kelkar, 2015/02/21 02:32:40]

Removed.. During initial checks, I think chrome_elf or someone similar threw
error here because I thought that time it ended up using process impersonation
token and after this flag error went away, but will remove it if it is not
causing issues and if one of our dlls fail here will fix that instead.

+  }
+
   // DoneWaiting can be synchronously called from RegisterWaitForSingleObject,
   // so set up all state now.
   callback_ = base::Bind(&ObjectWatcher::Signal, weak_factory_.GetWeakPtr(),