Adding lowbox condition to IsTokenCacheable function.

sandbox/win/src/broker_services.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/broker_services.h"
 
 #include <AclAPI.h>
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 70 matching lines @@
     NOTREACHED();
   }
 }
 
 // Utility function to determine whether a token for the specified policy can
 // be cached.
 bool IsTokenCacheable(const sandbox::PolicyBase* policy) {
   const sandbox::AppContainerAttributes* app_container =
       policy->GetAppContainer();
 
-  // We cannot cache tokens with an app container.
-  if (app_container)
+  // We cannot cache tokens with an app container or lowbox.
+  if (app_container || policy->GetLowBoxSid())
     return false;
 
   return true;
 }
 
 // Utility function to pack token values into a key for the cache map.
 uint32_t GenerateTokenCacheKey(const sandbox::PolicyBase* policy) {
   const size_t kTokenShift = 3;
   uint32_t key;
 
@@ skipping 487 matching lines @@
     return SBOX_ERROR_UNSUPPORTED;
 
   base::string16 name = LookupAppContainer(sid);
   if (name.empty())
     return SBOX_ERROR_INVALID_APP_CONTAINER;
 
   return DeleteAppContainer(sid);
 }
 
 }  // namespace sandbox