Adding method to create process using LowBox token in sandbox code.

content/common/sandbox_win.cc

Index: content/common/sandbox_win.cc
diff --git a/content/common/sandbox_win.cc b/content/common/sandbox_win.cc
index a3882d0d1dd709d581f695f2c990e6ee18ab0bbb..041d1b53edf92c5b991326a5dc0c667e4941a4a6 100644
--- a/content/common/sandbox_win.cc
+++ b/content/common/sandbox_win.cc
@@ -533,6 +533,23 @@ void AddBaseHandleClosePolicy(sandbox::TargetPolicy* policy) {
   policy->AddKernelObjectToClose(L"Section", object_path.data());
 }
 
+void AddAppContainerPolicy(sandbox::TargetPolicy* policy) {
+  if (base::win::GetVersion() < base::win::VERSION_WIN8)
+    return;
+  DCHECK(g_broker_services);
+  // Reviewers: This doesn't seem to be right place for installing

[forshaw, 2015/02/20 11:38:02]

Based on my original testing I don't believe you need to install the
appcontainer sid on the system for it to work (at least when using
NtCreateLowBoxToken). We should be able to generate a per-process appcontainer
SID using a simple incrementing counter. For example something like this seems
to work:

static unsigned int per_process_rid = 0;
  
std::wstring app_container_sid = base::StringPrintf(
	L"S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-"
	L"924012148-%u", per_process_rid++);
  
policy->SetAppContainer(app_container_sid.c_str());

Also how was the original appcontainer sid generated? We want to ensure it isn't
likely to conflict with anything in use.

[Shrikant Kelkar, 2015/02/21 02:32:40]

Appended GUID, ptal.

+  // an appcontainer please suggest one. Ideally we may want to create
+  // appcontainer per site
+  const wchar_t kAppContainerName[] = L"sbox_chromium";
+  const wchar_t kAppContainerSid[] =
+  L"S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-"
+  L"924012148-2839372144";
+  // Install will only register if appcontainer is not already there.
+  g_broker_services->InstallAppContainer(kAppContainerSid, kAppContainerName);
+
+  policy->SetAppContainer(kAppContainerSid);
+}
+
 bool InitBrokerServices(sandbox::BrokerServices* broker_services) {
   // TODO(abarth): DCHECK(CalledOnValidThread());
   //               See <http://b/1287166>.