Add a sandbox policy for duplicating handles into the broker.

sandbox/src/sandbox_policy.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_SRC_SANDBOX_POLICY_H_
 #define SANDBOX_SRC_SANDBOX_POLICY_H_
 
 #include <string>
 
 #include "base/basictypes.h"
@@ skipping 124 matching lines @@
   // Allowable semantics when a rule is matched.
   enum Semantics {
     FILES_ALLOW_ANY,       // Allows open or create for any kind of access that
                            // the file system supports.
     FILES_ALLOW_READONLY,  // Allows open or create with read access only.
     FILES_ALLOW_QUERY,     // Allows access to query the attributes of a file.
     FILES_ALLOW_DIR_ANY,   // Allows open or create with directory semantics
                            // only.
     HANDLES_DUP_ANY,       // Allows duplicating handles opened with any
                            // access permissions.
+    HANDLES_DUP_BROKER,    // Allows duplicating handles to the broker process.
     NAMEDPIPES_ALLOW_ANY,  // Allows creation of a named pipe.
     PROCESS_MIN_EXEC,      // Allows to create a process with minimal rights
                            // over the resulting process and thread handles.
                            // No other parameters besides the command line are
                            // passed to the child process.
     PROCESS_ALL_EXEC,      // Allows the creation of a process and return fill
                            // access on the returned handles.
                            // This flag can be used only when the main token of
                            // the sandboxed application is at least INTERACTIVE.
     EVENTS_ALLOW_ANY,      // Allows the creation of an event with full access.
@@ skipping 25 matching lines @@
   // A NULL value for handle_name indicates all handles of the specified type.
   // An empty string for handle_name indicates the handle is unnamed.
   virtual ResultCode AddKernelObjectToClose(const wchar_t* handle_type,
                                             const wchar_t* handle_name) = 0;
 };
 
 }  // namespace sandbox
 
 
 #endif  // SANDBOX_SRC_SANDBOX_POLICY_H_